288 lines
3.4 KiB
Markdown
288 lines
3.4 KiB
Markdown
# PostgreSQL
|
|
|
|
## Overview
|
|
|
|
PostgreSQL is the central database platform for SilverLinux.
|
|
|
|
Multiple applications use the same PostgreSQL instance while maintaining separate databases and database users.
|
|
|
|
This approach simplifies:
|
|
|
|
* Backup management
|
|
* Monitoring
|
|
* Security
|
|
* Resource utilization
|
|
|
|
---
|
|
|
|
## Service Information
|
|
|
|
Container Name:
|
|
|
|
```text
|
|
postgres
|
|
```
|
|
|
|
Network:
|
|
|
|
```text
|
|
internal
|
|
```
|
|
|
|
Purpose:
|
|
|
|
* Application databases
|
|
* Centralized data storage
|
|
* Shared database platform
|
|
|
|
---
|
|
|
|
## Current Databases
|
|
|
|
### gitea
|
|
|
|
Owner:
|
|
|
|
```text
|
|
gitea
|
|
```
|
|
|
|
Purpose:
|
|
|
|
Source control and repository management.
|
|
|
|
Used by:
|
|
|
|
```text
|
|
gitea
|
|
```
|
|
|
|
---
|
|
|
|
### openproject
|
|
|
|
Owner:
|
|
|
|
```text
|
|
openproject
|
|
```
|
|
|
|
Purpose:
|
|
|
|
Project management and collaboration.
|
|
|
|
Used by:
|
|
|
|
```text
|
|
openproject
|
|
```
|
|
|
|
---
|
|
|
|
### postgres
|
|
|
|
Owner:
|
|
|
|
```text
|
|
postgres
|
|
```
|
|
|
|
Purpose:
|
|
|
|
Administrative database.
|
|
|
|
Used for PostgreSQL administration and maintenance.
|
|
|
|
---
|
|
|
|
## Database Ownership
|
|
|
|
| Database | Owner |
|
|
| ----------- | ----------- |
|
|
| gitea | gitea |
|
|
| openproject | openproject |
|
|
| postgres | postgres |
|
|
|
|
Each application should use its own dedicated database user whenever possible.
|
|
|
|
---
|
|
|
|
## Credentials
|
|
|
|
Credentials are stored in:
|
|
|
|
```text
|
|
/srv/secrets/company.env
|
|
```
|
|
|
|
Current variables:
|
|
|
|
```text
|
|
POSTGRES_ROOT_PASSWORD
|
|
POSTGRES_OPENPROJECT_PASSWORD
|
|
```
|
|
|
|
Future variables:
|
|
|
|
```text
|
|
POSTGRES_GITEA_PASSWORD
|
|
POSTGRES_BAGET_PASSWORD
|
|
```
|
|
|
|
Passwords must never be committed to Git repositories.
|
|
|
|
---
|
|
|
|
## Administration
|
|
|
|
Open PostgreSQL shell:
|
|
|
|
```bash
|
|
docker exec -it postgres psql -U postgres
|
|
```
|
|
|
|
---
|
|
|
|
### List Databases
|
|
|
|
```sql
|
|
\l
|
|
```
|
|
|
|
---
|
|
|
|
### List Roles
|
|
|
|
```sql
|
|
\du
|
|
```
|
|
|
|
---
|
|
|
|
### List Connections
|
|
|
|
```sql
|
|
SELECT * FROM pg_stat_activity;
|
|
```
|
|
|
|
---
|
|
|
|
## Create Database
|
|
|
|
Example:
|
|
|
|
```sql
|
|
CREATE DATABASE myapp;
|
|
```
|
|
|
|
---
|
|
|
|
## Create User
|
|
|
|
Example:
|
|
|
|
```sql
|
|
CREATE USER myapp WITH PASSWORD 'StrongPassword';
|
|
```
|
|
|
|
Grant permissions:
|
|
|
|
```sql
|
|
GRANT ALL PRIVILEGES ON DATABASE myapp TO myapp;
|
|
```
|
|
|
|
---
|
|
|
|
## Backup
|
|
|
|
Create database backup:
|
|
|
|
```bash
|
|
docker exec postgres pg_dump -U postgres openproject > openproject.sql
|
|
```
|
|
|
|
Create full cluster backup:
|
|
|
|
```bash
|
|
docker exec postgres pg_dumpall -U postgres > postgres-full-backup.sql
|
|
```
|
|
|
|
---
|
|
|
|
## Restore
|
|
|
|
Restore database:
|
|
|
|
```bash
|
|
docker exec -i postgres psql -U postgres openproject < openproject.sql
|
|
```
|
|
|
|
Restore complete cluster:
|
|
|
|
```bash
|
|
docker exec -i postgres psql -U postgres < postgres-full-backup.sql
|
|
```
|
|
|
|
---
|
|
|
|
## Security
|
|
|
|
* PostgreSQL is not exposed publicly.
|
|
* Database traffic is restricted to Docker internal networks.
|
|
* Credentials are stored in `/srv/secrets/company.env`.
|
|
* Administrative access should use the `postgres` role only when necessary.
|
|
* Applications should use dedicated database users.
|
|
|
|
---
|
|
|
|
## Monitoring
|
|
|
|
Useful commands:
|
|
|
|
Database size:
|
|
|
|
```sql
|
|
SELECT pg_database.datname,
|
|
pg_size_pretty(pg_database_size(pg_database.datname))
|
|
FROM pg_database;
|
|
```
|
|
|
|
Current connections:
|
|
|
|
```sql
|
|
SELECT count(*) FROM pg_stat_activity;
|
|
```
|
|
|
|
PostgreSQL version:
|
|
|
|
```sql
|
|
SELECT version();
|
|
```
|
|
|
|
---
|
|
|
|
## Disaster Recovery
|
|
|
|
Minimum requirements for recovery:
|
|
|
|
* PostgreSQL container configuration
|
|
* Database backups
|
|
* `/srv/secrets/company.env`
|
|
* Docker network configuration
|
|
|
|
Without the secrets file, applications may not be able to reconnect to their databases after restoration.
|
|
|
|
---
|
|
|
|
## Related Services
|
|
|
|
* Gitea
|
|
* OpenProject
|
|
|
|
## Related Documentation
|
|
|
|
* docs/server.md
|
|
* docs/security.md
|
|
* docs/secrets.md
|
|
* docs/backups.md
|