pridanie pgAdmin

.env.example

@@ -12,6 +12,11 @@ CORS_ALLOWED_ORIGINS=https://bridzik.liptim.eu
 # Shared secret for the self-hosted /api/admin/* stats endpoints.
 ADMIN_TOKEN=tajneheslo
 
+# pgAdmin login (UI bound to 127.0.0.1:8081 on the host -- access via SSH tunnel,
+# never expose publicly since it has full access to the Postgres data).
+PGADMIN_DEFAULT_EMAIL=admin@example.com
+PGADMIN_DEFAULT_PASSWORD=zmen_ma
+
 # Fernet key encrypting Player.totp_secret at rest. Generate with:
 #   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
 # Keep it stable across restarts/redeploys -- losing it locks every account

docker-compose.prod.yaml

@@ -15,6 +15,21 @@ services:
     volumes:
       - pgdata:/var/lib/postgresql
     restart: always
+    networks:
+      caddy_network:
+
+  pgadmin:
+    image: dpage/pgadmin4:latest
+    environment:
+      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
+      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD}
+    volumes:
+      - pgadmin_data:/var/lib/pgadmin
+    restart: always
+    depends_on:
+      - db
+    networks:
+      caddy_network:
 
   backend:
     build: .
@@ -29,14 +44,24 @@ services:
     restart: always
     depends_on:
       - db
+    networks:
+      caddy_network:
 
   frontend:
+    container_name: bridzik
     build: ./frontend
     environment:
       BACKEND_UPSTREAM: backend:5000
     restart: always
     depends_on:
       - backend
+    networks:
+      caddy_network:
 
 volumes:
   pgdata:
+  pgadmin_data:
+
+networks:
+  caddy_network:
+    external: true