# OfficeCom Sentinel PostgreSQL

PostgreSQL is the private central store for endpoint reports. It is never
contacted directly by an endpoint; only n8n uses a database account.

## Provisioning

The production instance is deployed as the private Dockge stack documented in
[../dockge/README.md](../dockge/README.md). The bootstrap has already created
the database, schema, and restricted `ocsentinel_n8n` role.

For a separate future installation:

1. Create a database named `ocsentinel` on the private PostgreSQL server.
2. Apply `001_ocsentinel.sql` as a database administrator.
3. Create a non-superuser n8n login and grant only the necessary permissions:

```sql
GRANT USAGE ON SCHEMA ocsentinel TO ocsentinel_n8n;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA ocsentinel TO ocsentinel_n8n;
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ocsentinel TO ocsentinel_n8n;
GRANT SELECT ON ocsentinel.current_device_status, ocsentinel.organization_summary TO ocsentinel_n8n;
ALTER DEFAULT PRIVILEGES IN SCHEMA ocsentinel
  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ocsentinel_n8n;
```

Keep the database host, password, and TLS settings only in n8n credentials.
They do not belong in Gitea, NinjaOne scripts, or endpoint configuration.

## Maintenance

Run monthly from n8n or an administrator session to remove expired replay tokens:

```sql
DELETE FROM ocsentinel.ingest_nonce WHERE expires_at < now();
```