oc-sentinel/infra/postgres/README.md

OfficeCom Sentinel PostgreSQL

PostgreSQL is the private central store for endpoint reports. It is never contacted directly by an endpoint; only n8n uses a database account.

Provisioning

1. Create a database named ocsentinel on the existing private PostgreSQL server.
2. Apply 001_ocsentinel.sql as a database administrator.
3. Create a non-superuser n8n login and grant only the necessary permissions:

GRANT USAGE ON SCHEMA ocsentinel TO ocsentinel_n8n;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA ocsentinel TO ocsentinel_n8n;
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ocsentinel TO ocsentinel_n8n;
GRANT SELECT ON ocsentinel.current_device_status, ocsentinel.organization_summary TO ocsentinel_n8n;
ALTER DEFAULT PRIVILEGES IN SCHEMA ocsentinel
  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ocsentinel_n8n;

Keep the database host, password, and TLS settings only in n8n credentials. They do not belong in Gitea, NinjaOne scripts, or endpoint configuration.

Maintenance

Run monthly from n8n or an administrator session to remove expired replay tokens:

DELETE FROM ocsentinel.ingest_nonce WHERE expires_at < now();