From d43206da7081bb7365991c0f480a9e428182dd95 Mon Sep 17 00:00:00 2001
From: primal <primal@primal.host>
Date: Sun, 1 Feb 2026 14:46:15 -0500
Subject: [PATCH] Initial commit: pgAdmin web interface (clean)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 .gitignore         | 12 ++++++++++++
 .launch.sh         |  3 +++
 docker-compose.yml | 47 ++++++++++++++++++++++++++++++++++++++++++++++
 servers.json       | 14 ++++++++++++++
 4 files changed, 76 insertions(+)
 create mode 100644 .gitignore
 create mode 100755 .launch.sh
 create mode 100644 docker-compose.yml
 create mode 100644 servers.json

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..1b17d31
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,12 @@
+# Secrets
+*.env
+secrets/
+*.pem
+*.key
+pgadmin_password.txt
+
+# Data volumes
+data/
+
+# Logs
+*.log
diff --git a/.launch.sh b/.launch.sh
new file mode 100755
index 0000000..1124257
--- /dev/null
+++ b/.launch.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+cd "$(dirname "$0")"
+~/apps/.launch.sh "$@"
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..63845bb
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,47 @@
+services:
+  pgadmin:
+    image: dpage/pgadmin4:latest
+    container_name: infra-pgadmin
+    restart: unless-stopped
+    environment:
+      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL:-admin@primal.host}
+      PGADMIN_DEFAULT_PASSWORD_FILE: /run/secrets/pgadmin_password
+      PGADMIN_CONFIG_PROXY_X_FOR_COUNT: 1
+      PGADMIN_CONFIG_PROXY_X_PROTO_COUNT: 1
+    secrets:
+      - pgadmin_password
+    volumes:
+      - pgadmin_data:/var/lib/pgadmin
+      - ./servers.json:/pgadmin4/servers.json:ro
+    networks:
+      - proxy
+      - atproto
+    labels:
+      - "traefik.enable=true"
+      # Production route: pgadmin.primal.host
+      - "traefik.http.routers.pgadmin.rule=Host(`pgadmin.primal.host`)"
+      - "traefik.http.routers.pgadmin.entrypoints=https"
+      - "traefik.http.routers.pgadmin.tls.certresolver=letsencrypt"
+      - "traefik.http.routers.pgadmin.service=pgadmin"
+      - "traefik.http.services.pgadmin.loadbalancer.server.port=80"
+      # HTTP to HTTPS redirect
+      - "traefik.http.routers.pgadmin-redirect.rule=Host(`pgadmin.primal.host`)"
+      - "traefik.http.routers.pgadmin-redirect.entrypoints=http"
+      - "traefik.http.routers.pgadmin-redirect.middlewares=https-redirect"
+      # Local development route
+      - "traefik.http.routers.pgadmin-local.rule=Host(`pgadmin.primal.localhost`)"
+      - "traefik.http.routers.pgadmin-local.entrypoints=http"
+      - "traefik.http.routers.pgadmin-local.service=pgadmin"
+
+secrets:
+  pgadmin_password:
+    file: ./pgadmin_password.txt
+
+volumes:
+  pgadmin_data:
+
+networks:
+  proxy:
+    external: true
+  atproto:
+    external: true
diff --git a/servers.json b/servers.json
new file mode 100644
index 0000000..7ac7c47
--- /dev/null
+++ b/servers.json
@@ -0,0 +1,14 @@
+{
+  "Servers": {
+    "1": {
+      "Name": "postgres.primal.host",
+      "Group": "Servers",
+      "Host": "infra-postgres",
+      "Port": 5432,
+      "MaintenanceDB": "news_1440",
+      "Username": "news_1440",
+      "SSLMode": "prefer",
+      "PassFile": "/pgadmin4/pgpass"
+    }
+  }
+}