tested config + Postgres tweaks

Makefile

@@ -1,8 +1,12 @@
 # idea-collect — developer tasks
-# Override COMPOSE with `podman compose` or `podman-compose` if you prefer Podman locally.
-COMPOSE ?= docker compose
+# Dev mirrors production: everything runs under rootless Podman.
 DB_URL  ?= postgres://idea:idea@localhost:5432/idea?sslmode=disable
 
+# Dev Postgres (rootless Podman). Same image as the production quadlet.
+PG_IMAGE     ?= docker.io/library/postgres:18
+PG_CONTAINER ?= idea-collect-db
+PG_VOLUME    ?= idea-collect-pgdata
+
 .DEFAULT_GOAL := help
 
 .PHONY: help
@@ -12,12 +16,18 @@ help: ## Show this help
 
 ## ---- Database ----
 .PHONY: db-up db-down db-logs
-db-up: ## Start Postgres 18 (dev)
-	$(COMPOSE) -f compose.dev.yml up -d db
-db-down: ## Stop dev Postgres (keeps volume)
-	$(COMPOSE) -f compose.dev.yml down
+db-up: ## Start Postgres 18 (rootless Podman; idempotent)
+	podman run -d --replace --name $(PG_CONTAINER) \
+		-e POSTGRES_USER=idea -e POSTGRES_PASSWORD=idea -e POSTGRES_DB=idea \
+		-p 5432:5432 \
+		-v $(PG_VOLUME):/var/lib/postgresql \
+		--health-cmd 'pg_isready -U idea -d idea' \
+		--health-interval 5s --health-retries 10 \
+		$(PG_IMAGE)
+db-down: ## Stop and remove dev Postgres (keeps the data volume)
+	-podman rm -f -t 5 $(PG_CONTAINER)
 db-logs: ## Tail Postgres logs
-	$(COMPOSE) -f compose.dev.yml logs -f db
+	podman logs -f $(PG_CONTAINER)
 
 ## ---- Backend ----
 .PHONY: backend-run backend-build backend-test admin
@@ -46,9 +56,8 @@ e2e: db-up ## Start DB then run backend (use frontend-dev in another shell)
 	$(MAKE) backend-run
 
 ## ---- Containers ----
-# Use podman locally to mirror production; override with ENGINE=docker.
-ENGINE ?= podman
+# Rootless Podman mirrors production (the quadlets load these same images).
 .PHONY: images
 images: ## Build the backend + custom Caddy images
-	$(ENGINE) build -t localhost/idea-collect-backend:latest -f backend/Containerfile backend
-	$(ENGINE) build -t localhost/idea-collect-caddy:latest deploy/caddy
+	podman build -t localhost/idea-collect-backend:latest -f backend/Containerfile backend
+	podman build -t localhost/idea-collect-caddy:latest deploy/caddy

README.md

@@ -35,10 +35,10 @@ deploy/
 
 ## Quick start (local dev)
 
-Prerequisites: Go 1.26+, Node 20+, Podman or Docker.
+Prerequisites: Go 1.26+, Node 20+, rootless Podman.
 
 ```bash
-# 1. Start Postgres 18
+# 1. Start Postgres 18 (rootless Podman; mirrors the production quadlet)
 make db-up
 
 # 2. Run the backend (applies migrations on startup)

compose.dev.yml

@@ -1,20 +0,0 @@
-# Local development only. Production uses Podman quadlets in deploy/quadlets/.
-services:
-  db:
-    image: postgres:18
-    environment:
-      POSTGRES_USER: idea
-      POSTGRES_PASSWORD: idea
-      POSTGRES_DB: idea
-    ports:
-      - "5432:5432"
-    volumes:
-      - pgdata:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U idea -d idea"]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-
-volumes:
-  pgdata:

deploy/quadlets/postgres.container

@@ -7,7 +7,9 @@ After=network-online.target
 Image=docker.io/library/postgres:18
 ContainerName=postgres
 Network=idea-collect.network
-Volume=idea-pgdata.volume:/var/lib/postgresql/data:Z
+# Mount the parent so postgres:18 stores data in its version-specific subdir
+# (/var/lib/postgresql/18/...), which keeps in-place pg_upgrade possible.
+Volume=idea-pgdata.volume:/var/lib/postgresql:Z
 EnvironmentFile=%h/idea-collect/secrets/postgres.env
 # Only reachable inside idea-collect.network; no PublishPort.
 HealthCmd=pg_isready -U idea -d idea

deploy/secrets-examples/postgres.env.example

@@ -1,5 +1,6 @@
 # -> %h/idea-collect/secrets/postgres.env (rendered by Ansible from vault)
+# No PGDATA: the postgres:18 image defaults to a version-specific subdir under
+# the mounted /var/lib/postgresql volume (see deploy/quadlets/postgres.container).
 POSTGRES_USER=idea
 POSTGRES_PASSWORD=change-me-strong
 POSTGRES_DB=idea
-PGDATA=/var/lib/postgresql/data