v1.1.0

Added

• DRILL_LIVE_CONTAINER: the live database as the reference. Name the running container and the drill asks it which tables it has, then requires every one of them back from the restored dump and names the ones that did not come. A live database it cannot read fails the drill rather than reading as nothing missing, because a comparison that did not happen is not a clean result.

Changed

• DRILL_MIN_TABLES is now the fallback, and says so. A floor written by hand is a number nobody revisits: it passes for a dump that restored a fifth of the schema and keeps passing as the application grows away from it. The suite makes that concrete — the live database grows one table, the drill fails and names it, and the same dump under the old floor passes exactly as it always did.

Upgrading

git pull (or ./update.sh), then docker compose up -d. The container is recreated on the new image; the game files and .env are untouched.

Upstream calls 5.0.0 breaking because the image moved off Steam Runtime "sniper" onto steamrt4 and replaced the RCON forwarder simpleproxy with socat. Nothing in this repository had to change for it: same ports, same variables, same compose interface. The first start after the move re-verifies the game files through SteamCMD, so give it the usual long start period before calling it unhealthy.

Two new optional variables come with 5.0.0, both already at the image's own defaults. TV_RELAYVOICE is the one worth a look: it decides whether GOTV relays player voice.

Full history in CHANGELOG.md.

v1.0.0

Added

• Restores the newest dump into a throwaway database and checks the result.
  PostgreSQL and MySQL or MariaDB, from the same image the live service runs,
  on a quarterly systemd timer. The live database is never touched.
• Roles are created before the restore. pg_dump writes OWNER TO and
  never CREATE ROLE, so a dump restored into a fresh cluster errors once per
  owned object and silently reassigns ownership. The drill extracts the roles
  the dump refers to and creates them first.
• A table count, because an empty dump is valid. A gzip of a SQL script
  that creates nothing passes every integrity check there is.
  DRILL_MIN_TABLES is what catches it.
• Two stamps rather than one. last-run is written before any verdict and
  answers "is the drill still running"; last-ok only after a clean result and
  answers "is the newest backup restorable". A watcher with one of them cannot
  tell a drill that keeps failing from one that stopped.
• Ten end-to-end scenarios against real PostgreSQL and MariaDB containers,
  including the three that must fail: a truncated archive, an empty but valid
  dump, and a .partial file newer than every real backup.

Fixed

• Readiness required a liveness probe, which both images answer too early.
  PostgreSQL and MariaDB each start a temporary server to run their own
  initialisation, and pg_isready and mariadb-admin ping answer it. The
  drill went ahead before the credentials existed and failed with access
  denied. Readiness now requires an authenticated query to return a row. Found
  by the MariaDB scenarios in the test suite, on the first run that exercised
  that path — and then found a second time in the test harness itself, on the
  first CI run, where the same probe let the source database be seeded before
  it was ready and produced a twenty-byte dump that made the drill look wrong.
  Fixture failures are now loud: an empty source dump stops the run and says
  the fixture failed rather than letting nine scenarios report on nothing.