From 3c658fa32d537cbd65a5ea5bf8d8af90b49f1c19 Mon Sep 17 00:00:00 2001
From: Albrecht Degering <albrecht@degering.name>
Date: Fri, 31 Jul 2026 22:48:06 +0200
Subject: [PATCH] Harden worker queue and restore drill defaults

---
 .../checks/module-installer-rollback-drill.py | 27 ++++++++++++++++++-
 tools/deployment/govoplan_deploy/bundle.py    |  6 ++---
 tools/launch/launch-production-like-dev.sh    |  2 +-
 3 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/tools/checks/module-installer-rollback-drill.py b/tools/checks/module-installer-rollback-drill.py
index cbbb1e9..bed70a3 100644
--- a/tools/checks/module-installer-rollback-drill.py
+++ b/tools/checks/module-installer-rollback-drill.py
@@ -14,6 +14,7 @@ import sys
 import tempfile
 from collections.abc import Callable, Iterable
 from contextlib import contextmanager
+from datetime import UTC, datetime
 from pathlib import Path
 from types import SimpleNamespace
 from typing import Any
@@ -65,6 +66,11 @@ def main() -> int:
     parser.add_argument("--runtime-root", type=Path, help="Directory for temporary drill runtimes. Defaults to a new temp directory.")
     parser.add_argument("--keep-runtime", action="store_true", help="Keep the temporary drill runtime after completion.")
     parser.add_argument("--format", choices=("json", "text"), default="text", help="Output format.")
+    parser.add_argument(
+        "--evidence-path",
+        type=Path,
+        help="Write an atomic machine-readable drill result for the Ops health surface.",
+    )
     args = parser.parse_args()
 
     runtime_root = args.runtime_root or Path(tempfile.mkdtemp(prefix="govoplan-installer-drill-"))
@@ -88,7 +94,14 @@ def main() -> int:
         if not args.keep_runtime and args.runtime_root is None:
             shutil.rmtree(runtime_root, ignore_errors=True)
 
-    payload = {"ok": ok, "runtime_root": str(runtime_root), "scenarios": results}
+    payload = {
+        "ok": ok,
+        "completed_at": datetime.now(tz=UTC).isoformat(),
+        "runtime_root": str(runtime_root),
+        "scenarios": results,
+    }
+    if args.evidence_path:
+        _write_evidence(args.evidence_path, payload)
     if args.format == "json":
         print(json.dumps(payload, indent=2, sort_keys=True))
     else:
@@ -105,6 +118,18 @@ def main() -> int:
     return 0 if ok else 1
 
 
+def _write_evidence(path: Path, payload: dict[str, object]) -> None:
+    path = path.expanduser()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    temporary = path.with_suffix(path.suffix + ".tmp")
+    temporary.write_text(
+        json.dumps(payload, indent=2, sort_keys=True) + "\n",
+        encoding="utf-8",
+    )
+    temporary.chmod(0o600)
+    temporary.replace(path)
+
+
 def package_failure(root: Path) -> dict[str, object]:
     database_url, database = _sqlite_database(root)
     plan = _saved_install_plan(database, "package-failure-example")
diff --git a/tools/deployment/govoplan_deploy/bundle.py b/tools/deployment/govoplan_deploy/bundle.py
index c9936b8..c878ab5 100644
--- a/tools/deployment/govoplan_deploy/bundle.py
+++ b/tools/deployment/govoplan_deploy/bundle.py
@@ -172,7 +172,7 @@ def reconcile_runtime_environment(
             "ENABLED_MODULES": ",".join(spec.enabled_modules),
             "CELERY_ENABLED": "true" if redis.mode != "disabled" else "false",
             "CELERY_QUEUES": (
-                "send_email,append_sent,notifications,calendar,dataflow,workflow,events,default"
+                "send_email,append_sent,notifications,mail,calendar,dataflow,workflow,postbox,events,idm,default"
             ),
             "CORS_ORIGINS": spec.public_url,
             "GOVOPLAN_TRUSTED_HOSTS": public.hostname or "",
@@ -465,8 +465,8 @@ def render_compose(spec: InstallationSpec) -> dict[str, object]:
                 "worker",
                 "--queues",
                 (
-                    "send_email,append_sent,notifications,calendar,"
-                    "dataflow,events,default"
+                    "send_email,append_sent,notifications,mail,calendar,"
+                    "dataflow,workflow,postbox,events,idm,default"
                 ),
                 "--loglevel",
                 "INFO",
diff --git a/tools/launch/launch-production-like-dev.sh b/tools/launch/launch-production-like-dev.sh
index a28eddd..ffa9071 100644
--- a/tools/launch/launch-production-like-dev.sh
+++ b/tools/launch/launch-production-like-dev.sh
@@ -56,7 +56,7 @@ export DATABASE_URL="${DATABASE_URL:-${GOVOPLAN_PRODUCTION_LIKE_DATABASE_URL:-po
 export GOVOPLAN_DATABASE_URL_PGTOOLS="${GOVOPLAN_DATABASE_URL_PGTOOLS:-${GOVOPLAN_PRODUCTION_LIKE_DATABASE_URL_PGTOOLS:-postgresql://govoplan:govoplan-dev@127.0.0.1:55433/govoplan}}"
 export REDIS_URL="${REDIS_URL:-${GOVOPLAN_PRODUCTION_LIKE_REDIS_URL:-redis://127.0.0.1:56379/0}}"
 export CELERY_ENABLED="${CELERY_ENABLED:-true}"
-export CELERY_QUEUES="${CELERY_QUEUES:-send_email,append_sent,notifications,calendar,workflow,default}"
+export CELERY_QUEUES="${CELERY_QUEUES:-send_email,append_sent,notifications,mail,calendar,dataflow,workflow,postbox,events,idm,default}"
 export FILE_STORAGE_BACKEND="${FILE_STORAGE_BACKEND:-local}"
 export FILE_STORAGE_LOCAL_ROOT="${FILE_STORAGE_LOCAL_ROOT:-$META_ROOT/runtime/production-like/files}"
 export DEV_AUTO_MIGRATE_ENABLED="${DEV_AUTO_MIGRATE_ENABLED:-false}"