postgresql deploy

About

The office suite runs on PostgreSQL. The postgres + postgres-init services create and initialise the database, and the other services connect to it through the POSTGRES_* variables.

1. Deploy

git clone https://github.com/bindoffice/bind-docker.git

cd bind-docker/office
cp env.example .env
Modify the .env configuration, modify all variables marked with ‘Need modify’
make openssl

make
Access https://work.example.com as described in the docker deploy document

2. PostgreSQL variables

Variable

Default

Description

POSTGRES_IMAGE

postgres:16

PostgreSQL image

POSTGRES_ADDR

127.0.0.1:5432

PostgreSQL address, used by the services and also as the published port, see section 3

POSTGRES_USER

postgres

PostgreSQL user, need modify

POSTGRES_PASSWORD

changepassword

PostgreSQL password, need modify

POSTGRES_EXTENSIONS

empty

Extra extensions created on first start, comma separated, for example pg_trgm,uuid-ossp

The complete variable list is on the Configuration file example page.

3. PostgreSQL and Redis ports

postgres and redis are the only services that do not use host networking: the ports option is ignored in host network mode, so those ports would never reach the host machine. Both services use their own address variable as the published address:

Variable

Default

Expose on the LAN

POSTGRES_ADDR

127.0.0.1:5432

0.0.0.0:5432

REDIS_ADDR

127.0.0.1:6379

0.0.0.0:6379

The default 127.0.0.1 publishes the port on the host loopback only, which is all a local client needs:

psql "postgresql://postgres:<POSTGRES_PASSWORD>@127.0.0.1:5432/<DB_NAME>?sslmode=disable"

redis-cli -h 127.0.0.1 -p 6379

Do not set REDIS_ADDR to 0.0.0.0:6379: redis runs without a password, so that would expose the session and cache data to everyone on the network.

The remaining services still use host networking and reach these two ports on 127.0.0.1, so BIND_SQLDB and BIND_SESSION_HEDIS_HOST need no change. Connections that arrive through the published port do not come from 127.0.0.1, so PostgreSQL authenticates them with POSTGRES_PASSWORD instead of the local trust rule in pg_hba.conf.

When the whole stack runs on Docker Desktop for macOS, only published ports are forwarded to macOS, so the other services (web, smtp, imap …) cannot be reached from the Mac even though they listen inside the Docker VM. OrbStack shares the host network with macOS, so all of them are reachable from the Mac.

4. Data

The database and the cache keep their data in their own directories:

Directory

Data

office/postgres/data/pgdata

PostgreSQL files

office/redis/data

redis files