From f9e14c0b2321db1a97f8e87bc2f14b11c952c9b6 Mon Sep 17 00:00:00 2001
From: VPS 4 Deploy Agent <deploy@clube67.com>
Date: Tue, 16 Jun 2026 12:46:37 +0200
Subject: [PATCH] feat(infra): banco DEV isolado (pg-dev) + bump
 scoreodonto.com/subdominio
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- pg-dev/: container PostGIS único multi-DB (ref+dev por template) p/ desgrudar dev da produção; scripts refresh/reset + manifesto (secrets fora do git)
- bump scoreodonto.com e subdominio.clube67.com (backends dev apontam p/ pgdev via .env)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 pg-dev/.gitignore           |  3 +++
 pg-dev/docker-compose.yml   | 23 ++++++++++++++++++++++
 pg-dev/pg-dev-projects.conf |  6 ++++++
 pg-dev/pg-dev-refresh.sh    | 38 +++++++++++++++++++++++++++++++++++++
 pg-dev/pg-dev-reset.sh      | 16 ++++++++++++++++
 scoreodonto.com             |  2 +-
 subdominio.clube67.com      |  2 +-
 7 files changed, 88 insertions(+), 2 deletions(-)
 create mode 100644 pg-dev/.gitignore
 create mode 100644 pg-dev/docker-compose.yml
 create mode 100644 pg-dev/pg-dev-projects.conf
 create mode 100755 pg-dev/pg-dev-refresh.sh
 create mode 100755 pg-dev/pg-dev-reset.sh

diff --git a/pg-dev/.gitignore b/pg-dev/.gitignore
new file mode 100644
index 0000000..eeb8bdd
--- /dev/null
+++ b/pg-dev/.gitignore
@@ -0,0 +1,3 @@
+secrets.env
+.env
+*.dump
diff --git a/pg-dev/docker-compose.yml b/pg-dev/docker-compose.yml
new file mode 100644
index 0000000..e88951f
--- /dev/null
+++ b/pg-dev/docker-compose.yml
@@ -0,0 +1,23 @@
+# Banco DEV isolado da VPS4 (rootless) — ver scoreodonto.com/documentação/BANCO-DEV-ESTRATEGIA.md
+# Subir:  set -a; source secrets.env; set +a; docker compose up -d
+services:
+  pgdev:
+    image: postgis/postgis:18-3.6
+    container_name: pgdev
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: devadmin
+      POSTGRES_PASSWORD: ${PGDEV_PASSWORD:?defina PGDEV_PASSWORD (source secrets.env)}
+      POSTGRES_DB: postgres
+    volumes:
+      - pgdev-data:/var/lib/postgresql   # PG18+: montar a raiz, não /data
+    networks:
+      - soc          # mesma rede dos backends de dev → acesso por DNS "pgdev"
+    # SEM "ports:" → não exposto ao host/internet (só acessível via rede soc)
+
+volumes:
+  pgdev-data:
+
+networks:
+  soc:
+    external: true
diff --git a/pg-dev/pg-dev-projects.conf b/pg-dev/pg-dev-projects.conf
new file mode 100644
index 0000000..62e710c
--- /dev/null
+++ b/pg-dev/pg-dev-projects.conf
@@ -0,0 +1,6 @@
+# Manifesto de projetos DEV — adicione 1 linha por projeto novo.
+# formato:  nome_projeto : banco_origem_na_VPS3 : usuario_origem
+# (a senha de origem vai em secrets.env como SRC_<nome_projeto>_PASS)
+scoreodonto : scoreodonto   : scoreodonto_user
+rx          : dental_images : clube67
+subdominio  : subdominio    : mercado_admin
diff --git a/pg-dev/pg-dev-refresh.sh b/pg-dev/pg-dev-refresh.sh
new file mode 100755
index 0000000..143b59d
--- /dev/null
+++ b/pg-dev/pg-dev-refresh.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Atualiza o banco-referência <projeto>_ref a partir da PRODUÇÃO (VPS3, somente leitura)
+# e recria <projeto>_dev a partir dele. Uso: ./pg-dev-refresh.sh <projeto>
+set -euo pipefail
+PROJ="${1:?uso: ./pg-dev-refresh.sh <projeto>  (ex.: scoreodonto)}"
+cd "$(dirname "$0")"
+set -a; source ./secrets.env; set +a
+export XDG_RUNTIME_DIR=/run/user/1000 DOCKER_HOST=unix:///run/user/1000/docker.sock
+VPS3=10.99.0.3; PGIMG=postgres:18
+
+line=$(grep -E "^[[:space:]]*${PROJ}[[:space:]]*:" pg-dev-projects.conf | head -1 || true)
+[ -z "$line" ] && { echo "ERRO: '$PROJ' não está em pg-dev-projects.conf"; exit 1; }
+SRC_DB=$(echo "$line"  | awk -F: '{gsub(/[[:space:]]/,"",$2);print $2}')
+SRC_USER=$(echo "$line"| awk -F: '{gsub(/[[:space:]]/,"",$3);print $3}')
+pvar="SRC_${PROJ}_PASS"; SRC_PASS="${!pvar:?sem senha SRC_${PROJ}_PASS em secrets.env}"
+REF="${PROJ}_ref"; DEV="${PROJ}_dev"; W=$(mktemp -d)
+trap 'rm -rf "$W"' EXIT
+
+PSQL(){ docker run --rm --network soc -e PGPASSWORD="$PGDEV_PASSWORD" "$PGIMG" \
+  psql -h pgdev -U devadmin -d postgres -v ON_ERROR_STOP=1 "$@"; }
+
+echo "[1/4] pg_dump de '$SRC_DB' (VPS3 $VPS3, somente leitura)..."
