Issue Deploying Two Rails Applications with Shared Postgres Accessory

[albertski]

I have two separate Rails applications setup up to deploy with Kamal 2 to the same server, both using Postgres.

Application 1 deploy.yml

# Name of your application. Used to uniquely configure containers.
service: siteone

<% require "dotenv"; Dotenv.load(".env") %>

# Name of the container image.
image: albertski/siteone

# Deploy to these servers.
servers:
  web:
    - <%= ENV['KAMAL_SERVER'] %>

# Enable SSL auto certification via Let's Encrypt (and allow for multiple apps on one server).
# If using something like Cloudflare, it is recommended to set encryption mode
# in Cloudflare's SSL/TLS setting to "Full" to enable end-to-end encryption.
proxy:
  ssl: true
  host: siteone.com
  app_port: 80
  healthcheck:
    path: /up
    interval: 7
    timeout: 49

# Credentials for your image host.
registry:
  # Specify the registry server, if you're not using Docker Hub
  # server: registry.digitalocean.com / ghcr.io / ...
  username:
    - KAMAL_REGISTRY_USERNAME

  # Always use an access token rather than real password (pulled from .kamal/secrets).
  password:
    - KAMAL_REGISTRY_PASSWORD

# Configure builder setup.
builder:
  arch: amd64
  secrets:
    - KAMAL_REGISTRY_USERNAME
    - KAMAL_REGISTRY_PASSWORD

# Inject ENV variables into containers (secrets come from .kamal/secrets).
#
env:
  clear:
    DB_HOST: KAMAL_SERVER
  secret:
    - RAILS_LOG_LEVEL
    - RAILS_MASTER_KEY
    - KAMAL_REGISTRY_PASSWORD
    - KAMAL_REGISTRY_USERNAME
    - POSTGRES_USER
    - POSTGRES_DB
    - POSTGRES_PASSWORD
    - POSTGRES_HOST
    - REDIS_URL

# Aliases are triggered with "bin/kamal <alias>". You can overwrite arguments on invocation:
# "bin/kamal logs -r job" will tail logs from the first server in the job section.
#
aliases:
  console: app exec -r -i "bundle exec rails console"
  shell: app exec -i bash
  logs: app logs -f

# Use a different ssh user than root
#
# ssh:
#   user: app

# Use a persistent storage volume.
#
# volumes:
#   - "app_storage:/app/storage"

# Bridge fingerprinted assets, like JS and CSS, between versions to avoid
# hitting 404 on in-flight requests. Combines all files from new and old
# version inside the asset_path.
#
asset_path: /rails/public/assets

# Configure rolling deploys by setting a wait time between batches of restarts.
#
# boot:
#   limit: 10 # Can also specify as a percentage of total hosts, such as "25%"
#   wait: 2

# Use accessory services (secrets come from .kamal/secrets).
#
accessories:
  db:
    image: postgres:16
    host: <%= ENV['KAMAL_SERVER'] %>
    port: 5432
    env:
      secret:
        - POSTGRES_USER
        - POSTGRES_DB
        - POSTGRES_PASSWORD
        - POSTGRES_HOST
    directories:
      - data:/var/lib/postgresql/data
  redis:
    image: redis:7.0
    host: <%= ENV['KAMAL_SERVER'] %>
    port: 6379
    directories:
      - data:/data

Application 2 deploy.yml

# Name of your application. Used to uniquely configure containers.
service: sitetwo

<% require "dotenv"; Dotenv.load(".env") %>

# Name of the container image.
image: albertski/sitetwo

# Deploy to these servers.
servers:
  web:
    - <%= ENV['KAMAL_SERVER'] %>

# Enable SSL auto certification via Let's Encrypt (and allow for multiple apps on one server).
# If using something like Cloudflare, it is recommended to set encryption mode
# in Cloudflare's SSL/TLS setting to "Full" to enable end-to-end encryption.
proxy:
  ssl: true
  host: sitetwo.net
  app_port: 80
  healthcheck:
    path: /up
    interval: 7
    timeout: 49

