docker-compose.yml

name: piyaz
services:
  db:
    image: postgres:18
    restart: unless-stopped
    # pg_stat_statements collects nothing unless preloaded; CREATE EXTENSION
    # alone (docker/extensions.sql) only creates the SQL objects. Applies on
    # the next `docker compose up -d`.
    command: ["postgres", "-c", "shared_preload_libraries=pg_stat_statements"]
    environment:
      POSTGRES_USER: piyaz
      # Superuser: exempt from FORCE ROW LEVEL SECURITY, so this credential
      # bypasses the tenant boundary. The port below is published to loopback
      # only, so reaching it already means local access to the host. Set
      # POSTGRES_PASSWORD in .env.local to override on a host where that is not
      # a safe assumption. Read only on first init, never on an existing volume.
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-piyaz}
      POSTGRES_DB: piyaz
      # Passed through to init-rls.sql so it can provision app_user and
      # service_role with caller-generated passwords (see .env.local.example).
      APP_USER_PASSWORD: ${APP_USER_PASSWORD:?missing APP_USER_PASSWORD; generate via `openssl rand -base64 24` and add to .env.local}
      SERVICE_ROLE_PASSWORD: ${SERVICE_ROLE_PASSWORD:?missing SERVICE_ROLE_PASSWORD; generate via `openssl rand -base64 24` and add to .env.local}
      AUTH_ROLE_PASSWORD: ${AUTH_ROLE_PASSWORD:?missing AUTH_ROLE_PASSWORD; generate via `openssl rand -base64 24` and add to .env.local}
    ports:
      # Loopback only. A bare "5432:5432" binds every interface, and Docker
      # writes iptables rules that a host firewall such as ufw does not filter,
      # which publishes the database to the network.
      - "127.0.0.1:5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql
      - ./docker/init-auth.sql:/docker-entrypoint-initdb.d/01-auth.sql:ro
      - ./docker/init-rls.sh:/docker-entrypoint-initdb.d/02-rls.sh:ro
      - ./docker/grants.sql:/opt/postgres-init/grants.sql:ro
      - ./docker/grants-auth.sql:/opt/postgres-init/grants-auth.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U piyaz"]
      interval: 5s
      timeout: 3s
      retries: 5

volumes:
  pgdata: