Document Dockge PostgreSQL deployment

docs/ocsentinel-n8n-contract.md

@@ -55,6 +55,9 @@ able to reach the webhook URL over HTTPS.
 
 Use an n8n credential for the shared HMAC secret and a separate n8n credential
 for PostgreSQL. Do not store either value in workflow JSON or this repository.
+For the current Docker deployment, use the private hostname
+`ocsentinel-postgres` and the restricted database role `ocsentinel_n8n`; see
+`infra/dockge/README.md` for the remaining credential fields.
 
 ## PostgreSQL Scope
 

infra/dockge/README.md

@@ -0,0 +1,44 @@
+# OCSentinel PostgreSQL Dockge Stack
+
+Production is deployed as the Dockge stack directory:
+
+```text
+/dockerstacks/ocsentinel-postgres
+```
+
+The stack runs `postgres:16-alpine` as `ocsentinel-postgres` and joins the
+existing Docker network `n8n_n8n-network`. It deliberately has no `ports:`
+mapping, so PostgreSQL is not exposed on the host network or the Internet.
+
+The stack owns these private files on the server:
+
+```text
+/dockerstacks/ocsentinel-postgres/compose.yaml
+/dockerstacks/ocsentinel-postgres/.env
+/dockerstacks/ocsentinel-postgres/init/
+/dockerstacks/ocsentinel-postgres/data/
+```
+
+`.env` is root-readable only and contains both the PostgreSQL administrator
+password and the restricted `ocsentinel_n8n` password. Never commit it or copy
+it to endpoint devices.
+
+## n8n PostgreSQL Credential
+
+Create one credential in n8n with these non-secret values:
+
+| Setting | Value |
+| --- | --- |
+| Host | `ocsentinel-postgres` |
+| Port | `5432` |
+| Database | `ocsentinel` |
+| User | `ocsentinel_n8n` |
+| SSL | disabled (private Docker network) |
+
+Retrieve the password only on the server when entering the n8n credential:
+
+```bash
+sudo grep '^OCSENTINEL_N8N_PASSWORD=' /dockerstacks/ocsentinel-postgres/.env
+```
+
+The database schema source remains [../postgres/001_ocsentinel.sql](../postgres/001_ocsentinel.sql).

infra/postgres/README.md

@@ -5,7 +5,13 @@ contacted directly by an endpoint; only n8n uses a database account.
 
 ## Provisioning
 
-1. Create a database named `ocsentinel` on the existing private PostgreSQL server.
+The production instance is deployed as the private Dockge stack documented in
+[../dockge/README.md](../dockge/README.md). The bootstrap has already created
+the database, schema, and restricted `ocsentinel_n8n` role.
+
+For a separate future installation:
+
+1. Create a database named `ocsentinel` on the private PostgreSQL server.
 2. Apply `001_ocsentinel.sql` as a database administrator.
 3. Create a non-superuser n8n login and grant only the necessary permissions: