# =============================================================================
# Database transport security, for the lanes whose runtime requires it.
#
# The prod runtime connects with `sslmode=verify-full` and an explicit `sslrootcert`. That is not a
# lane setting to relax: a prod smoke test against a database with TLS disabled is a smoke test of a
# configuration production never runs, and the one failure mode it would hide — the certificate
# chain or the host name not checking out — is the one that only ever appears in production.
#
# So the lane brings a real certificate instead. The qualification wrapper generates a CA and a
# server certificate for the host name `db` per run, at mode 0600, and removes both on teardown; the
# realm-secret pattern, applied to a keypair. Nothing here is committed: infra/postgres/tls holds
# only a .gitignore.
#
# `verify-full` is deliberate rather than `verify-ca`. `verify-ca` proves the certificate was issued
# by the expected authority and says nothing about who presented it, so it does not detect a
# redirected connection — which is most of what transport security is for.
# =============================================================================

services:
  db:
    # Runs as root just long enough to install the key where postgres can read it, then hands over
    # to the official entrypoint. See infra/postgres/entrypoint.sh for why a bind mount cannot do it.
    entrypoint: ["/bin/sh", "/opt/postgres-entrypoint/entrypoint.sh"]
    command:
      - "postgres"
      - "-c"
      - "ssl=on"
      - "-c"
      - "ssl_cert_file=/etc/postgresql-tls/server.crt"
      - "-c"
      - "ssl_key_file=/etc/postgresql-tls/server.key"
    volumes:
      - type: bind
        source: ./infra/postgres/entrypoint.sh
        target: /opt/postgres-entrypoint/entrypoint.sh
        read_only: true
      - type: bind
        source: ./infra/postgres/tls
        target: /opt/postgres-tls
        read_only: true

  app:
    # The certificate authority the JDBC URL names in `sslrootcert`. A public certificate, so it
    # carries no mode problem — the private half never leaves the database container's filesystem.
    secrets:
      - postgres-ca

secrets:
  postgres-ca:
    file: ./infra/postgres/tls/ca.crt