chore(docker): env2 runs its own image tag, leader-auto-down overlay, drill targets env2 (#116)

- docker/build.sh: SCADABRIDGE_IMAGE picks the tag (default scadabridge:latest).
- docker-env2/docker-compose.yml: node image is ${SCADABRIDGE_IMAGE:-scadabridge:latest},
  so env2 can run its own build without retagging the primary rig's image.
- docker-env2/docker-compose.leader-auto-down.yml: opt-in overlay for both env2 pairs,
  mirroring docker/docker-compose.leader-auto-down.yml. Shipped default stays auto-down.
- docker/failover-drill.sh: DRILL_ENV=primary|env2 (container prefix, Traefik :9100,
  pair site-x).

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

docker-env2/deploy.sh

@@ -13,7 +13,9 @@ fi
 
 echo "=== ScadaBridge Env2 Docker Deploy ==="
 
-# Reuse the primary build (same scadabridge:latest image, same network creation)
+# Reuse the primary build (same scadabridge:latest image, same network creation).
+# SCADABRIDGE_IMAGE=<repo:tag> builds and runs env2 on its own tag instead (build.sh and
+# the compose file both read it), leaving scadabridge:latest untouched.
 "$SCRIPT_DIR/../docker/build.sh"
 
 # Ensure env2 databases exist on the shared scadabridge-mssql

docker-env2/docker-compose.leader-auto-down.yml

@@ -0,0 +1,28 @@
+# Opt-in overlay: run env2's central pair and its site-x pair on the in-repo
+# `leader-auto-down` downing provider (LeaderAutoDowningProvider, ScadaBridge#106)
+# instead of the shipped default `auto-down`. env2 is the soak environment for the
+# #116 rollout; mirrors docker/docker-compose.leader-auto-down.yml.
+#
+# The shipped default is NOT changed by this file: the mounted appsettings still say
+# `auto-down`; this overlay layers an environment override on top (env wins over JSON).
+#
+# A downing-provider change must reach both nodes of a pair at the same time - never
+# roll it one node at a time. Apply (from the main checkout, both pairs together):
+#
+#   docker compose -f docker-env2/docker-compose.yml -f docker-env2/docker-compose.leader-auto-down.yml \
+#     up -d --force-recreate --no-deps central-a central-b site-x-a site-x-b
+#
+# Revert to the default by re-running the same command without the overlay file.
+services:
+  central-a:
+    environment:
+      ScadaBridge__Cluster__SplitBrainResolverStrategy: "leader-auto-down"
+  central-b:
+    environment:
+      ScadaBridge__Cluster__SplitBrainResolverStrategy: "leader-auto-down"
+  site-x-a:
+    environment:
+      ScadaBridge__Cluster__SplitBrainResolverStrategy: "leader-auto-down"
+  site-x-b:
+    environment:
+      ScadaBridge__Cluster__SplitBrainResolverStrategy: "leader-auto-down"

docker-env2/docker-compose.yml

@@ -8,9 +8,13 @@
 x-secrets-store-env: &secrets-store-env
   Secrets__SqlitePath: "/data/scadabridge-secrets.db"
 
+# Node image: ${SCADABRIDGE_IMAGE:-scadabridge:latest}. Unset = the primary rig's shared
+# image (the historic behaviour). Set SCADABRIDGE_IMAGE (same variable docker/build.sh
+# tags with) to run env2 on its own build, e.g. SCADABRIDGE_IMAGE=scadabridge:env2-116,
+# so an env2 rebuild never retags the image the primary rig's containers run.
 services:
   central-a:
-    image: scadabridge:latest
+    image: ${SCADABRIDGE_IMAGE:-scadabridge:latest}
     # An init process (tini) as PID 1, so a crashed dotnet process actually dies
     # instead of wedging the container at 100% CPU with the restart policy never
     # firing — mirrors docker/docker-compose.yml's init: true (ScadaBridge#34).
@@ -75,7 +79,7 @@ services:
     restart: unless-stopped
 
   central-b:
-    image: scadabridge:latest
+    image: ${SCADABRIDGE_IMAGE:-scadabridge:latest}
     init: true  # PID-1 crash wedge, ScadaBridge#34 — see central-a
     # CoordinatedShutdown needs cluster-leave (15s budget) + cluster-exiting +
     # actor-system-terminate + Serilog flush; the 10s SIGTERM default SIGKILLed
@@ -137,7 +141,7 @@ services:
     restart: unless-stopped
 
   site-x-a:
-    image: scadabridge:latest
+    image: ${SCADABRIDGE_IMAGE:-scadabridge:latest}
     init: true  # PID-1 crash wedge, ScadaBridge#34 — see central-a
     # CoordinatedShutdown needs cluster-leave (15s budget) + cluster-exiting +
     # actor-system-terminate + Serilog flush; the 10s SIGTERM default SIGKILLed
@@ -166,7 +170,7 @@ services:
     restart: unless-stopped
 
   site-x-b:
-    image: scadabridge:latest
+    image: ${SCADABRIDGE_IMAGE:-scadabridge:latest}
     init: true  # PID-1 crash wedge, ScadaBridge#34 — see central-a
     # CoordinatedShutdown needs cluster-leave (15s budget) + cluster-exiting +
     # actor-system-terminate + Serilog flush; the 10s SIGTERM default SIGKILLed