From 455013db8ea9e54e55092b052a3f19316c8e17cc Mon Sep 17 00:00:00 2001
From: Draco-Lunaris-Echo <draco-lunaris-echo@moon-dragon.us>
Date: Sun, 7 Jun 2026 17:21:37 -0500
Subject: [PATCH] fix(docker): add PostgreSQL APT repo for postgresql-client-16

Debian Bookworm default repos only ship PostgreSQL 15. The Docker
runtime stage needs postgresql-client-16 for the entrypoint script,
so add the official PGDG APT repository.

- Add PGDG GPG key and sources.list entry for bookworm-pgdg
- Install ca-certificates and curl first (needed for repo setup)
- Purge gnupg2 after use to keep image lean
- Verify argon2 package name is correct for Bookworm (it is)
---
 Dockerfile | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index def159e..d3dc9f0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -60,13 +60,21 @@ RUN npm run build
 # ---------------------------------------------------------------------------
 FROM debian:bookworm-slim AS runtime
 
-RUN apt-get update && apt-get install -y \
-    ca-certificates \
-    libssl3 \
-    libfontconfig1 \
-    postgresql-client-16 \
-    argon2 \
-    curl \
+# Add PostgreSQL APT repository for postgresql-client-16
+# (Bookworm default repos only ship PostgreSQL 15)
+RUN apt-get update && apt-get install -y ca-certificates curl gnupg2 \
+    && curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
+       | gpg --dearmor -o /usr/share/keyrings/postgresql-keyring.gpg \
+    && echo "deb [signed-by=/usr/share/keyrings/postgresql-keyring.gpg] https://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" \
+       > /etc/apt/sources.list.d/pgdg.list \
+    && apt-get update \
+    && apt-get install -y \
+       libssl3 \
+       libfontconfig1 \
+       postgresql-client-16 \
+       argon2 \
+    && apt-get purge -y gnupg2 \
+    && apt-get autoremove -y \
     && rm -rf /var/lib/apt/lists/*
 
 # Create service user