ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
15 lines
744 B
Bash
15 lines
744 B
Bash
# Production environment template for rn-platform-01's `postgres` service.
|
|
# Postgres itself binds only to localhost/the platform-internal Docker network — never exposed
|
|
# beyond rn-platform-01, see docs/PRODUCTION_NETWORK_SECURITY.md §6.
|
|
|
|
POSTGRES_USER=rootnode_platform
|
|
POSTGRES_PASSWORD=__REPLACE_WITH_STRONG_PASSWORD__
|
|
POSTGRES_DB=rootnode_platform
|
|
|
|
# Tuning baseline — conservative, meant to be revisited once rn-platform-01's real allocated
|
|
# RAM is known (see docs/production-postgres section in docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md
|
|
# §11). Applied via infra/docker/postgres/postgresql.conf.d/ — do not hand-edit the container.
|
|
# POSTGRES_SHARED_BUFFERS=1GB
|
|
# POSTGRES_EFFECTIVE_CACHE_SIZE=3GB
|
|
# POSTGRES_MAX_CONNECTIONS=100
|