wip

.gitignore

@@ -15,3 +15,4 @@ terraform.rc
 secrets.yaml
 .env
 *~
+data/

docker/pgproxy/README.md

@@ -0,0 +1,3 @@
+# pgproxy
+
+- [stolen from here](https://github.com/rafitox/pgproxy_tailscale)

docker/pgproxy/docker-compose.yml

@@ -0,0 +1,56 @@
+---
+services:
+  postgres:
+    image: postgres:18.0-alpine
+    container_name: postgres
+    environment:
+      POSTGRES_USER: ${PGPROXY_POSTGRES_USER}
+      POSTGRES_PASSWORD: ${PGPROXY_POSTGRES_PASSWORD}
+    networks:
+      - pgnet
+    dns:
+      - 9.9.9.9
+    volumes:
+      - ./data/pgdata:/var/lib/postgresql/data
+      - ./data/certs/server.crt:/var/lib/postgresql/server.crt:ro
+      - ./data/certs/server.key:/var/lib/postgresql/server.key:ro
+    command:
+      [
+        "-c", "ssl=off",
+        "-c", "ssl_cert_file=/var/lib/postgresql/server.crt",
+        "-c", "ssl_key_file=/var/lib/postgresql/server.key"
+      ]
+
+  pgproxy:
+    image: rafaelribeiro96/pgproxy:1.82.5
+    command:
+      [
+        "--hostname", "pgproxy-node",
+        "--upstream-addr", "postgres:5432",
+        "--port", "5432",
+        "--upstream-ca-file", "/certs/ca.pem",
+        "--state-dir", "/var/lib/pgproxy",
+      ]
+    container_name: pgproxy
+    restart: unless-stopped
+    environment:
+      PGHOST: postgres
+      PGPORT: "5432"
+      PGUSER: ${PGPROXY_POSTGRES_USER}
+      PGPASSWORD: ${PGPROXY_POSTGRES_PASSWORD}
+      TSKEY: ${PGPROXY_TSKEY_API}
+      TS_AUTHKEY: ${PGPROXY_TSKEY_API}
+    ports:
+      - "5432:5432"
+    networks:
+      - pgnet
+    dns:
+      - 9.9.9.9
+    depends_on:
+      - postgres
+    volumes:
+      - ./data/pgproxy-state:/var/lib/pgproxy
+      - ./data/certs/ca.pem:/certs/ca.pem:ro
+networks:
+  pgnet:
+    driver: bridge

docker/pgproxy/sample.env

@@ -0,0 +1,3 @@
+PGPROXY_POSTGRES_USER=
+PGPROXY_POSTGRES_PASSWORD=
+PGPROXY_TSKEY_API=