95b9cccf07
RELAY-PHASE1 Wave A (2/3) + E1 infra: - A1: createPgStores() Postgres adapter for all 9 P3 store ports + runMigrations(); writable-CTE atomic INV8 status swaps; 0002_routes.sql. 23/23 pg tests, 96.72% cov. - A3: real capability verifier delegating to relay-auth verifyCapabilityToken; sync->async seam across authz/provision/main. Full CP suite 15 files/101 pass, tsc clean. - E1: deploy/docker-compose.yml (Postgres16+Redis7, loopback-only) + .env.example. - docs: PLAN_RELAY_PHASE1.md file-level execution spec; PROGRESS_LOG RELAY-PHASE1 section.
49 lines
1.5 KiB
YAML
49 lines
1.5 KiB
YAML
# RELAY-PHASE1 · E1 — Postgres + Redis for the rendezvous-relay control-plane (P3) on the VPS.
|
|
#
|
|
# Both services bind to 127.0.0.1 ONLY — they are the relay's private state, never exposed on the
|
|
# public interface (INV9-adjacent; open only :443 + AGENT_PORT in the cloud security group). The
|
|
# control-plane / relay processes reach them over loopback.
|
|
#
|
|
# Usage on 8.138.1.192:
|
|
# cp deploy/.env.example deploy/.env # then fill secrets
|
|
# docker compose --env-file deploy/.env -f deploy/docker-compose.yml up -d
|
|
#
|
|
# PG_URL for the app = postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@127.0.0.1:5432/${POSTGRES_DB}
|
|
# REDIS_URL for the app = redis://127.0.0.1:6379
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:16
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: ${POSTGRES_DB:-relay}
|
|
POSTGRES_USER: ${POSTGRES_USER:-relay}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in deploy/.env}
|
|
ports:
|
|
- "127.0.0.1:5432:5432" # loopback-only
|
|
volumes:
|
|
- relay_pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-relay} -d ${POSTGRES_DB:-relay}"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
redis:
|
|
image: redis:7
|
|
restart: unless-stopped
|
|
command: ["redis-server", "--appendonly", "yes"]
|
|
ports:
|
|
- "127.0.0.1:6379:6379" # loopback-only
|
|
volumes:
|
|
- relay_redisdata:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
volumes:
|
|
relay_pgdata:
|
|
relay_redisdata:
|