fix: add missing extensions and correct UID defaults for pre-built images (#48)

  Fixes #43: Pre-built images use UID 999, but .env defaults assumed host UID
  Fixes #47: Add missing contrib extensions to CORE_EXTENSION_LIST

  ## UID/GID Configuration (Issue #43)
  - Update .env.example to default POSTGRES_UID/GID to 999 (matches pre-built ghcr.io images)
  - Add documentation in README explaining UID requirements for pre-built vs local builds
  - Add validation in config render script to clamp PG_EFFECTIVE_IO_CONCURRENCY to range 0-1000

  ## Missing Extensions (Issue #47)
  Add 7 new contrib extensions to CORE_EXTENSION_LIST:
  - cube (required dependency for earthdistance)
  - earthdistance (earth distance calculations)
  - intarray (integer array functions)
  - ltree (hierarchical tree structures)
  - pg_prewarm (buffer cache preloading)
  - tablefunc (crosstab/pivot functions)
  - unaccent (accent removal for text search)

  ## Tests & Documentation
  - Update pgtap smoke tests: 29 → 39 tests (add new extensions + bloom + pg_cron)
  - Update README extension bundle documentation

Author: paudley

.env.example

@@ -92,9 +92,11 @@ BACKUPS_HOST_PATH=./backups
 COMPOSE_PROFILES=valkey,pgbouncer,memcached,rabbitmq
 
 # Container execution context
-# Defaults to the invoking user's UID/GID; override only if you need a specific account inside containers.
-POSTGRES_UID=
-POSTGRES_GID=
+# Pre-built images from ghcr.io use UID/GID 999 (the postgres user baked into the image).
+# If building locally with CORE_DATA_BUILD_IMAGE=1, you can set these to your host user's UID/GID.
+# WARNING: Mismatch between these values and the image's baked-in UID causes permission errors.
+POSTGRES_UID=999
+POSTGRES_GID=999
 POSTGRES_RUNTIME_USER=postgres
 POSTGRES_RUNTIME_GECOS=Core\ Data\ PostgreSQL\ Administrator
 POSTGRES_RUNTIME_HOME=/home/postgres
@@ -158,8 +160,9 @@ RABBITMQ_DEFAULT_USER=coredata
 RABBITMQ_DEFAULT_PASS_FILE=./secrets/rabbitmq_default_pass
 RABBITMQ_ERLANG_COOKIE_FILE=./secrets/rabbitmq_erlang_cookie
 RABBITMQ_DATA_MOUNT_PATH=/var/lib/rabbitmq
-RABBITMQ_UID=
-RABBITMQ_GID=
+# Pre-built RabbitMQ image uses UID/GID 999. Match POSTGRES_UID/GID for consistency.
+RABBITMQ_UID=999
+RABBITMQ_GID=999
 
