Load Vault before backend migrations

Dockerfile

@@ -20,4 +20,4 @@ COPY --from=build /app/src/generated ./dist/generated
 COPY --from=build /app/prisma ./prisma
 COPY --from=build /app/prisma.config.ts ./prisma.config.ts
 EXPOSE 4000
-CMD ["sh", "-c", "npm run prisma:migrate:deploy && npm run start"]
+CMD ["node", "dist/entrypoint.js"]

src/entrypoint.ts

@@ -0,0 +1,26 @@
+import { spawn } from 'node:child_process';
+
+import { loadVaultEnvironment } from './vault/env.js';
+
+function run(command: string, args: string[]): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      env: process.env,
+      stdio: 'inherit',
+    });
+
+    child.on('error', reject);
+    child.on('exit', (code) => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+
+      reject(new Error(`${command} ${args.join(' ')} exited with ${code}`));
+    });
+  });
+}
+
+await loadVaultEnvironment();
+await run('npm', ['run', 'prisma:migrate:deploy']);
+await import('./server.js');