Update PostgreSQL Docker Compose configuration and add SSL certificates

postgres/custom-conf/pg_hba.conf

@@ -0,0 +1,3 @@
+# TYPE  DATABASE        USER            ADDRESS                 METHOD
+hostssl  all             all             192.168.2.0/24         md5
+hostssl  all             all             127.0.0.1/32           md5

postgres/docker-compose.yml

@@ -1,57 +1,38 @@
+version: "3.9"
+
 services:
   postgres:
-    image: postgres:16-alpine
+    image: postgres:latest
-    container_name: fairreview_postgres
+    container_name: postgres_secure
     restart: unless-stopped
     environment:
-      POSTGRES_DB: ${POSTGRES_DB:-fairreview}
+      POSTGRES_USER: ${POSTGRES_USER}
-      POSTGRES_USER: ${POSTGRES_USER:-zhuma}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
       PGDATA: /var/lib/postgresql/data/pgdata
     volumes:
       - postgres_data:/var/lib/postgresql/data
-      - ./ssl:/ssl-host:ro  # your host SSL files, read-only
+      - ./certs:/certs:ro
-    tmpfs:
+      - ./init-scripts:/docker-entrypoint-initdb.d:ro
-      - /ssl:rw,mode=0700   # tmpfs inside container for proper ownership
+      - ./custom-conf:/etc/postgresql/conf.d:ro
-      - /tmp
-      - /var/run/postgresql
     ports:
-      - "5432:5432"
+      - "5432:5432" # accessible from LAN
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-zhuma} -d ${POSTGRES_DB:-fairreview}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 10s
-    security_opt:
-      - no-new-privileges:true
-    deploy:
-      resources:
-        limits:
-          memory: 512M
-        reservations:
-          memory: 256M
     command: >
-      sh -c "
+      postgres
-        # Copy SSL files into tmpfs, set correct permissions
+      -c listen_addresses='*'
-        cp /ssl-host/* /ssl/ &&
+      -c ssl=on
-        chown postgres:postgres /ssl/* &&
+      -c ssl_cert_file=/certs/server.crt
-        chmod 600 /ssl/server.key &&
+      -c ssl_key_file=/certs/server.key
-        chmod 644 /ssl/server.crt /ssl/ca.crt &&
+      -c ssl_ca_file=/certs/ca.crt
-        # Start PostgreSQL with SSL
+      -c log_timezone=UTC
-        postgres
+      -c timezone=UTC
-          -c ssl=on
+      -c config_file=/etc/postgresql/conf.d/postgresql.conf
-          -c ssl_cert_file=/ssl/server.crt
+    networks:
-          -c ssl_key_file=/ssl/server.key
+      - pgnet
-          -c ssl_ca_file=/ssl/ca.crt
-          -c max_connections=100
-          -c shared_buffers=128MB
-          -c effective_cache_size=256MB
-          -c maintenance_work_mem=64MB
-          -c checkpoint_completion_target=0.9
-          -c wal_buffers=16MB
-          -c default_statistics_target=100
-      "
 
 volumes:
   postgres_data:
+
+networks:
+  pgnet:
+    driver: bridge