feat(postgresql): migrate to Pattern C — Docker secrets for POSTGRES_PASSWORD and PGADMIN_DEFAULT_PASSWORD (_FILE convention)

2026-07-06 23:37:16 -07:00
parent 1969c69c5f
commit 33f63924fc
1 changed files with 122 additions and 0 deletions
@@ -0,0 +1,122 @@
+version: "3.6"
+services:
+  postgresql:
+    stop_grace_period: 60s
+    env_file:
+      - postgresql.env
+    command:
+      - postgres
+    environment:
+      - POSTGRES_PASSWORD_FILE=/run/secrets/postgresql_password
+      - POSTGRES_USER=${POSTGRES_USER}
+    secrets:
+      - postgresql_password
+    hostname: db
+    image: public.ecr.aws/docker/library/postgres:17
+    networks:
+      - postgresql_db-backend
+#      - traefik_backend
+      - authentik_backend
+    ports:
+      - 5430:5432/tcp
+    volumes:
+      - /volume1/docker/PostgreSQL/data-17:/var/lib/postgresql/data
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.tcp.routers.postgres.entrypoints=postgresql
+        - traefik.tcp.routers.postgres.rule=HostSNI(`*`)
+        - traefik.tcp.services.postgres.loadbalancer.server.port=5432
+        - traefik.tcp.routers.postgres.service=postgres
+        - traefik.swarm.network=traefik_backend
+#      resources:
+#        limits:
+#          cpus: '8' # Limit to 0.5 CPU core
+#          memory: 2G
+      placement:
+        constraints:
+          - node.labels.block != databases
+          - node.hostname == docker-2
+
+  databasus:
+    hostname: databasus
+    image: databasus/databasus:latest
+#    ports:
+#      - "4005:4005"
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    volumes:
+      - /volume1/docker/databasus:/databasus-data
+#      - /volume1/SMB-docker/tmp:/tmp
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.databasus.rule=Host(`${DATABASUS_HOST}`)
+        - traefik.http.routers.databasus.tls=true
+        - traefik.http.routers.databasus.tls.certresolver=letsencrypt
+        - traefik.http.routers.databasus.entrypoints=websecure
+        - traefik.http.services.databasus.loadbalancer.server.port=4005
+        - traefik.swarm.network=traefik_backend
+#        - traefik.http.routers.databasus.middlewares=forwardAuth-authentik@file, crowdsec@file
+#        - traefik.http.routers.databasus.middlewares=auth
+#        - traefik.http.middlewares.auth.basicauth.users=test:$$2a$$12$$1sIFlNKcNrEApe2IScpFwukd7l1j/uvfxk0GeuqIk0BBcO9Mk2F2u
+#      resources:
+#        limits:
+#          cpus: '4' # Limit to 0.5 CPU core
+#          memory: 2G
+
+
+  pgadmin:
+    env_file:
+      - postgresql.env
+    image: dpage/pgadmin4:latest
+    environment:
+      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
+      PGADMIN_DEFAULT_PASSWORD_FILE: /run/secrets/postgresql_pgadmin_password
+      PGADMIN_LISTEN_PORT: 80
+    secrets:
+      - postgresql_pgadmin_password
+    volumes:
+      - "/volume1/docker/PostgreSQL Admin:/var/lib/pgadmin"
+#      - "/volume1/docker/PostgreSQL Backups:/var/lib/pgadmin/storage/avb_bryanmail.net"
+    ports:
+      - 3030:80
+    networks:
+      - postgresql_db-backend
+      - traefik_backend
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.pgadmin.rule=Host(`${PGADMIN_HOST}`)
+        - traefik.http.routers.pgadmin.tls=true
+        - traefik.http.routers.pgadmin.tls.certresolver=letsencrypt
+        - traefik.http.routers.pgadmin.entrypoints=websecure
+        - traefik.http.services.pgadmin.loadbalancer.server.port=80
+        - traefik.swarm.network=traefik_backend
+#        - traefik.http.routers.pgadmin.middlewares=forwardAuth-authentik@file, crowdsec@file
+#        - traefik.http.routers.pgadmin.middlewares=auth
+#        - traefik.http.middlewares.auth.basicauth.users=test:$$2a$$12$$1sIFlNKcNrEApe2IScpFwukd7l1j/uvfxk0GeuqIk0BBcO9Mk2F2u
+      resources:
+        limits:
+          cpus: '1' # Limit to 0.5 CPU core
+          memory: 512M
+
+networks:
+  postgresql_db-backend:
+    name: postgresql_db-backend
+#   external: true
+    attachable: true
+    driver: overlay
+    driver_opts:
+      com.docker.network.driver.mtu: "8950" #broke database connections for things like vaultwarden and Immich
+  traefik_backend:
+    external: true
+  authentik_backend:
+    external: true
+
+secrets:
+  postgresql_password:
+    external: true
+  postgresql_pgadmin_password:
+    external: true