Document Dockge PostgreSQL deployment

infra/dockge/README.md

@@ -0,0 +1,44 @@
+# OCSentinel PostgreSQL Dockge Stack
+
+Production is deployed as the Dockge stack directory:
+
+```text
+/dockerstacks/ocsentinel-postgres
+```
+
+The stack runs `postgres:16-alpine` as `ocsentinel-postgres` and joins the
+existing Docker network `n8n_n8n-network`. It deliberately has no `ports:`
+mapping, so PostgreSQL is not exposed on the host network or the Internet.
+
+The stack owns these private files on the server:
+
+```text
+/dockerstacks/ocsentinel-postgres/compose.yaml
+/dockerstacks/ocsentinel-postgres/.env
+/dockerstacks/ocsentinel-postgres/init/
+/dockerstacks/ocsentinel-postgres/data/
+```
+
+`.env` is root-readable only and contains both the PostgreSQL administrator
+password and the restricted `ocsentinel_n8n` password. Never commit it or copy
+it to endpoint devices.
+
+## n8n PostgreSQL Credential
+
+Create one credential in n8n with these non-secret values:
+
+| Setting | Value |
+| --- | --- |
+| Host | `ocsentinel-postgres` |
+| Port | `5432` |
+| Database | `ocsentinel` |
+| User | `ocsentinel_n8n` |
+| SSL | disabled (private Docker network) |
+
+Retrieve the password only on the server when entering the n8n credential:
+
+```bash
+sudo grep '^OCSENTINEL_N8N_PASSWORD=' /dockerstacks/ocsentinel-postgres/.env
+```
+
+The database schema source remains [../postgres/001_ocsentinel.sql](../postgres/001_ocsentinel.sql).