# OCSentinel PostgreSQL Dockge Stack

Production is deployed as the Dockge stack directory:

```text
/dockerstacks/ocsentinel-postgres
```

The stack runs `postgres:16-alpine` as `ocsentinel-postgres` and joins the
existing Docker network `n8n_n8n-network`. It deliberately has no `ports:`
mapping, so PostgreSQL is not exposed on the host network or the Internet.

The stack owns these private files on the server:

```text
/dockerstacks/ocsentinel-postgres/compose.yaml
/dockerstacks/ocsentinel-postgres/.env
/dockerstacks/ocsentinel-postgres/init/
/dockerstacks/ocsentinel-postgres/data/
```

`.env` is root-readable only and contains both the PostgreSQL administrator
password and the restricted `ocsentinel_n8n` password. Never commit it or copy
it to endpoint devices.

## n8n PostgreSQL Credential

Create one credential in n8n with these non-secret values:

| Setting | Value |
| --- | --- |
| Host | `ocsentinel-postgres` |
| Port | `5432` |
| Database | `ocsentinel` |
| User | `ocsentinel_n8n` |
| SSL | disabled (private Docker network) |

Retrieve the password only on the server when entering the n8n credential:

```bash
sudo grep '^OCSENTINEL_N8N_PASSWORD=' /dockerstacks/ocsentinel-postgres/.env
```

The database schema source remains [../postgres/001_ocsentinel.sql](../postgres/001_ocsentinel.sql).