From 6044637f123dfe07b742932788aec616a6bf7263 Mon Sep 17 00:00:00 2001
From: "CanbiZ (MickLesk)" <47820557+MickLesk@users.noreply.github.com>
Date: Mon, 27 Apr 2026 13:31:02 +0200
Subject: [PATCH] Dawarich: run db:migrate before assets:precompile (#14051)

* fix(dawarich): run db:migrate before assets:precompile

In Rails production, eager loading during assets:precompile can execute
DB queries. Dawarich 1.7.0 adds new tables (monthly digest email
preferences, S3 storage settings). Running precompile before migrate
causes 'Operation not permitted' / exit code 1 when those tables do
not exist yet.

Reordered to: db:migrate -> assets:precompile -> data:migrate,
which is the correct Rails deployment sequence.

Fixes #14048

* add otp key
---
 ct/dawarich.sh              | 6 +++++-
 install/dawarich-install.sh | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/ct/dawarich.sh b/ct/dawarich.sh
index d2d260998..3d1ca7e02 100644
--- a/ct/dawarich.sh
+++ b/ct/dawarich.sh
@@ -53,6 +53,10 @@ function update_script() {
     export PATH="/root/.rbenv/shims:/root/.rbenv/bin:$PATH"
     eval "$(/root/.rbenv/bin/rbenv init - bash)"
 
+    if ! grep -q "OTP_ENCRYPTION_PRIMARY_KEY" /opt/dawarich/.env; then
+      echo "OTP_ENCRYPTION_PRIMARY_KEY=$(openssl rand -hex 32)" >>/opt/dawarich/.env
+    fi
+
     set -a && source /opt/dawarich/.env && set +a
 
     $STD bundle config set --local deployment 'true'
@@ -67,8 +71,8 @@ function update_script() {
       $STD npm install
     fi
 
-    $STD bundle exec rake assets:precompile
     $STD bundle exec rails db:migrate
+    $STD bundle exec rake assets:precompile
     $STD bundle exec rake data:migrate
     msg_ok "Ran Migrations"
 
diff --git a/install/dawarich-install.sh b/install/dawarich-install.sh
index 9edf3a296..34e58ded7 100644
--- a/install/dawarich-install.sh
+++ b/install/dawarich-install.sh
@@ -46,10 +46,12 @@ msg_ok "Set up Directories"
 
 msg_info "Configuring Environment"
 SECRET_KEY_BASE=$(openssl rand -hex 64)
+OTP_ENCRYPTION_PRIMARY_KEY=$(openssl rand -hex 32)
 RELEASE=$(get_latest_github_release "Freika/dawarich")
 cat <<EOF >/opt/dawarich/.env
 RAILS_ENV=production
 SECRET_KEY_BASE=${SECRET_KEY_BASE}
+OTP_ENCRYPTION_PRIMARY_KEY=${OTP_ENCRYPTION_PRIMARY_KEY}
 DATABASE_HOST=localhost
 DATABASE_USERNAME=${PG_DB_USER}
 DATABASE_PASSWORD=${PG_DB_PASS}