Initial import with GitLab CI/CD and registry deploy flow

docs/runbooks/postgres-server-docker.md

@@ -0,0 +1,88 @@
+# Runbook - Shared Docker Host PostgreSQL for call-center
+
+Use this runbook when the server already hosts other Docker projects and `call-center` still runs on SQLite. This flow creates an isolated PostgreSQL instance for `call-center` only and does not restart the current application stack.
+
+## Assets
+
+- Compose file: `deployment/docker-compose.postgres.server.yml`
+- Secret env file: `/home/mvpcc/call-center/.env.postgres.server`
+- Data directory: `/home/mvpcc/call-center/.data_pg`
+- Host-local PostgreSQL port: `127.0.0.1:5434`
+
+Future application connection string:
+
+- containers on the same Docker host: `postgresql://mvpcc_app:<secret>@call-center-postgres:5432/mvpcc`
+- host-local checks: `postgresql://mvpcc_app:<secret>@127.0.0.1:5434/mvpcc`
+
+## Bring-up
+
+From the repository root on the target server:
+
+```bash
+cd /home/mvpcc/call-center
+python3 - <<'PY'
+from pathlib import Path
+import secrets
+
+target = Path(".env.postgres.server")
+target.write_text(
+    "POSTGRES_DB=mvpcc\n"
+    "POSTGRES_USER=mvpcc_app\n"
+    f"POSTGRES_PASSWORD={secrets.token_urlsafe(32)}\n",
+    encoding="utf-8",
+)
+PY
+chmod 600 .env.postgres.server
+mkdir -p .data_pg
+chmod 700 .data_pg
+docker compose -f deployment/docker-compose.postgres.server.yml up -d
+```
+
+## Verification
+
+Container status and logs:
+
+```bash
+cd /home/mvpcc/call-center
+docker compose -f deployment/docker-compose.postgres.server.yml ps
+docker compose -f deployment/docker-compose.postgres.server.yml logs postgres --tail 50
+docker exec call-center-postgres pg_isready -U mvpcc_app -d mvpcc
+```
+
+Host-local connection check without installing `psql` on the server:
+
+```bash
+cd /home/mvpcc/call-center
+set -a
+. ./.env.postgres.server
+set +a
+docker run --rm --network host \
+  -e PGPASSWORD="$POSTGRES_PASSWORD" \
+  postgres:16-alpine \
+  psql -h 127.0.0.1 -p 5434 -U "$POSTGRES_USER" -d "$POSTGRES_DB" \
+  -Atqc "select current_database(), current_user;"
+```
+
+Port exposure check:
+
+```bash
+ss -ltn | grep 5434
+```
+
+Expected result:
+
+- the container is `healthy`
+- `pg_isready` returns `accepting connections`
+- the SQL check returns `mvpcc|mvpcc_app`
+- `ss` shows `127.0.0.1:5434`, not `0.0.0.0:5434`
+
+## Scope guardrails
+
+Do not do these actions in this step:
+
+- do not edit `deployment/docker-compose.server.yml`
+- do not switch `DATABASE_URL` for the running `call-center` services
+- do not run application migrations against the new PostgreSQL instance yet
+- do not touch existing PostgreSQL containers used by other projects
+
+When a second Dockerized `call-center` stack is added later on the same host, connect it to the external network `call-center-postgres_default` and use `call-center-postgres:5432` from the application containers.