Postgres 16 → 18 (needs a dump/restore at deploy, see runbook)

[radiantnode]

Warning

Draft on purpose. This needs a manual data migration at deploy time. Deploying it with a plain up -d starts Postgres 18 on an empty volume. The app would create a fresh schema and serve normally with no accounts, passkeys or history. Nothing would be destroyed (the old cluster stays in pg_data), but new writes would go to the empty database. Follow the runbook below.

Stacked on #113. Merge that first, and this PR retargets to main by itself.

Postgres 16.15 → 18.6 in prod (digest-pinned), and 16-alpine → 18-alpine in dev, design and CI.

Why a new volume

Postgres majors don't share an on-disk format, and the 18 image moved PGDATA to /var/lib/postgresql/18/docker (the volume now mounts at /var/lib/postgresql). Prod gets a fresh pg18_data volume. pg_data (the 16.x cluster) is left untouched as the rollback copy. The data moves by pg_dumpall/restore, which is fine for an 83 MB database.

Runbook (prod, about 2 minutes of downtime)

cd ~/deploy/tensies
C="docker compose -f docker-compose.prod.yml --env-file .env.prod"
git checkout <this branch or main after merge>
$C stop web nginx                                   # freeze writes
docker exec tensies-postgres-1 pg_dumpall -U tensies > /tmp/pg16.sql
$C up -d postgres                                   # PG18 on pg18_data, initdb
until $C exec -T postgres pg_isready -U tensies; do sleep 1; done
$C exec -T postgres psql -q -U tensies -d postgres < /tmp/pg16.sql   # "role tensies already exists" is expected
# check: should match the 16.x numbers taken before
$C exec -T postgres psql -U tensies -tAc "select (select count(*) from users), (select count(*) from events)"
$C up -d && docker restart tensies-nginx-1
rm /tmp/pg16.sql

Rollback: check out the previous commit and $C up -d postgres. It remounts pg_data with 16.x exactly as it was when you stopped it.

The dump contains the tensies role's password hash, which carries over into the restore. That's harmless in prod, where it's the same POSTGRES_PASSWORD.

Dev stack: it also moves to a new pg18_data volume, so local dev starts with an empty database. tensies-dev_pg_data stays on disk.

Verified locally, using a real dump of prod

• pg_dumpall of prod (read-only) restored into postgres:18.6-alpine on a fresh volume mounted at /var/lib/postgresql. Row counts match prod exactly: users 3/3, webauthn_credentials 3/3, events 84,473/84,473.
• The current app image started against it with no migrations to apply. /api/leaderboard served the real leaderboard, the multi-instance WebSocket test passed 16/16, and telemetry writes landed (events 84,473 → 84,569).
• On a fresh Postgres 18 database, all nine migrations apply and the WebSocket test passes 16/16.
• docker compose config validates all three compose files.
• The dump was deleted after the test.

🤖 Generated with Claude Code

https://claude.ai/code/session_015bPJkYdnfm2KVcEzTiJuSM