feat: add Mattermost stack with PostgreSQL streaming replication
* feat: add mattermost stack with PostgreSQL streaming replication [AGENT]
Add self-hosted Mattermost (Team Edition) + PostgreSQL stack under
stacks/mattermost/, following existing conventions (compose.yaml,
.env.example, README.md).
Designed for a two-node primary/standby setup across two macOS hosts
running Colima Docker, with PostgreSQL streaming replication tunnelled
over SSH between VMs. Mattermost runs as a single-node stack on each
host and connects to its local PG; a standby PG automatically rejects
writes from Mattermost without any application-level changes.
Files:
- compose.yaml: Mattermost + PostgreSQL services with healthcheck
- .env.example: all configurable variables with inline comments
- initdb/01-replication.sh: creates replicator role + WAL on first init
- README.md: five-step deployment guide covering single node, VM nginx
proxy, second node, streaming replication setup, and failover/pg_rewind
* fix: address PR review feedback on mattermost stack [AGENT]
- Add POSTGRES_REPLICATION_PASSWORD to .env.example (was missing)
- initdb: fail fast if POSTGRES_REPLICATION_PASSWORD is unset (no insecure default)
- initdb: use createuser + ALTER ROLE with dollar-quoting instead of SQL string
literal to avoid single-quote injection in the password
- initdb: restrict pg_hba replication entry to 127.0.0.1/32 (loopback only,
matching the SSH reverse tunnel termination point) instead of 0.0.0.0/0
- README: tunnel now binds on 127.0.0.1 (not 0.0.0.0) on the remote side,
consistent with the pg_hba restriction
- README: pg_rewind step now uses POSTGRES_USER (superuser) instead of
replicator role, which lacks the required privilege
- README: clarify that POSTGRES_ROLE is informational only; standby.signal
written by pg_basebackup -R is what makes PG read-only, not this variable;
initdb script should be omitted on the standby node
* fix: address second round of PR review feedback [AGENT]
- compose.yaml: pass POSTGRES_REPLICATION_PASSWORD through to the postgres
container environment so the initdb guard clause can read it
- initdb: add wal_log_hints = on to the WAL settings block; pg_rewind
requires either wal_log_hints or data checksums to work correctly
- compose.yaml: soften the POSTGRES_ROLE comment to match the README --
it is documentation-only, not a runtime control variable
---------
Co-authored-by: 爪爪(Clawlet) <clawlet@clawlet.local>