security rework and memory optimilizations.

stacks/postgres-shared.yml

@@ -0,0 +1,135 @@
+version: '3.8'
+
+# Shared PostgreSQL Database
+# Purpose: Centralized database for all homelab applications
+# Port: 5432
+# GPU: No
+# Storage: SSD (PostgreSQL data and backups)
+
+services:
+  postgres-shared:
+    image: postgres:16-alpine
+    container_name: postgres-shared
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      start_period: 20s
+      interval: 30s
+      retries: 5
+      timeout: 5s
+    ports:
+      - "5432:5432"
+    volumes:
+      - /home/jpmschweitzer/docker-data/postgres-shared/data:/var/lib/postgresql/data
+      - /home/jpmschweitzer/docker-data/postgres-shared/backups:/backups
+    environment:
+      POSTGRES_PASSWORD: ${POSTGRES_ADMIN_PASSWORD:?admin password required}
+      TZ: Europe/Amsterdam
+
+      # Performance tuning (adjust based on available RAM)
+      # Shared buffers: 25% of RAM allocated to PostgreSQL
+      POSTGRES_SHARED_BUFFERS: 512MB
+      # Effective cache: 50-75% of RAM allocated to PostgreSQL
+      POSTGRES_EFFECTIVE_CACHE_SIZE: 2GB
+      # Max connections: adjust based on number of applications
+      POSTGRES_MAX_CONNECTIONS: 200
+    deploy:
+      resources:
+        limits:
+          cpus: '2.0'
+          memory: 2G
+        reservations:
+          memory: 512M
+    networks:
+      - docker-dataplane
+
+networks:
+  docker-dataplane:
+    external: true
+    name: docker-dataplane
+
+# Setup Instructions:
+#
+# 1. Create directories:
+#    mkdir -p ~/docker-data/postgres-shared/{data,backups}
+#
+# 2. Deploy stack via core-api (recommended) or docker-compose
+#
+# 3. Initialize databases (run ONCE after first deployment):
+#    docker exec -i postgres-shared psql -U postgres <<'EOF'
+#      -- Authentik database
+#      CREATE DATABASE authentik;
+#      CREATE USER authentik_user WITH PASSWORD 'F//j0ktck7cX06Vfgh0YXceONOtlSsHvadqROICeDx8=';
+#      GRANT ALL PRIVILEGES ON DATABASE authentik TO authentik_user;
+#      \c authentik
+#      GRANT ALL ON SCHEMA public TO authentik_user;
+#      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO authentik_user;
+#      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO authentik_user;
+#
+#      -- Gitea database
+#      \c postgres
+#      CREATE DATABASE gitea;
+#      CREATE USER gitea_user WITH PASSWORD 'cCav64d76NX1zdEEAbVOM9uvao14aY8HojjNdxsSpMM=';
+#      GRANT ALL PRIVILEGES ON DATABASE gitea TO gitea_user;
+#      \c gitea
+#      GRANT ALL ON SCHEMA public TO gitea_user;
+#      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO gitea_user;
+#      ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO gitea_user;
+#    EOF
+#
+# 4. Verify deployment:
+#    docker exec postgres-shared pg_isready
+#    docker exec postgres-shared psql -U postgres -c '\l'
+#
+# Database Connection Examples:
+#
+# From containers on docker-dataplane network:
+#   Host: postgres-shared
+#   Port: 5432
+#   Database: authentik (or gitea, etc.)
+#   User: authentik_user (or gitea_user, etc.)
+#   Password: <app-specific-password>
+#
+# From host machine:
+#   psql -h localhost -U authentik_user -d authentik
+#
+# Monitoring:
+#
+# Active connections per database:
+#   docker exec postgres-shared psql -U postgres -c \
+#     "SELECT datname, numbackends FROM pg_stat_database;"
+#
+# Database sizes:
+#   docker exec postgres-shared psql -U postgres -c \
+#     "SELECT datname, pg_size_pretty(pg_database_size(datname)) FROM pg_database;"
+#
+# Backup:
+#
+# All databases:
+#   docker exec postgres-shared pg_dumpall -U postgres | \
+#     gzip > ~/docker-data/postgres-shared/backups/all-$(date +%Y%m%d).sql.gz
+#
+# Single database:
+#   docker exec postgres-shared pg_dump -U postgres authentik | \
+#     gzip > ~/docker-data/postgres-shared/backups/authentik-$(date +%Y%m%d).sql.gz
+#
+# Restore:
+#   gunzip < backup.sql.gz | docker exec -i postgres-shared psql -U postgres
+#
+# Maintenance:
+#
+# Vacuum analyze (optimize performance):
+#   docker exec postgres-shared psql -U postgres -c "VACUUM ANALYZE;"
+#
+# Reindex (if queries slow):
+#   docker exec postgres-shared psql -U postgres -d authentik -c "REINDEX DATABASE authentik;"
+#
+# Resource Usage (expected):
+#   CPU: ~0.5-1.5 cores (depends on query load)
+#   RAM: ~500MB-1.5GB (depends on active connections and cache)
+#   Storage: Grows with data (monitor with: df -h ~/docker-data/postgres-shared)
+#
+# Applications Using This Database:
+#   - Authentik (identity provider)
+#   - Gitea (git hosting) - migrated from dedicated instance
+#   - Future applications as needed