 # Time zone for containers
 TZ=UTC

README.md

@@ -129,6 +129,23 @@ POSTGRES_IMAGE_NAME=ghcr.io/paudley/core-data-postgres
 POSTGRES_IMAGE_TAG=17.2-v1.0.0
 ```
 
+### Important: UID/GID Configuration for Pre-built Images
+
+Pre-built images from `ghcr.io` have the `postgres` user baked in with **UID/GID 999**. Your `.env` must match:
+
+```bash
+POSTGRES_UID=999
+POSTGRES_GID=999
+```
+
+**Why this matters:** The `volume_prep` service uses these values to `chown` data directories. If they don't match the image's baked-in UID, you'll see permission errors like:
+
+```
+chmod: changing permissions of '/var/lib/postgresql/data': Operation not permitted
+```
+
+**Building locally?** If you set `CORE_DATA_BUILD_IMAGE=1`, you can use your host user's UID/GID instead—the image build process will create the postgres user with your specified IDs.
+
 ## Highlights
 
 * Custom Docker image with PostGIS, pgvector, Apache AGE, pg\_cron, pg\_squeeze, pgAudit, pgBadger, pgBackRest, and pgtune baked in.
@@ -145,11 +162,11 @@ POSTGRES_IMAGE_TAG=17.2-v1.0.0
 
 core\_data provisions a batteries-included extension stack in every non-template database at init time:
 
-* **Performance & Observability** — `pg_stat_statements`, `auto_explain`, `pg_buffercache`.
+* **Performance & Observability** — `pg_stat_statements`, `auto_explain`, `pg_buffercache`, `pg_prewarm`, `bloom`.
 * **Security & Compliance** — `pgaudit`, `pgcrypto`, `"uuid-ossp"`.
-* **Developer Ergonomics** — `hstore`, `citext`, `pg_trgm`, `btree_gin`, `btree_gist`, `hypopg`.
+* **Developer Ergonomics** — `hstore`, `citext`, `pg_trgm`, `btree_gin`, `btree_gist`, `hypopg`, `intarray`, `ltree`, `tablefunc`, `unaccent`.
 * **Connectivity** — `postgres_fdw`, `dblink`.
-* **Spatial, Vector, Graph** — `postgis`, `postgis_raster`, `postgis_topology`, `vector`, `age`.
+* **Spatial, Vector, Graph** — `postgis`, `postgis_raster`, `postgis_topology`, `vector`, `age`, `cube`, `earthdistance`.
 * **Maintenance & Testing** — `pg_cron` (kept in the `postgres` database), `pg_partman`, `pg_repack`, `pg_squeeze`, `pgstattuple`, `pgtap`.
 * **Geospatial Extras** — `postgis_tiger_geocoder`, `address_standardizer`, `address_standardizer_data_us`, `pgrouting`, `fuzzystrmatch`.
 

postgres/initdb/00-render-config.sh

@@ -53,6 +53,14 @@ apply_network_allow_entries() {
 : "${PG_MAINTENANCE_WORK_MEM:=256MB}"
 : "${PG_RANDOM_PAGE_COST:=1.1}"
 : "${PG_EFFECTIVE_IO_CONCURRENCY:=200}"
+# PostgreSQL 17 accepts effective_io_concurrency in range 0-1000; clamp invalid values
+if [[ "${PG_EFFECTIVE_IO_CONCURRENCY}" -lt 0 ]]; then
+	echo "[core_data] WARNING: PG_EFFECTIVE_IO_CONCURRENCY=${PG_EFFECTIVE_IO_CONCURRENCY} is negative; clamping to 0." >&2
+	PG_EFFECTIVE_IO_CONCURRENCY=0
+elif [[ "${PG_EFFECTIVE_IO_CONCURRENCY}" -gt 1000 ]]; then
+	echo "[core_data] WARNING: PG_EFFECTIVE_IO_CONCURRENCY=${PG_EFFECTIVE_IO_CONCURRENCY} exceeds max (1000); clamping to 1000." >&2
+	PG_EFFECTIVE_IO_CONCURRENCY=1000
+fi
 : "${PG_MAX_WAL_SIZE:=2GB}"
 : "${PG_MIN_WAL_SIZE:=1GB}"
 : "${PG_WAL_KEEP_SIZE:=2GB}"

scripts/lib/extensions.sh

@@ -122,7 +122,7 @@ run_pgtap_smoke() {
 		psql --set ON_ERROR_STOP=on --username "${POSTGRES_SUPERUSER:-postgres}" --dbname "${database}" <<'SQL'
 CREATE SCHEMA IF NOT EXISTS test_core_data;
 SET search_path = test_core_data, public;
-SELECT plan(29);
+SELECT plan(39);
 SELECT ok(current_schema = 'test_core_data', 'search_path set to test schema');
 SELECT has_extension('vector', 'vector extension installed');
 SELECT has_extension('postgis', 'postgis extension installed');
@@ -135,10 +135,12 @@ SELECT ok(position('auto_explain' in current_setting('shared_preload_libraries')
 SELECT has_extension('pg_buffercache', 'pg_buffercache extension installed');
 SELECT has_extension('pgcrypto', 'pgcrypto extension installed');
 SELECT has_extension('citext', 'citext extension installed');
+SELECT has_extension('cube', 'cube extension installed');
 SELECT has_extension('hstore', 'hstore extension installed');
 SELECT has_extension('pg_trgm', 'pg_trgm extension installed');
 SELECT has_extension('btree_gin', 'btree_gin extension installed');
 SELECT has_extension('btree_gist', 'btree_gist extension installed');
+SELECT has_extension('bloom', 'bloom extension installed');
 SELECT has_extension('postgres_fdw', 'postgres_fdw extension installed');
 SELECT has_extension('dblink', 'dblink extension installed');
 SELECT has_extension('uuid-ossp', 'uuid-ossp extension installed');
@@ -153,6 +155,13 @@ SELECT has_extension('address_standardizer_data_us', 'address_standardizer_data_
 SELECT has_extension('pgrouting', 'pgRouting extension installed');
 SELECT has_extension('hypopg', 'hypopg extension installed');
 SELECT has_extension('pg_partman', 'pg_partman extension installed');
+SELECT has_extension('pg_cron', 'pg_cron extension installed');
+SELECT has_extension('earthdistance', 'earthdistance extension installed');
+SELECT has_extension('intarray', 'intarray extension installed');
+SELECT has_extension('ltree', 'ltree extension installed');
+SELECT has_extension('pg_prewarm', 'pg_prewarm extension installed');
+SELECT has_extension('tablefunc', 'tablefunc extension installed');
+SELECT has_extension('unaccent', 'unaccent extension installed');
 SELECT * FROM finish();
 SQL
 }

scripts/lib/extensions_list.sh

@@ -3,19 +3,25 @@
 # SPDX-License-Identifier: MIT
 
 # Canonical list of default extensions enabled across bootstrap flows.
+# Note: Order matters for dependencies (e.g., cube must come before earthdistance)
 # shellcheck disable=SC2034
 CORE_EXTENSION_LIST=(
 	age
 	btree_gin
 	btree_gist
 	citext
+	cube
 	dblink
-	hstore
+	earthdistance
 	fuzzystrmatch
+	hstore
+	intarray
+	ltree
 	bloom
 	pg_buffercache
 	pg_cron
 	pg_partman
+	pg_prewarm
 	hypopg
 	pg_repack
 	pg_squeeze
@@ -33,6 +39,8 @@ CORE_EXTENSION_LIST=(
 	address_standardizer_data_us
 	postgis_tiger_geocoder
 	pgrouting
+	tablefunc
+	unaccent
 	uuid-ossp
 	vector
 )