🔧(yhub) align the yhub db credentials with the backend's dev ones

The yhub database ran under its own yhub role. Every other database in
this stack uses the backend's dev credentials, dinum/pass, which is also
what CI already uses for this database; only the database name stays
apart, since it is a separate database on a separate server.

The url the collaboration server connects with moves into the same file,
beside the credentials it repeats, written once rather than twice — the
yhub service reads the file as well. A yhub-postgres.local override is
created like for the other env files, and the healthcheck asks about
POSTGRES_DB and POSTGRES_USER like the other two do instead of naming the
role.

POSTGRES_USER only takes effect on a fresh initdb, so an existing stack
needs its yhub-pgdata volume dropped and `make migrate-yhub` re-run; the
volume holds local document state only.

Signed-off-by: Kevin Jahns <kevin.jahns@protonmail.com>

Makefile

@@ -88,6 +88,7 @@ create-env-local-files:
 	@touch env.d/development/postgresql.local
 	@touch env.d/development/kc_auth.local
 	@touch env.d/development/kc_postgresql.local
+	@touch env.d/development/yhub-postgres.local
 	@touch env.d/development/yhub.local
 .PHONY: create-env-local-files
 

compose.yml

@@ -229,10 +229,11 @@ services:
     image: postgres:16-alpine
     env_file:
       - env.d/development/yhub-postgres
+      - env.d/development/yhub-postgres.local
     volumes:
       - yhub-pgdata:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U yhub"]
+      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
       interval: 1s
       timeout: 2s
       retries: 60
@@ -251,9 +252,13 @@ services:
     image: impress:yhub-development
     environment:
       HOME: /tmp # same reason as node-based services above (unmapped uid)
-    # its own file rather than the backend's: this server reads none of the
-    # django settings `common` carries, and everything it does read is in there
+    # its own files rather than the backend's: this server reads none of the
+    # django settings `common` carries. The database url is in the file its
+    # postgres is configured from, beside the credentials it spells out;
+    # everything else this server reads is in `yhub`
     env_file:
+      - env.d/development/yhub-postgres
+      - env.d/development/yhub-postgres.local
       - env.d/development/yhub
       - env.d/development/yhub.local
     volumes:

env.d/development/yhub

@@ -1,14 +1,16 @@
 # Collaboration server (yhub)
 #
-# Everything the collaboration server reads, and nothing else: it shares the
-# backend's stores and origins by value, not by loading the backend's own
-# environment. Override any of it in yhub.local, which is not committed.
+# Everything the collaboration server reads but its database url, and nothing
+# else: it shares the backend's stores and origins by value, not by loading the
+# backend's own environment. Override any of it in yhub.local, which is not
+# committed.
 
 # Stores. Its own valkey and its own postgres database — the backend's live
-# next to them and are never touched from here.
+# next to them and are never touched from here. The postgres url is not here
+# but in `yhub-postgres`, the file that database is configured from, so that
+# its credentials are written once; this service reads that file too.
 PORT=3002
 REDIS=redis://yhub-valkey:6379
-POSTGRES=postgres://yhub:pass@yhub-postgres:5432/yhub
 REDIS_PREFIX=yhub
 
 # Backend. It answers who a user is and what they may do with a document, and

env.d/development/yhub-postgres

@@ -1,4 +1,13 @@
 # Postgresql db container configuration for the collaboration server (yhub).
+# Its own database on its own server: the backend's lives next to it and is
+# never touched from here. The credentials are the backend's dev ones, and the
+# ones CI uses for this database too — only the database name differs.
 POSTGRES_DB=yhub
-POSTGRES_USER=yhub
+POSTGRES_USER=dinum
 POSTGRES_PASSWORD=pass
+
+# What the collaboration server connects with: the credentials above spelled as
+# a url, which is the only form it takes. Read by the `yhub` service as well,
+# which is why it lives here rather than next to the rest of that server's
+# settings — the password is written once.
+POSTGRES=postgres://dinum:pass@yhub-postgres:5432/yhub

src/yhub-server/README.md

@@ -596,9 +596,11 @@ provider answers to), `LEGACY_S3_SIGNATURE_VERSION` (see below), and
 `LEGACY_S3_BUCKET_NAME` (defaults to Django's dev default
 `impress-media-storage`; production uses a different bucket name and must set
 it explicitly). The server refuses to boot when the flag is set without
-endpoint and credentials. In development they come, like everything else this
-server reads, from `env.d/development/yhub` (and `yhub.local`, which is not
-committed — `make create-env-local-files` creates it).
+endpoint and credentials. In development they come from
+`env.d/development/yhub`, which holds everything this server reads but the
+database url — that one is in `env.d/development/yhub-postgres`, beside the
+credentials it spells out. Both have a `.local` counterpart, not committed,
+that `make create-env-local-files` creates.
 
 The bucket is read with the **AWS SDK for JavaScript v3**
 (`@aws-sdk/client-s3`), the same library family boto3 is to Django, so the