# One machine running a database that other machines use.
#
# It exists to prove the last step of a credential: the mesh generated a password, sealed it to
# this machine, and cannot tell PostgreSQL to accept it. Something here has to, and this is where
# that something is run against a real database rather than described.
scenario: a-provider

segments:
  hosting:
    kind: public
    cidr: [192.0.2.0/24]

machines:
  anchor:
    at: { segment: hosting, address: [192.0.2.10] }
    inbound: allow

images:
  - postgres:17-alpine

place:
  all: [runtime]