cf50d8577e
Root cause of recent "invalid credentials on correct password" was
a silent btree index corruption: pgvector/pgvector:pg16 was pulled
with a different ICU library than the one used to build existing
indexes. Queries returned 0 rows even though matching heap rows
existed. Postgres logged nothing (corrupt index → empty result set
is a "successful" query) and the login path never logged unknown-
user attempts (enumeration protection).
Three defenses:
1. Pin postgres image by digest in docker-compose.yml so a
silent pull can't change ICU under our feet.
2. Startup collation-drift check in src/db/database.js:
compares pg_database.datcollversion to the library's actual
version and, on mismatch, runs REINDEX DATABASE + ALTER
DATABASE REFRESH COLLATION VERSION. Logs "Collation versions:
aligned" on clean boot.
3. Server-side console.warn on login lookup-miss (no email, no
audit row — preserves enumeration protection but gives
Grafana/Loki a signal for unusual miss rates).
44 lines
1.2 KiB
YAML
44 lines
1.2 KiB
YAML
services:
|
|
pediatric-scribe:
|
|
build: .
|
|
image: ped-ai-local:latest
|
|
ports:
|
|
- "127.0.0.1:3552:3000"
|
|
env_file:
|
|
- .env
|
|
volumes:
|
|
- scribe-logs:/app/data/logs
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
container_name: pediatric-ai-scribe
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000/api/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 20s
|
|
|
|
postgres:
|
|
# Pinned by digest — changing the pgvector image can change the bundled
|
|
# ICU library and corrupt existing text indexes. REINDEX after any bump.
|
|
image: pgvector/pgvector:pg16@sha256:7d400e340efb42f4d8c9c12c6427adb253f726881a9985d2a471bf0eed824dff
|
|
environment:
|
|
POSTGRES_DB: pedscribe
|
|
POSTGRES_USER: pedscribe
|
|
POSTGRES_PASSWORD: ${DB_PASSWORD:-zy9LK958SAcfUM7SJTkdthSYyYy6}
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
restart: unless-stopped
|
|
container_name: pedscribe-db
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U pedscribe"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 10s
|
|
|
|
volumes:
|
|
pgdata:
|
|
scribe-logs:
|