Bundle database init scripts in postgres image

Author: zijian-z

.env.example

@@ -10,7 +10,6 @@ BASIC_AUTH_PASSWORD=change-this-password
 
 # TeslaMate collector stack. Generate strong values before production use:
 #   openssl rand -base64 48
-POSTGRES_TAG=18-trixie
 MOSQUITTO_TAG=2
 TESLAMATE_TAG=latest
 TM_ENCRYPTION_KEY=replace-with-a-long-random-encryption-key

.github/workflows/publish.yml

@@ -21,8 +21,13 @@ jobs:
         include:
           - image: tesla-dashboard-api
             context: ./backend
+            file: ./backend/Dockerfile
           - image: tesla-dashboard-web
             context: ./frontend
+            file: ./frontend/Dockerfile
+          - image: tesla-dashboard-postgres
+            context: ./deploy
+            file: ./deploy/Dockerfile.postgres
 
     steps:
       - name: Checkout
@@ -60,6 +65,7 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: ${{ matrix.context }}
+          file: ${{ matrix.file }}
           push: true
           platforms: linux/amd64
           tags: ${{ steps.tags.outputs.tags }}

README.md

@@ -16,7 +16,7 @@ Nginx / Frontend  -- 内网 HTTP -->  FastAPI Backend  -- Docker 内网 -->  Pos
 TeslaMate Collector  -- 内网 --> PostgreSQL + MQTT
 ```
 
-默认生产部署只发布 `web` 的 `WEB_PORT`。`api` 只在 Docker 内网暴露 `8000`，TeslaMate 只在 Docker 内网暴露 `4000`，PostgreSQL 和 MQTT 也都只在内网可见。`db-init` 服务会自动创建只读数据库账号，不需要手工执行 SQL。
+默认生产部署只发布 `web` 的 `WEB_PORT`。`api` 只在 Docker 内网暴露 `8000`，TeslaMate 只在 Docker 内网暴露 `4000`，PostgreSQL 和 MQTT 也都只在内网可见。`database` 镜像内置首次启动恢复备份脚本，`db-init` 服务会自动创建只读数据库账号，不需要手工执行 SQL，也不需要在部署目录额外复制脚本文件。
 
 ## 功能
 
@@ -92,7 +92,6 @@ WEB_PORT=8080
 BASIC_AUTH_USER=admin
 BASIC_AUTH_PASSWORD=change-this-password
 
-POSTGRES_TAG=18-trixie
 MOSQUITTO_TAG=2
 TESLAMATE_TAG=latest
 TM_ENCRYPTION_KEY=replace-with-a-long-random-encryption-key
@@ -115,6 +114,14 @@ openssl rand -base64 48
 
 大陆机器部署前，先在 GitHub Actions 手工运行一次 `Build and Push Images`，把本项目镜像和运行依赖镜像都推送到阿里云镜像仓库。生产 `compose.yaml` 默认会从 `${IMAGE_REGISTRY}/${IMAGE_NAMESPACE}` 拉取所有镜像，不再直接依赖 Docker Hub。
 
+生产部署目录最少只需要这些文件：
+
+- `compose.yaml`
+- `.env`
+- 可选的 TeslaMate 数据库备份文件，例如 `teslamate.bck`
+
+恢复备份和创建只读账号的脚本已经打进 `tesla-dashboard-postgres` 镜像，不需要额外复制 `deploy/` 目录。
+
 ### 2. 启动
 
 先确认部署机有 Docker Compose v2：
@@ -159,6 +166,18 @@ http://部署机IP:8080
 
 如果备份里包含旧的 TeslaMate token，并且 `TM_ENCRYPTION_KEY` 也保持一致，那么恢复后通常可以直接继续使用，不需要重新额外配置授权 token。
 
+完整重建并重新导入备份：
+
+```bash
+sudo docker compose down -v --remove-orphans
+sudo docker compose pull
+sudo docker compose up -d database
+sudo docker compose logs -f database
+sudo docker compose up -d
+```
+
+`down -v` 会删除 PostgreSQL 持久化 volume。只有在确认同级目录里的备份文件可用时才执行这条命令。
+
 ## GitHub Actions 推送到阿里云镜像仓库
 
 工作流在 [.github/workflows/publish.yml](.github/workflows/publish.yml)。在 GitHub 仓库的 `Settings -> Secrets and variables -> Actions` 添加：
@@ -175,6 +194,7 @@ http://部署机IP:8080
 ```text
 registry.cn-shenzhen.aliyuncs.com/your-namespace/tesla-dashboard-api:<image_tag>
 registry.cn-shenzhen.aliyuncs.com/your-namespace/tesla-dashboard-web:<image_tag>
+registry.cn-shenzhen.aliyuncs.com/your-namespace/tesla-dashboard-postgres:<image_tag>
 registry.cn-shenzhen.aliyuncs.com/your-namespace/postgres:18-trixie
 registry.cn-shenzhen.aliyuncs.com/your-namespace/eclipse-mosquitto:2
 registry.cn-shenzhen.aliyuncs.com/your-namespace/teslamate:latest