+docker run --rm -e PGPASSWORD="$SRC_PASS" -v "$W":/w "$PGIMG" \
+  pg_dump -h "$VPS3" -U "$SRC_USER" -d "$SRC_DB" -Fc -f /w/dump
+
+echo "[2/4] recriando $REF..."
+PSQL -c "DROP DATABASE IF EXISTS $DEV WITH (FORCE);"
+PSQL -c "DROP DATABASE IF EXISTS $REF WITH (FORCE);"
+PSQL -c "CREATE DATABASE $REF;"
+
+echo "[3/4] restaurando dump em $REF (avisos de owner/postgis são normais)..."
+docker run --rm --network soc -e PGPASSWORD="$PGDEV_PASSWORD" -v "$W":/w "$PGIMG" \
+  pg_restore -h pgdev -U devadmin -d "$REF" --no-owner --no-privileges /w/dump || true
+
+echo "[4/4] criando $DEV a partir do template $REF..."
+PSQL -c "CREATE DATABASE $DEV TEMPLATE $REF;"
+
+echo "OK: $DEV pronto (origem: $SRC_DB @ VPS3)."
diff --git a/pg-dev/pg-dev-reset.sh b/pg-dev/pg-dev-reset.sh
new file mode 100755
index 0000000..7d6e0f2
--- /dev/null
+++ b/pg-dev/pg-dev-reset.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Reset rápido (segundos): recria <projeto>_dev a partir do <projeto>_ref já existente,
+# SEM ir à VPS3. Uso: ./pg-dev-reset.sh <projeto>
+set -euo pipefail
+PROJ="${1:?uso: ./pg-dev-reset.sh <projeto>}"
+cd "$(dirname "$0")"
+set -a; source ./secrets.env; set +a
+export XDG_RUNTIME_DIR=/run/user/1000 DOCKER_HOST=unix:///run/user/1000/docker.sock
+REF="${PROJ}_ref"; DEV="${PROJ}_dev"
+PSQL(){ docker run --rm --network soc -e PGPASSWORD="$PGDEV_PASSWORD" postgres:18 \
+  psql -h pgdev -U devadmin -d postgres -v ON_ERROR_STOP=1 "$@"; }
+PSQL -tAc "SELECT 1 FROM pg_database WHERE datname='$REF';" | grep -q 1 \
+  || { echo "ERRO: $REF não existe — rode ./pg-dev-refresh.sh $PROJ primeiro"; exit 1; }
+PSQL -c "DROP DATABASE IF EXISTS $DEV WITH (FORCE);"
+PSQL -c "CREATE DATABASE $DEV TEMPLATE $REF;"
+echo "OK: $DEV resetado a partir de $REF."
diff --git a/scoreodonto.com b/scoreodonto.com
index efa9553..deaddfb 160000
--- a/scoreodonto.com
+++ b/scoreodonto.com
@@ -1 +1 @@
-Subproject commit efa9553536b96e0d01d479baf1b8a768b7751e6c
+Subproject commit deaddfbf6801ca01fc7c200546a616504332c2c7
diff --git a/subdominio.clube67.com b/subdominio.clube67.com
index 8a35da6..4c431f7 160000
--- a/subdominio.clube67.com
+++ b/subdominio.clube67.com
@@ -1 +1 @@
-Subproject commit 8a35da646a189e82950c00d3104b315909ae6642
+Subproject commit 4c431f742bcea4aa9a9f22c5ac922db307028061