# deploy/postgres.container
# ~/.config/containers/systemd/postgres.container
#
# Rootless. Generates postgres.service on daemon-reload.
#
#   podman secret create mapserver-db-password -
#   systemctl --user daemon-reload
#   systemctl --user start postgres

[Unit]
Description=PostgreSQL for mapserver

[Container]
Image=docker.io/library/postgres:17-alpine
ContainerName=mapserver-db

# Named volume, NOT a host bind mount: rootless podman maps container UIDs
# into the subuid range, and bind mounts hit permission errors that named
# volumes avoid entirely.
Volume=mapserver-pgdata:/var/lib/postgresql/data

# Localhost only. The Rust binary is the sole client.
PublishPort=127.0.0.1:5432:5432

Environment=POSTGRES_DB=mapserver
Environment=POSTGRES_USER=mapserver
Secret=mapserver-db-password,type=env,target=POSTGRES_PASSWORD

HealthCmd=pg_isready -U mapserver -d mapserver
HealthInterval=10s
HealthRetries=5

[Service]
Restart=always
TimeoutStartSec=120

[Install]
WantedBy=default.target