docker-compose.db.yml

# PostgreSQL Database Only (with pgvector)
# Usage: docker compose -f docker-compose.db.yml up -d
#
# Default port: 25432 (change with POSTGRES_PORT env var)
# Default credentials: ownpilot / ownpilot_secret
#
# Then in your .env:
#   POSTGRES_HOST=127.0.0.1   # use IPv4 literal; "localhost" may resolve to ::1 on Windows
#   POSTGRES_PORT=25432
#   POSTGRES_USER=ownpilot
#   POSTGRES_PASSWORD=ownpilot_secret
#   POSTGRES_DB=ownpilot

services:
  postgres:
    image: pgvector/pgvector:pg16
    container_name: ownpilot-db
    restart: unless-stopped
    ports:
      # Bind to IPv4 loopback only — avoids localhost/::1 resolution issues on Windows
      # and prevents exposing the DB to other hosts on the LAN.
      - '127.0.0.1:${POSTGRES_PORT:-25432}:5432'
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-ownpilot}
      # SECURITY (DOCK-003): `ownpilot_secret` is a committed, publicly-known
      # fallback intended ONLY for local development. The port above is bound to
      # 127.0.0.1, so the DB is never exposed beyond this host. For any shared,
      # remote, or production use you MUST set POSTGRES_PASSWORD in your .env to
      # a strong secret (the gateway reads the same value).
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ownpilot_secret}
      POSTGRES_DB: ${POSTGRES_DB:-ownpilot}
    volumes:
      - ownpilot-postgres-data:/var/lib/postgresql/data
      # Auto-run initial schema on first start
      - ./packages/gateway/src/db/migrations/postgres:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER:-ownpilot} -d ${POSTGRES_DB:-ownpilot}']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

volumes:
  ownpilot-postgres-data:
    driver: local