Start cloak vault for self-hosted release migrations.

Since this one is using schemas, existing encrypted columns
do require cloak to be up.

lib/plausible/data_migration/backfill_teams.ex

@@ -14,10 +14,21 @@ defmodule Plausible.DataMigration.BackfillTeams do
   end
 
   def run(opts \\ []) do
+    start_cloak()
+
     dry_run? = Keyword.get(opts, :dry_run?, true)
     Repo.transaction(fn -> backfill(dry_run?) end, timeout: :infinity)
   end
 
+  defp start_cloak() do
+    Application.ensure_all_started(:cloak)
+    Application.ensure_all_started(:cloak_ecto)
+    Plausible.Auth.TOTP.Vault.start_link(key: totp_vault_key())
+  rescue
+    _ ->
+      :ok
+  end
+
   defp backfill(dry_run?) do
     # Orphaned teams
 
@@ -613,4 +624,10 @@ defmodule Plausible.DataMigration.BackfillTeams do
   defp log(msg) do
     IO.puts("[#{DateTime.utc_now(:second)}] #{msg}")
   end
+
+  defp totp_vault_key() do
+    :plausible
+    |> Application.fetch_env!(Plausible.Auth.TOTP)
+    |> Keyword.fetch!(:vault_key)
+  end
 end