compose.yaml

@@ -2,15 +2,14 @@ name: tesla-dashboard
 
 services:
   database:
-    image: ${IMAGE_REGISTRY}/${IMAGE_NAMESPACE}/postgres:${POSTGRES_TAG:-18-trixie}
+    image: ${IMAGE_REGISTRY}/${IMAGE_NAMESPACE}/tesla-dashboard-postgres:${IMAGE_TAG:-latest}
     restart: unless-stopped
     environment:
       POSTGRES_USER: ${TM_DB_USER:-teslamate}
       POSTGRES_PASSWORD: ${TM_DB_PASS}
       POSTGRES_DB: ${TM_DB_NAME:-teslamate}
     volumes:
       - teslamate-db:/var/lib/postgresql
-      - ./deploy/restore-backup-if-present.sh:/docker-entrypoint-initdb.d/20-restore-backup-if-present.sh:ro
       - ./:/backup-source:ro
     networks:
       - data
@@ -62,7 +61,7 @@ services:
       - all
 
   db-init:
-    image: ${IMAGE_REGISTRY}/${IMAGE_NAMESPACE}/postgres:${POSTGRES_TAG:-18-trixie}
+    image: ${IMAGE_REGISTRY}/${IMAGE_NAMESPACE}/tesla-dashboard-postgres:${IMAGE_TAG:-latest}
     restart: "no"
     depends_on:
       database:
@@ -74,9 +73,7 @@ services:
       POSTGRES_DB: ${TM_DB_NAME:-teslamate}
       DASHBOARD_DB_USER: ${DASHBOARD_DB_USER:-dashboard_readonly}
       DASHBOARD_DB_PASSWORD: ${DASHBOARD_DB_PASSWORD}
-    volumes:
-      - ./deploy/create-dashboard-role.sh:/scripts/create-dashboard-role.sh:ro
-    command: ["sh", "/scripts/create-dashboard-role.sh"]
+    command: ["sh", "/usr/local/share/tesla-dashboard/create-dashboard-role.sh"]
     networks:
       - data
     security_opt:

deploy/Dockerfile.postgres

@@ -0,0 +1,8 @@
+ARG POSTGRES_IMAGE=postgres:18-trixie
+FROM ${POSTGRES_IMAGE}
+
+COPY restore-backup-if-present.sh /docker-entrypoint-initdb.d/20-restore-backup-if-present.sh
+COPY create-dashboard-role.sh /usr/local/share/tesla-dashboard/create-dashboard-role.sh
+
+RUN chmod 0755 /docker-entrypoint-initdb.d/20-restore-backup-if-present.sh \
+  /usr/local/share/tesla-dashboard/create-dashboard-role.sh

deploy/create-dashboard-role.sh

@@ -10,10 +10,12 @@ set -eu
 
 export PGPASSWORD="$POSTGRES_PASSWORD"
 
+echo "Waiting for PostgreSQL at $POSTGRES_HOST..."
 until pg_isready -h "$POSTGRES_HOST" -U "$POSTGRES_USER" -d "$POSTGRES_DB" >/dev/null 2>&1; do
   sleep 1
 done
 
+echo "Creating or updating read-only dashboard role: $DASHBOARD_DB_USER"
 psql \
   -h "$POSTGRES_HOST" \
   -U "$POSTGRES_USER" \
@@ -52,3 +54,5 @@ begin
 end
 $$;
 SQL
+
+echo "Read-only dashboard role is ready: $DASHBOARD_DB_USER"

deploy/restore-backup-if-present.sh

@@ -46,20 +46,33 @@ fi
 
 echo "Restoring TeslaMate database backup: $backup_file"
 
+restore_dump_or_sql() {
+  candidate="$1"
+
+  if pg_restore --list "$candidate" >/dev/null 2>&1; then
+    pg_restore --verbose --no-owner --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" "$candidate"
+  else
+    psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < "$candidate"
+  fi
+}
+
 case "$backup_file" in
   *.sql|*.bck)
-    psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < "$backup_file"
+    restore_dump_or_sql "$backup_file"
     ;;
   *.sql.gz|*.bck.gz)
-    gzip -dc "$backup_file" | psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB"
+    tmp_file="/tmp/teslamate-restore"
+    gzip -dc "$backup_file" > "$tmp_file"
+    restore_dump_or_sql "$tmp_file"
+    rm -f "$tmp_file"
     ;;
   *.dump|*.backup)
-    pg_restore --verbose --no-owner --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" "$backup_file"
+    restore_dump_or_sql "$backup_file"
     ;;
   *.dump.gz|*.backup.gz)
     tmp_file="/tmp/teslamate-restore.dump"
     gzip -dc "$backup_file" > "$tmp_file"
-    pg_restore --verbose --no-owner --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" "$tmp_file"
+    restore_dump_or_sql "$tmp_file"
     rm -f "$tmp_file"
     ;;
   *)