Fudge apparmor

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.devcontainer/setup-ha.sh

@@ -506,11 +506,16 @@ configure_and_start_teslamate() {
     if [ "$state" = "started" ]; then
       break
     fi
+    if [ "$state" = "error" ]; then
+      dump_diagnostics 50
+      err "TeslaMate addon failed to start (state: ${state})"
+    fi
     debug "Attempt $((attempt + 1))/${max_attempts}: TeslaMate state=${state}"
     sleep 5
     attempt=$((attempt + 1))
   done
   if [ "$state" != "started" ]; then
+    dump_diagnostics 50
     err "TeslaMate addon did not start in time (state: ${state})"
   fi
 
@@ -518,23 +523,52 @@ configure_and_start_teslamate() {
   ok "TeslaMate addon started and ready"
 }
 
+# dump_diagnostics() prints PostgreSQL and TeslaMate add-on logs (full lines) so
+# a startup failure shows its real cause. PostgreSQL is reported first because
+# TeslaMate halts if it cannot reach the database, so a stopped/crashed postgres
+# addon is the most common root cause. Closes any open GitHub Actions log group
+# first so the output is never hidden inside a collapsed fold.
+dump_diagnostics() {
+  local lines="${1:-50}"
+  group_end
+
+  local pg_state
+  pg_state=$(supervisor_api_jq "/addons/${POSTGRES_SLUG}/info" '.data.state' 2>/dev/null || true)
+  warn "PostgreSQL addon state: ${pg_state:-unknown}"
+  warn "Last ${lines} lines of PostgreSQL add-on logs:"
+  supervisor_api GET "/addons/${POSTGRES_SLUG}/logs" 2>/dev/null | tail -n "${lines}" >&2 || true
+
+  warn "Last ${lines} lines of TeslaMate add-on logs:"
+  supervisor_api GET "/addons/${TESLAMATE_SLUG}/logs" 2>/dev/null | tail -n "${lines}" >&2 || true
+}
+
 wait_for_teslamate_ready() {
   log "Waiting for TeslaMate to be ready (listening on port ${TESLAMATE_PORT})..."
   local max_attempts=60
   local attempt=0
+  local logs state
   while [ "$attempt" -lt "$max_attempts" ]; do
-    local logs
     logs=$(supervisor_api GET "/addons/${TESLAMATE_SLUG}/logs" 2>/dev/null || true)
     if echo "$logs" | grep -q "TeslaMateWeb.Endpoint"; then
       ok "TeslaMate is ready"
       return 0
     fi
-    if [ "$DEBUG" = "1" ]; then
-      debug "Attempt $((attempt + 1))/${max_attempts}: endpoint not up yet; last log: $(echo "$logs" | tail -n 1)"
+
+    # TeslaMate's s6 finish script halts the whole container if the service
+    # exits non-zero, so a crash during startup shows up as the add-on leaving
+    # the "started" state. Detect that and fail immediately with the real logs
+    # instead of polling uselessly until the timeout.
+    state=$(supervisor_api_jq "/addons/${TESLAMATE_SLUG}/info" '.data.state')
+    if [ "$state" = "error" ] || [ "$state" = "stopped" ]; then
+      dump_diagnostics 50
+      err "TeslaMate crashed during startup (add-on state: ${state})"
     fi
+
+    debug "Attempt $((attempt + 1))/${max_attempts}: endpoint not up yet (state=${state})"
     sleep 5
     attempt=$((attempt + 1))
   done
+  dump_diagnostics 50
   err "TeslaMate did not become ready in time (never saw 'TeslaMateWeb.Endpoint' in logs)"
 }
 

