Harden container deployment lifecycle

tests/unit/test_deployment_configuration.py

@@ -0,0 +1,26 @@
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_only_web_runs_migrations_in_compose() -> None:
+    for filename in ("docker-compose.yml", "docker-compose.unraid.yml"):
+        compose = yaml.safe_load((ROOT / filename).read_text(encoding="utf-8"))
+        services = compose["services"]
+
+        assert (
+            services["web"].get("environment", {}).get("VACATURERADAR_RUN_MIGRATIONS", "1") == "1"
+        )
+        assert services["worker"]["environment"]["VACATURERADAR_RUN_MIGRATIONS"] == "0"
+        assert services["scheduler"]["environment"]["VACATURERADAR_RUN_MIGRATIONS"] == "0"
+
+
+def test_runtime_is_compatible_with_read_only_container() -> None:
+    dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
+    deploy_script = (ROOT / "scripts" / "deploy_docker.sh").read_text(encoding="utf-8")
+
+    assert '"--no-control-socket"' in dockerfile
+    assert "exec -T web python manage.py collectstatic" not in deploy_script
+    assert "for required_host in 127.0.0.1 localhost" in deploy_script