zawa-pg-tls

zawa custom Postgres image (ghcr.io/jigsawye/zawa-pg).

Template is a direct fork of Zeabur marketplace template 773OAW (PostgreSQL with pgvector). Service definition (id, ports, volume, instructions, env order, configs file) is copied verbatim so the Zeabur dashboard treats this as a first-class Postgres service — Database tab, auto backup, exposed POSTGRES_* variables all work.

Differences from 773OAW:

• Image: ghcr.io/jigsawye/zawa-pg:latest — PG 18 + pgvector + self-signed TLS auto-generated on first boot, regenerated 30 days before expiry.
• Two extra env vars: SSL_SAN (SAN list baked into the cert) and LOG_TO_STDOUT (unify stderr into Zeabur log stream).

Connection

• Inter-service: reference ${POSTGRES_CONNECTION_STRING}. Self-signed TLS is enabled but not required by the server, so internal traffic over the Zeabur private network works without sslmode.
• External (Vercel, local psql): use the instruction-provided URL and append ?sslmode=require for encrypted transport. verify-full requires distributing the root CA — see the zawa-pg LE upgrade path for the Let's Encrypt swap when needed.

Restoring a backup

Same flow as 773OAW: download + extract the backup data.sql, then run <PostgreSQL Connect Command> < data.sql. Restoring will replace the existing user password — strip CREATE ROLE / ALTER ROLE from the dump beforehand if you want to keep the current password.