The lake is one shared warehouse (s3://era5-thermograph/iceberg), so the
environments differ only in where the engine runs: a throwaway docker run
of a small DuckDB image (httpfs + iceberg extensions baked in) on the
target box, locally for LAN dev and over SSH for beta/prod. No daemon, no
listening port, no tunnel, and no container names to resolve.
No catalog service: each table's newest metadata JSON is resolved at call
time and exposed as a view named after its table directory, so reads track
a table that is still being loaded.
Sessions lock themselves down before user SQL runs (allowed_directories
pinned to the lake prefixes, external access disabled, configuration
locked), so writes to backups/ or local files are refused by the engine
itself. Credentials resolve at call time from the target host's env file
or a caller-side sops decrypt, handed over via stdin, never argv.
Handoff for the Iceberg worker: the contract iceberg.sh must satisfy (same
interface shape as dbq.sh, read-only enforced by the system, no new network
endpoints, call-time container resolution), the environment constraints that
will otherwise bite -- prod's Swarm overlay is unroutable from its own host so
tunnels are impossible, Contabo object storage requires path-style addressing,
the backups/ prefix is live, and beta's /etc/thermograph.env is unreadable by
the deploy user -- plus the decisions to report back, acceptance criteria with
a demonstrated refused write, and anti-goals.
Uniform read-only query access to the LAN dev, beta and prod databases, plus a
thermograph_ro role in each to enforce it.
None of the databases are exposed over TCP: each listens only on its private
docker network, and prod's is a Swarm overlay the host cannot route to -- so
ssh -L works for beta but is impossible for prod, and publishing 5432 would mean
new ufw rules and a Swarm endpoint change on production. Running psql inside the
db container works identically everywhere with no ports, tunnels or infra
changes, so dbq.sh does that: local docker exec for dev, ssh for beta/prod. The
prod container is a Swarm task whose name changes each redeploy, so it is
resolved at call time rather than hardcoded.
Queries connect as thermograph_ro (NOSUPERUSER, granted only pg_read_all_data),
so a stray write fails with "permission denied" even against prod; the app's own
superuser role is deliberately unused here. Extra args pass through to psql and
stdin is forwarded.
ops/README.md documents usage and the conventions Iceberg will follow when it
lands as a sibling (env-keyed dispatch, run the engine where the data is
reachable, dedicated read-only identity).
