Database Configuration

​

Supported engines and versions

​

Schema requirements

• CONNECT on the database
• USAGE and CREATE on the public schema
• The user is expected to be the owner of the database. Flyway requires DDL to create the migration history table on first startup.

​

Provisioning steps

-- 1. Create the application role with login
CREATE ROLE tower WITH LOGIN PASSWORD '<choose-a-strong-password>';

-- 2. Create the database owned by the application role
CREATE DATABASE decision_tower_db OWNER tower;

-- 3. Grant connect privilege explicitly (idempotent — owner already has it)
GRANT ALL PRIVILEGES ON DATABASE decision_tower_db TO tower;

jdbc:postgresql://<host>:<port>/<database-name>

​

Migration and upgrade considerations

​

Flyway history table

​

Migration files shipped with the application

​

Upgrade procedure

1. Back up the database before any upgrade. Tower migrations are forward-only; rollback in production requires restoring from backup.
2. Stop the running Tower instance, or scale the Deployment to zero replicas (Kubernetes).
3. Verify there are no long-running transactions against decision_tower_db from external tools.
4. Start the new image. Tower applies pending migrations on startup; the application logs each migration as it runs and records it in flyway_schema_history.
5. Confirm the application reaches the Started AletyxTowerCoreApplication log line and that /actuator/health returns 200 OK before allowing traffic.

​

Skipping migrations / repairing state

• A migration was edited in place after being applied (checksum mismatch). The fix is to revert the migration to its applied form, or run flyway repair against the database.
• A migration file was renamed or deleted between releases. Coordinate with Aletyx support before applying — this almost always indicates an unintended downgrade.

​

Connection pooling

spring.datasource.hikari.maximum-pool-size=10
spring.datasource.hikari.minimum-idle=2
spring.datasource.hikari.connection-timeout=30000

​

Operational access patterns

• Read-only access for diagnostic tools or BI dashboards. Create a dedicated role and grant minimal privileges:
  CREATE ROLE tower_reader WITH LOGIN PASSWORD '<password>';
  GRANT CONNECT ON DATABASE decision_tower_db TO tower_reader;
  \c decision_tower_db
  GRANT USAGE ON SCHEMA public TO tower_reader;
  ALTER DEFAULT PRIVILEGES FOR ROLE tower IN SCHEMA public
    GRANT SELECT ON TABLES TO tower_reader;
  ALTER DEFAULT PRIVILEGES FOR ROLE tower IN SCHEMA public
    GRANT USAGE, SELECT ON SEQUENCES TO tower_reader;
  
  The ALTER DEFAULT PRIVILEGES FOR ROLE tower ensures that tables created by future Flyway migrations are visible to tower_reader automatically. Without it, each new migration would require a manual GRANT.
• Backups via pg_dump. Tower’s data is fully relational (no large objects, no binary columns), so a logical dump is safe and round-trips cleanly:
  pg_dump --format=custom --file=tower.dump decision_tower_db
  pg_restore --create --dbname=postgres tower.dump   # restore on the target
  
  Frequency depends on your retention policy; at minimum, a daily snapshot is recommended for any environment that holds production approval workflows.

​

Network connectivity

jdbc:postgresql://<host>:5432/decision_tower_db?ssl=true&sslmode=require

​

Configuration variables

​

Example: docker-compose for a self-hosted PostgreSQL alongside Tower

services:
  tower-database:
    image: postgres:18
    environment:
      POSTGRES_DB: decision_tower_db
      POSTGRES_USER: tower
      POSTGRES_PASSWORD: <strong-password>
    volumes:
      - tower-db-data:/var/lib/postgresql/data
    ports:
      - "5434:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U tower -d decision_tower_db"]
      interval: 10s
      timeout: 5s
      retries: 5

  decision-control-tower:
    image: <your-registry>/aletyx/decision-control-tower:latest
    depends_on:
      tower-database:
        condition: service_healthy
    environment:
      ALETYX_DC_TOWER_DB_URL: jdbc:postgresql://tower-database:5432/decision_tower_db
      ALETYX_DC_TOWER_DB_USERNAME: tower
      ALETYX_DC_TOWER_DB_PASSWORD: <strong-password>
      # plus OIDC variables, see chapter 1
    ports:
      - "8080:8080"

volumes:
  tower-db-data: