Dockerfile-multigres

# syntax=docker/dockerfile:1.6
# Multigres PostgreSQL 17 variants — vanilla and OrioleDB
#
# Build targets:
#   docker build -f Dockerfile-multigres --target variant-17 -t multigres-17 .
#   docker build -f Dockerfile-multigres --target variant-orioledb-17 -t multigres-orioledb-17 .

####################
# Stage 0: Nix base — shared Alpine + Nix setup for all builders
####################
FROM alpine:3.21 AS nix-base

RUN apk add --no-cache \
    bash \
    coreutils \
    curl \
    shadow \
    sudo \
    xz

RUN addgroup -S postgres && \
    adduser -S -h /var/lib/postgresql -s /bin/bash -G postgres postgres && \
    addgroup -S wal-g && \
    adduser -S -s /bin/bash -G wal-g wal-g

RUN cat <<EOF > /tmp/extra-nix.conf
extra-experimental-features = nix-command flakes
extra-substituters = https://nix-postgres-artifacts.s3.amazonaws.com
extra-trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=
EOF
RUN curl -L https://releases.nixos.org/nix/nix-2.33.2/install | sh -s -- --daemon --no-channel-add --yes --nix-extra-conf-file /tmp/extra-nix.conf

ENV PATH="${PATH}:/nix/var/nix/profiles/default/bin"

WORKDIR /nixpg
COPY . .

####################
# Stage 1a: Nix builder — PostgreSQL 17
####################
FROM nix-base AS nix-builder-17

RUN nix profile add path:.#psql_17_slim/bin path:.#pg-backrest path:.#pgctld

RUN nix store gc

RUN nix profile add path:.#supabase-groonga && \
    mkdir -p /tmp/groonga-plugins && \
    cp -r /nix/var/nix/profiles/default/lib/groonga/plugins /tmp/groonga-plugins/

RUN nix store gc

####################
# Stage 1b: Nix builder — OrioleDB 17
####################
FROM nix-base AS nix-builder-orioledb-17

RUN nix profile add path:.#psql_orioledb-17_slim/bin path:.#pg-backrest path:.#pgctld

RUN nix store gc

RUN nix profile add path:.#supabase-groonga && \
    mkdir -p /tmp/groonga-plugins && \
    cp -r /nix/var/nix/profiles/default/lib/groonga/plugins /tmp/groonga-plugins/

RUN nix store gc

####################
# Stage 2: Gosu builder
####################
FROM alpine:3.21 AS gosu-builder

ARG TARGETARCH
ARG GOSU_VERSION=1.16

RUN apk add --no-cache gnupg curl

RUN curl -fsSL "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${TARGETARCH}" -o /usr/local/bin/gosu && \
    curl -fsSL "https://github.com/tianon/gosu/releases/download/${GOSU_VERSION}/gosu-${TARGETARCH}.asc" -o /usr/local/bin/gosu.asc && \
    GNUPGHOME="$(mktemp -d)" && \
    export GNUPGHOME && \
    gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 && \
    gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu && \
    rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc && \
    chmod +x /usr/local/bin/gosu

####################
# Stage 3: Shared base — runtime Alpine + config + migrations
# Both variants inherit from this stage. No /nix dependency here.
####################
FROM alpine:3.21 AS base

RUN apk add --no-cache \
    bash \
    curl \
    openssh \
    procps \
    shadow \
    su-exec \
    tzdata \
    musl-locales \
    musl-locales-lang \
    && rm -rf /var/cache/apk/*

RUN addgroup -S postgres && \
    adduser -S -G postgres -h /var/lib/postgresql -s /bin/bash postgres && \
    addgroup -S wal-g && \
    adduser -S -G wal-g -s /bin/bash wal-g && \
    adduser postgres wal-g

RUN mkdir -p \
    /usr/lib/postgresql/bin \
    /usr/lib/postgresql/share/postgresql \
    /usr/share/postgresql \
    /var/lib/postgresql/data \
    /var/run/postgresql \
    /etc/postgresql \
    /etc/postgresql-custom \
    && chown -R postgres:postgres \
        /usr/lib/postgresql \
        /var/lib/postgresql \
        /usr/share/postgresql \
        /var/run/postgresql \
        /etc/postgresql \
        /etc/postgresql-custom

