The role split previously required a one-time manual script run on
existing volumes (initdb.d only fires on fresh ones). This folds the
bootstrap into the compose file the way split-account deployments
standardly do it: a one-shot db-init service runs z_rls_role.sh
(idempotent, network mode via PGHOST=db + PGPASSWORD from DBPASS) on
every 'compose up', and the app gates on
db-init: condition: service_completed_successfully.
- Zero manual steps for fresh AND existing deployments: update compose,
add DBSRVPASS to .env, 'compose pull && up -d'.
- Security posture improves: the superuser password is now held ONLY by
the init service — the app container connects exclusively as the
non-superuser runtime role.
- z_rls_role.sh gains dual connection modes (local socket for docker
exec, network for the init service) with the DBPASS requirement
enforced only in network mode.
- Verified on the dev stack: init runs and exits clean, app gates on it
and comes up healthy, second 'up' re-converges idempotently, invariant
test passes through the new dependency chain.
The initdb.d mount stays as-is (harmless double coverage on fresh
volumes; both paths are idempotent).
John O'Keefe
313268a7ae