From a22c63808c61b8eea53819bc30f99de62c6f09c8 Mon Sep 17 00:00:00 2001
From: b0txec <b0tgit@mailum.com>
Date: Thu, 20 Aug 2026 19:33:36 +0300
Subject: [PATCH] Correct production runtime contract

---
 deploy/vps/README.md     |  5 ++++-
 deploy/vps/compose.yml   | 10 +++++-----
 docs/VPS_STAGING_PLAN.md |  2 ++
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/deploy/vps/README.md b/deploy/vps/README.md
index 3d8a7bc..7c597f4 100644
--- a/deploy/vps/README.md
+++ b/deploy/vps/README.md
@@ -26,7 +26,6 @@ paths before the first start:
   compose.yml
   config/authelia/configuration.yml
   config/authelia/users_database.yml
-  data/app/
   data/authelia/
   data/postgres/
   secrets/jwt_secret
@@ -38,6 +37,10 @@ The Nginx files remain examples until the domain, Cloudflare origin certificate,
 trusted client-address configuration, and private upstream tests are complete.
 Do not enable the virtual host merely because the containers start successfully.
 
+WeatherTool application scratch files are intentionally ephemeral in a
+non-executable in-memory `/app/data` filesystem. PostgreSQL is the durable
+application data store; Authelia and PostgreSQL state use dedicated bind paths.
+
 ## Release image
 
 Build the exact committed revision on Rocky:
diff --git a/deploy/vps/compose.yml b/deploy/vps/compose.yml
index a3f10a8..a89d987 100644
--- a/deploy/vps/compose.yml
+++ b/deploy/vps/compose.yml
@@ -27,18 +27,18 @@ services:
       postgres:
         condition: service_healthy
     environment:
-      DB_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB}
-      DB_USER: ${POSTGRES_USER}
-      DB_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_HOST: postgres
       ENABLE_SCHEDULED_JOBS: "false"
       DEBUG: "false"
     ports:
       - "127.0.0.1:${WEATHERTOOL_PORT:-8002}:8080"
-    volumes:
-      - ./data/app:/app/data
     read_only: true
     tmpfs:
       - /tmp:size=64m,mode=1777
+      - /app/data:size=256m,mode=0770,uid=100,gid=101
     networks:
       - backend
     security_opt:
diff --git a/docs/VPS_STAGING_PLAN.md b/docs/VPS_STAGING_PLAN.md
index 8a97c0c..962fea6 100644
--- a/docs/VPS_STAGING_PLAN.md
+++ b/docs/VPS_STAGING_PLAN.md
@@ -90,6 +90,8 @@ WeatherTool will use:
 - a private application network;
 - its own PostgreSQL service and persistent storage;
 - its own Authelia configuration and storage;
+- an ephemeral writable application scratch filesystem while the remaining
+  application container filesystem stays read-only;
 - a loopback-only application binding, with the final port chosen after the
   VPS inventory; and
 - no shared Docker volumes, database, or application network with HOP or any