COPY --chown=postgres:postgres ansible/files/postgresql_config/postgresql.conf.j2 /etc/postgresql/postgresql.conf
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_hba.conf.j2 /etc/postgresql/pg_hba.conf
COPY --chown=postgres:postgres ansible/files/postgresql_config/pg_ident.conf.j2 /etc/postgresql/pg_ident.conf
COPY --chown=postgres:postgres ansible/files/postgresql_config/conf.d /etc/postgresql-custom/conf.d
COPY --chown=postgres:postgres ansible/files/postgresql_config/postgresql-stdout-log.conf /etc/postgresql/logging.conf
COPY --chown=postgres:postgres ansible/files/postgresql_config/supautils.conf.j2 /etc/postgresql-custom/supautils.conf
COPY --chown=postgres:postgres ansible/files/postgresql_extension_custom_scripts /etc/postgresql-custom/extension-custom-scripts
COPY --chown=postgres:postgres ansible/files/postgresql_config/custom_walg.conf /etc/postgresql-custom/wal-g.conf
COPY --chown=postgres:postgres ansible/files/postgresql_config/custom_read_replica.conf /etc/postgresql-custom/read-replica.conf
COPY --chown=postgres:postgres ansible/files/pgsodium_getkey_urandom.sh.j2 /usr/lib/postgresql/bin/pgsodium_getkey.sh

# Apply settings shared by all variants:
#   - enable unix socket, session preload, config includes
#   - strip timescaledb and pgsodium (absent from all pg17 builds)
#   - comment out db_user_namespace (not supported in pg17)
RUN sed -i \
    -e "s|#unix_socket_directories = '/tmp'|unix_socket_directories = '/var/run/postgresql'|g" \
    -e "s|#session_preload_libraries = ''|session_preload_libraries = 'supautils'|g" \
    -e "s|#include = '/etc/postgresql-custom/supautils.conf'|include = '/etc/postgresql-custom/supautils.conf'|g" \
    -e "s|#include = '/etc/postgresql-custom/wal-g.conf'|include = '/etc/postgresql-custom/wal-g.conf'|g" \
    -e "s/ timescaledb,//g" \
    -e "s/ pgsodium,//g" \
    -e "s/db_user_namespace = off/#db_user_namespace = off/g" \
    /etc/postgresql/postgresql.conf && \
    echo "pgsodium.getkey_script= '/usr/lib/postgresql/bin/pgsodium_getkey.sh'" >> /etc/postgresql/postgresql.conf && \
    echo "vault.getkey_script= '/usr/lib/postgresql/bin/pgsodium_getkey.sh'" >> /etc/postgresql/postgresql.conf && \
    chown -R postgres:postgres /etc/postgresql-custom && \
    mkdir -p /usr/share/postgresql/extension/ && \
    ln -s /usr/lib/postgresql/bin/pgsodium_getkey.sh /usr/share/postgresql/extension/pgsodium_getkey && \
    chmod +x /usr/lib/postgresql/bin/pgsodium_getkey.sh

COPY migrations/db /docker-entrypoint-initdb.d/
COPY ansible/files/pgbouncer_config/pgbouncer_auth_schema.sql /docker-entrypoint-initdb.d/init-scripts/00-schema.sql
COPY ansible/files/stat_extension.sql /docker-entrypoint-initdb.d/migrations/00-extension.sql

ENV PGDATA=/var/lib/postgresql/data
ENV POSTGRES_HOST=/var/run/postgresql
ENV POSTGRES_USER=supabase_admin
ENV POSTGRES_DB=postgres
ENV POSTGRES_INITDB_ARGS="--allow-group-access --locale-provider=icu --encoding=UTF-8 --icu-locale=en_US.UTF-8"
ENV LANG=en_US.UTF-8
ENV LANGUAGE=en_US:en
ENV LC_ALL=en_US.UTF-8
ENV GRN_PLUGINS_DIR=/usr/lib/groonga/plugins

####################
# Stage 4a: variant-17 — PostgreSQL 17 (vanilla)
####################
FROM base AS variant-17

COPY --from=nix-builder-17 /nix /nix
COPY --from=nix-builder-17 /tmp/groonga-plugins/plugins /usr/lib/groonga/plugins
COPY --from=gosu-builder /usr/local/bin/gosu /usr/local/bin/gosu

RUN for f in /nix/var/nix/profiles/default/bin/*; do \
        ln -sf "$f" /usr/lib/postgresql/bin/ 2>/dev/null || true; \
        ln -sf "$f" /usr/bin/ 2>/dev/null || true; \
    done && \
    ln -sf /nix/var/nix/profiles/default/share/postgresql/* /usr/lib/postgresql/share/postgresql/ 2>/dev/null || true && \
    ln -sf /nix/var/nix/profiles/default/share/postgresql/* /usr/share/postgresql/ 2>/dev/null || true && \
    ln -sf /usr/lib/postgresql/share/postgresql/timezonesets /usr/share/postgresql/timezonesets 2>/dev/null || true

RUN chown -R postgres:postgres /usr/lib/postgresql && \
    chown -R postgres:postgres /usr/share/postgresql

