Password file lives in a 700 dir and userlist is 640 postgres, so
non-root status false-DRifted right after a clean apply. Check them
only as root; non-root status still verifies db/ini/tls/listener.
- role ocrt_dev (LOGIN, random password in /var/lib/sysmig/secrets,
not superuser - DB ownership suffices for schema migrations)
- database ocrt_dev owner ocrt_dev
- pgbouncer: listen 0.0.0.0, self-signed CA+cert (SAN=hostname/IPs),
client_tls_sslmode=require, userlist synced from pg_authid (SCRAM
pass-through; pg_hba unchanged)
- two pool aliases: ocrt_dev (transaction) and ocrt_dev_migrate
(session, for advisory-lock-based migration tools)
- 013 status: listen_addr expectation flips once 015 is applied
- GCP firewall tcp:6432 remains a manual step (gcloud cmd in header)
wan