mesh-catalog/modules/postgres/module.json

{
  "module": "postgres",
  "version": "1",
  "provides": [
    {
      "name": "postgres-database",
      "scope": "mesh",
      "identity": {
        "max": 63,
        "in": "a PostgreSQL role and database name"
      }
    }
  ],
  "claims": [
    {
      "name": "mesh-store",
      "scope": "mesh",
      "serves": [
        "databases",
        "query"
      ]
    }
  ],
  "capabilities": [
    "container-runtime"
  ],
  "emits": [
    "database.provisioned",
    "database.deprovisioned"
  ],
  "consumes": [
    "postgres.database.provisioned",
    "postgres.database.deprovisioned"
  ],
  "listens": [
    {
      "name": "database",
      "port": 5432,
      "protocol": "tcp",
      "from": "mesh",
      "why": "modules on any machine that were granted a database"
    }
  ],
  "guards": [
    5432
  ],
  "serves": {
    "postgres-database": {
      "port": 5432
    }
  },
  "receives": {
    "postgres-database": "${dir:grants}/mesh.json"
  },
  "grants": {
    "postgres-database": "${dir:grants}"
  },
  "own-secrets": {
    "superuser": "${dir:state}/superuser.secret",
    "reader": "${dir:state}/reader.secret"
  },
  "data": {
    "own": [
      {
        "id": "store",
        "path": "${dir:store-data}",
        "class": "valuable",
        "backup": {
          "dump": "docker exec -u postgres postgres sh -c 'cd /var/lib/postgresql/data/dumps && for db in $(psql -Atc \"select datname from pg_database where oid >= 16384 order by 1\"); do pg_dump -Fc -f \"$db.dump.partial\" \"$db\" && mv \"$db.dump.partial\" \"$db.dump\" || exit 1; done'",
          "into": "dumps"
        },
        "why": "every consumer's database; copied by the dump below, since a running store's files are not a consistent copy"
      },
      {
        "id": "dumps",
        "path": "${dir:dumps}",
        "class": "rebuildable",
        "why": "last night's dump of the store, made again every night"
      }
    ],
    "consumers": {
      "postgres-database": {
        "class": "valuable",
        "in": "store",
        "why": "a consumer's rows are the only copy of what it wrote"
      }
    }
  },
  "resources": [
    {
      "id": "state",
      "type": "directory",
      "mode": "0700",
      "place": "."
    },
    {
      "id": "grants",
      "type": "directory",
      "mode": "0700"
    },
    {
      "id": "store-data",
      "type": "directory",
      "path": "/var/lib/mesh-store",
      "mode": "0700",
      "owner": "999:70"
    },
    {
      "id": "dumps",
      "type": "directory",
      "path": "${dir:store-data}/dumps",
      "mode": "0700",
      "owner": "999:70"
    },
    {
      "id": "server",
      "type": "container",
      "name": "postgres",
      "image": "pgvector/pgvector@sha256:cf134a767f474095eeba57e0117be8e568e011a63f33fbf252f14c9b760f8e6f",
      "env": {
        "POSTGRES_PASSWORD_FILE": "/run/secrets/superuser",
        "PGDATA": "/var/lib/postgresql/data/pgdata"
      },
      "ports": [
        "5432:5432"
      ],
      "volumes": [
        "/var/lib/mesh-store:/var/lib/postgresql/data",
        "${dir:state}/superuser.secret:/run/secrets/superuser:ro"
      ]
    },
    {
      "id": "client",
      "type": "package",
      "package": "postgresql-libs"
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "code",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/postgres-provider",
        "binary": "postgres-provider",
        "loads": [
          "postgres-provider"
        ],
        "env": {
          "MESH_PROVISION_POSTGRES": "postgres://postgres@127.0.0.1:${port:5432}/postgres?sslmode=disable",
          "MESH_PROVISION_PASSWORD_FILE": "${dir:state}/superuser.secret",
          "MESH_RECEIVES": "${dir:grants}/mesh.json",
          "MESH_POSTGRES_READER_PASSWORD_FILE": "${dir:state}/reader.secret"
        }
      }
    ]
  }
}