COPY docker/pgctld/postgresql.conf.tmpl /etc/pgctld/postgresql.conf.tmpl

# Wrapper: injects --postgres-config-template on every pgctld call so the team's
# unmodified k8s manifests and local provisioner commands work without extra flags.
RUN printf '#!/bin/sh\nexec /nix/var/nix/profiles/default/bin/pgctld --postgres-config-template /etc/pgctld/postgresql.conf.tmpl "$@"\n' \
    > /usr/local/bin/pgctld && \
    chmod +x /usr/local/bin/pgctld

# Strip extensions absent from pg17 vanilla build
RUN sed -i 's/ timescaledb,//g; s/ plv8,//g' /etc/postgresql-custom/supautils.conf

ENV PATH="/nix/var/nix/profiles/default/bin:/usr/lib/postgresql/bin:${PATH}"
ENV LOCALE_ARCHIVE=/nix/var/nix/profiles/default/lib/locale/locale-archive

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD pg_isready -U postgres -h localhost || true
STOPSIGNAL SIGINT
USER postgres
EXPOSE 5432

ENTRYPOINT ["tail"]
CMD ["-f", "/dev/null"]

####################
# Stage 4b: variant-orioledb-17 — PostgreSQL 17 with OrioleDB
####################
FROM base AS variant-orioledb-17

COPY --from=nix-builder-orioledb-17 /nix /nix
COPY --from=nix-builder-orioledb-17 /tmp/groonga-plugins/plugins /usr/lib/groonga/plugins
COPY --from=gosu-builder /usr/local/bin/gosu /usr/local/bin/gosu

RUN for f in /nix/var/nix/profiles/default/bin/*; do \
        ln -sf "$f" /usr/lib/postgresql/bin/ 2>/dev/null || true; \
        ln -sf "$f" /usr/bin/ 2>/dev/null || true; \
    done && \
    ln -sf /nix/var/nix/profiles/default/share/postgresql/* /usr/lib/postgresql/share/postgresql/ 2>/dev/null || true && \
    ln -sf /nix/var/nix/profiles/default/share/postgresql/* /usr/share/postgresql/ 2>/dev/null || true && \
    ln -sf /usr/lib/postgresql/share/postgresql/timezonesets /usr/share/postgresql/timezonesets 2>/dev/null || true

RUN chown -R postgres:postgres /usr/lib/postgresql && \
    chown -R postgres:postgres /usr/share/postgresql

# Strip extensions absent from orioledb-17 build
RUN sed -i 's/ timescaledb,//g; s/ plv8,//g; s/ postgis,//g; s/ pgrouting,//g' \
    /etc/postgresql-custom/supautils.conf

# Add orioledb to shared_preload_libraries and configure as default table access method
# Rewind: 1200s window, 100k transactions, 1280 x 8KB = 10MB buffer
RUN sed -i "s/\(shared_preload_libraries.*\)'/\1, orioledb'/" /etc/postgresql/postgresql.conf && \
    echo "default_table_access_method = 'orioledb'" >> /etc/postgresql/postgresql.conf && \
    echo "orioledb.enable_rewind = true" >> /etc/postgresql/postgresql.conf && \
    echo "orioledb.rewind_max_time = 1200" >> /etc/postgresql/postgresql.conf && \
    echo "orioledb.rewind_max_transactions = 100000" >> /etc/postgresql/postgresql.conf && \
    echo "orioledb.rewind_buffers = 1280" >> /etc/postgresql/postgresql.conf

# Register orioledb before initdb migrations run
RUN echo "CREATE EXTENSION orioledb;" > /docker-entrypoint-initdb.d/init-scripts/00-pre-init.sql && \
    chown postgres:postgres /docker-entrypoint-initdb.d/init-scripts/00-pre-init.sql

# pgctld calls initdb without locale flags, so it picks up LANG from the environment.
# OrioleDB requires C, POSIX, or ICU collations; override the base stage's en_US.UTF-8.
ENV LANG=C
ENV LC_ALL=C
ENV LANGUAGE=C

COPY docker/pgctld/orioledb-postgresql.conf.tmpl /etc/pgctld/orioledb-postgresql.conf.tmpl

# Wrapper: injects --postgres-config-template on every pgctld call so the team's
# unmodified k8s manifests and local provisioner commands work without extra flags.
RUN printf '#!/bin/sh\nexec /nix/var/nix/profiles/default/bin/pgctld --postgres-config-template /etc/pgctld/orioledb-postgresql.conf.tmpl "$@"\n' \
    > /usr/local/bin/pgctld && \
    chmod +x /usr/local/bin/pgctld

ENV PATH="/nix/var/nix/profiles/default/bin:/usr/lib/postgresql/bin:${PATH}"
ENV LOCALE_ARCHIVE=/nix/var/nix/profiles/default/lib/locale/locale-archive

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD pg_isready -U postgres -h localhost || true
STOPSIGNAL SIGINT
USER postgres
EXPOSE 5432

ENTRYPOINT ["tail"]
CMD ["-f", "/dev/null"]