feat: jpa, messaging, notification, mongo, graphql 어댑터터 리펙토링

docker-compose.tls.yml

@@ -0,0 +1,50 @@
+# =============================================================================
+# Database transport security, for the lanes whose runtime requires it.
+#
+# The prod runtime connects with `sslmode=verify-full` and an explicit `sslrootcert`. That is not a
+# lane setting to relax: a prod smoke test against a database with TLS disabled is a smoke test of a
+# configuration production never runs, and the one failure mode it would hide — the certificate
+# chain or the host name not checking out — is the one that only ever appears in production.
+#
+# So the lane brings a real certificate instead. The qualification wrapper generates a CA and a
+# server certificate for the host name `db` per run, at mode 0600, and removes both on teardown; the
+# realm-secret pattern, applied to a keypair. Nothing here is committed: infra/postgres/tls holds
+# only a .gitignore.
+#
+# `verify-full` is deliberate rather than `verify-ca`. `verify-ca` proves the certificate was issued
+# by the expected authority and says nothing about who presented it, so it does not detect a
+# redirected connection — which is most of what transport security is for.
+# =============================================================================
+
+services:
+  db:
+    # Runs as root just long enough to install the key where postgres can read it, then hands over
+    # to the official entrypoint. See infra/postgres/entrypoint.sh for why a bind mount cannot do it.
+    entrypoint: ["/bin/sh", "/opt/postgres-entrypoint/entrypoint.sh"]
+    command:
+      - "postgres"
+      - "-c"
+      - "ssl=on"
+      - "-c"
+      - "ssl_cert_file=/etc/postgresql-tls/server.crt"
+      - "-c"
+      - "ssl_key_file=/etc/postgresql-tls/server.key"
+    volumes:
+      - type: bind
+        source: ./infra/postgres/entrypoint.sh
+        target: /opt/postgres-entrypoint/entrypoint.sh
+        read_only: true
+      - type: bind
+        source: ./infra/postgres/tls
+        target: /opt/postgres-tls
+        read_only: true
+
+  app:
+    # The certificate authority the JDBC URL names in `sslrootcert`. A public certificate, so it
+    # carries no mode problem — the private half never leaves the database container's filesystem.
+    secrets:
+      - postgres-ca
+
+secrets:
+  postgres-ca:
+    file: ./infra/postgres/tls/ca.crt