# Credentials for your image host.
registry:
  # Specify the registry server, if you're not using Docker Hub
  # server: registry.digitalocean.com / ghcr.io / ...
  username:
    - KAMAL_REGISTRY_USERNAME

  # Always use an access token rather than real password (pulled from .kamal/secrets).
  password:
    - KAMAL_REGISTRY_PASSWORD

# Configure builder setup.
builder:
  arch: amd64
  secrets:
    - KAMAL_REGISTRY_USERNAME
    - KAMAL_REGISTRY_PASSWORD

# Inject ENV variables into containers (secrets come from .kamal/secrets).
#
env:
  clear:
    DB_HOST: KAMAL_SERVER
  secret:
    - RAILS_LOG_LEVEL
    - RAILS_MASTER_KEY
    - KAMAL_REGISTRY_PASSWORD
    - KAMAL_REGISTRY_USERNAME
    - POSTGRES_USER
    - POSTGRES_DB
    - POSTGRES_PASSWORD
    - POSTGRES_HOST
    - REDIS_URL

# Aliases are triggered with "bin/kamal <alias>". You can overwrite arguments on invocation:
# "bin/kamal logs -r job" will tail logs from the first server in the job section.
#
aliases:
  console: app exec -r -i "bundle exec rails console"
  shell: app exec -i bash
  logs: app logs -f

# Use a different ssh user than root
#
# ssh:
#   user: app

# Use a persistent storage volume.
#
# volumes:
#   - "app_storage:/app/storage"

# Bridge fingerprinted assets, like JS and CSS, between versions to avoid
# hitting 404 on in-flight requests. Combines all files from new and old
# version inside the asset_path.
#
asset_path: /rails/public/assets

# Configure rolling deploys by setting a wait time between batches of restarts.
#
# boot:
#   limit: 10 # Can also specify as a percentage of total hosts, such as "25%"
#   wait: 2

# Use accessory services (secrets come from .kamal/secrets).
#
accessories:
  db:
    image: postgres:16
    host: <%= ENV['KAMAL_SERVER'] %>
    port: 5432
    env:
      secret:
        - POSTGRES_USER
        - POSTGRES_DB
        - POSTGRES_PASSWORD
        - POSTGRES_HOST
    directories:
      - data:/var/lib/postgresql/data
  redis:
    image: redis:7.0
    host: <%= ENV['KAMAL_SERVER'] %>
    port: 6379
    directories:
      - data:/data

I deployed the first application without any issues. However, when I try to deploy the second one, I get the following error:

docker: Error response from daemon: driver failed programming external connectivity on endpoint sitetwo-db (411887e3a990cf26d1a3abb5710d1838c5c51b87ac2234c3607e1f76efa41ab3): Bind for 0.0.0.0:5432 failed: port is already allocated.

It seems like the second application is attempting to reinstall or reconfigure the same Postgres accessory. How can I configure both applications to use the same Postgres accessory while keeping their database credentials separate?

[hundredwatt]

You need to configure the accessory only for 1 of the applications.

If you want separate credentials, you can manually login into the db after its booted and create a 2nd user for the other application

[albertski]

Thank you @hundredwatt. Why didn't I think of that. That did end up working.

I did the following:

• Removed accessories from my second application's deploy.yml
• I ran the following queries to create the second database credentials (I logged into my first application's database):

CREATE USER second_app_user WITH PASSWORD 'pa$$word';
GRANT ALL PRIVILEGES ON DATABASE second_app_database TO second_app_user;
GRANT USAGE ON SCHEMA public TO second_app_user;
GRANT CREATE ON SCHEMA public TO second_app_user;

• Ran kamal deploy on the second application

[hundredwatt]

For one use case, I created a separate config file for shared accessories. I only use it with kamal accessory ... commands. Then I configure each app like you mentioned.