Release prep: 54 engines, self-hosted signatures, i18n, dashboard updates

internal/infrastructure/postgres/pg.go

@@ -0,0 +1,91 @@
+// Package postgres provides PostgreSQL persistence for the SENTINEL SOC.
+//
+// Uses pgx/v5 driver (pure Go, no CGO) with connection pooling.
+// Migrations managed by goose.
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"embed"
+	"fmt"
+	"log/slog"
+	"time"
+
+	_ "github.com/jackc/pgx/v5/stdlib" // pgx driver registered as "pgx"
+	"github.com/pressly/goose/v3"
+)
+
+//go:embed migrations/*.sql
+var migrations embed.FS
+
+// DB wraps a PostgreSQL connection pool.
+type DB struct {
+	pool   *sql.DB
+	logger *slog.Logger
+}
+
+// Open connects to PostgreSQL and runs any pending goose migrations.
+//
+//	dsn example: "postgres://sentinel:pass@localhost:5432/sentinel_soc?sslmode=disable"
+func Open(dsn string, logger *slog.Logger) (*DB, error) {
+	pool, err := sql.Open("pgx", dsn)
+	if err != nil {
+		return nil, fmt.Errorf("postgres: open: %w", err)
+	}
+
+	// Connection pool tuning for SOC workload.
+	pool.SetMaxOpenConns(25)
+	pool.SetMaxIdleConns(10)
+	pool.SetConnMaxLifetime(5 * time.Minute)
+	pool.SetConnMaxIdleTime(1 * time.Minute)
+
+	// Verify connectivity.
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if err := pool.PingContext(ctx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("postgres: ping: %w", err)
+	}
+
+	db := &DB{pool: pool, logger: logger}
+
+	// Run pending goose migrations.
+	if err := db.migrate(); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("postgres: migrate: %w", err)
+	}
+
+	logger.Info("PostgreSQL connected", "dsn_host", redactDSN(dsn))
+	return db, nil
+}
+
+// Close releases the connection pool.
+func (db *DB) Close() error {
+	return db.pool.Close()
+}
+
+// Pool returns the underlying *sql.DB for direct queries.
+func (db *DB) Pool() *sql.DB {
+	return db.pool
+}
+
+func (db *DB) migrate() error {
+	goose.SetBaseFS(migrations)
+	if err := goose.SetDialect("postgres"); err != nil {
+		return fmt.Errorf("goose dialect: %w", err)
+	}
+	if err := goose.Up(db.pool, "migrations"); err != nil {
+		return fmt.Errorf("goose up: %w", err)
+	}
+	db.logger.Info("goose migrations applied")
+	return nil
+}
+
+// redactDSN extracts host:port for logging without exposing credentials.
+func redactDSN(dsn string) string {
+	if len(dsn) > 60 {
+		return dsn[:20] + "…" + dsn[len(dsn)-15:]
+	}
+	return "***"
+}