.github/workflows/integration-test.yaml

@@ -48,10 +48,20 @@ jobs:
             fi
             echo "::endgroup::" >&2
             echo "::group::Start Supervisor" >&2
+            # AppArmor profile enforcement on add-on containers makes the
+            # PostgreSQL add-on's first-boot initdb file I/O so slow it blows
+            # past that add-on's hard 2-minute startup timeout on GitHub Actions
+            # runners. SUPERVISOR_UNCONFINED only unconfines the Supervisor
+            # itself, not the add-ons it launches, so instead stub apparmor_parser
+            # to a no-op and mount it into the Supervisor's privileged container.
+            # Add-on profiles are then never loaded and add-ons run effectively
+            # unconfined (matches the proven ha-addon-ghostfolio CI setup).
+            printf '#!/bin/sh\nexit 0\n' | sudo tee /usr/sbin/apparmor_parser > /dev/null && sudo chmod +x /usr/sbin/apparmor_parser
+            sudo sed -i 's|docker run --rm --privileged|docker run --rm --privileged -v /usr/sbin/apparmor_parser:/usr/sbin/apparmor_parser:ro|' /usr/bin/supervisor_run
             if [ -n "${DEBUG:-}" ]; then
-              SUPERVISOR_UNCONFINED=1 supervisor_run &
+              supervisor_run &
             else
-              SUPERVISOR_UNCONFINED=1 supervisor_run > /dev/null 2>&1 &
+              supervisor_run > /dev/null 2>&1 &
             fi
             echo "::endgroup::" >&2
             bash .devcontainer/setup-ha.sh

rootfs/etc/s6-overlay/s6-rc.d/teslamate/run

@@ -52,9 +52,34 @@ for env_var in $(bashio::config 'env_vars|keys'); do
     export "${name}=${value}"
 done
 
+# Wait for PostgreSQL to be ready before continuing. The add-on can start
+# before the database is accepting connections (e.g. on a Home Assistant reboot
+# when both add-ons start together, or under load in CI), so retry instead of
+# failing immediately - TeslaMate has no built-in retry for this pre-check and
+# the s6 finish script would otherwise halt the whole add-on.
+bashio::log.info "Waiting for PostgreSQL at '$DATABASE_HOST:$DATABASE_PORT'..."
+pg_wait_attempt=0
+pg_wait_max=30
+until pg_isready -h "$DATABASE_HOST" -p "$DATABASE_PORT" > /dev/null 2>&1; do
+  pg_wait_attempt=$((pg_wait_attempt + 1))
+  if [[ "$pg_wait_attempt" -ge "$pg_wait_max" ]]; then
+    bashio::log.error "PostgreSQL at '$DATABASE_HOST' is not ready or unreachable after $((pg_wait_max * 2))s"
+    # Distinguish a DNS/networking problem from a database that is simply down,
+    # so the failure is actionable: resolve the host and report what we find.
+    if getent hosts "$DATABASE_HOST" > /dev/null 2>&1; then
+      bashio::log.error "Host '$DATABASE_HOST' resolves to $(getent hosts "$DATABASE_HOST" | awk '{print $1}' | tr '\n' ' ')but is not accepting connections on port $DATABASE_PORT - is the PostgreSQL add-on running and healthy?"
+    else
+      bashio::log.error "Host '$DATABASE_HOST' does not resolve - the PostgreSQL add-on may be stopped or on a different network"
+    fi
+    exit 1
+  fi
+  bashio::log.info "PostgreSQL not ready yet, retrying in 2s (${pg_wait_attempt}/${pg_wait_max})..."
+  sleep 2
+done
+bashio::log.info "PostgreSQL is ready"
+
 # Create the PostgreSQL database if it doesn't exist
 bashio::log.info "Checking for database '$DATABASE_NAME' on $DATABASE_HOST"
-if pg_isready -h "$DATABASE_HOST" -p "$DATABASE_PORT" > /dev/null 2>&1; then
 # Check the version of PostgreSQL database is v16.7 or later or v17.3 or later
 pg_version=$(PGPASSWORD="$DATABASE_PASS" psql -h "$DATABASE_HOST" -p "$DATABASE_PORT" -U "$DATABASE_USER" postgres -Atqc "SELECT regexp_replace(version(), 'PostgreSQL ([^ ]+) .*', '\\1') AS version")
 major_version=$(echo "$pg_version" | cut -d '.' -f 1)
@@ -87,10 +112,6 @@ if pg_isready -h "$DATABASE_HOST" -p "$DATABASE_PORT" > /dev/null 2>&1; then
     exit 1
   fi
 fi
-else
-  bashio::log.error "PostgreSQL at '$DATABASE_HOST' is not ready or unreachable"
-  exit 1
-fi
 
 # Import dashboards
 if bashio::config.true 'grafana_import_dashboards'; then