fix(compose): harden optional pg-llm-batch database

[seonghobae]

Scope

Harden the optional offline pg-llm-batch Compose overlay:

• require externally supplied database credentials;
• bind the development port to loopback;
• authenticate the SQL healthcheck with the configured password;
• apply no-new-privileges, read-only root, and explicit PostgreSQL runtime tmpfs mounts.

Verification

• PYTHONPATH=. python3 -m pytest -q backend/tests/test_repo_hygiene.py
• ruff check backend/tests/test_repo_hygiene.py
• YAML parse
• Podman Compose config with non-secret test credentials

The overlay remains opt-in and is not part of the default stack.

---

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 10 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5235b9d7-23cc-470c-b5fa-d1be423662d5

📥 Commits

Reviewing files that changed from the base of the PR and between 81c1056 and e3dbed9.

📒 Files selected for processing (2)

• backend/tests/test_repo_hygiene.py
• docker-compose.pg-llm-batch.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[seonghobae]

Current-head review completed for 90a8768c.

The optional pg-llm-batch overlay now requires externally supplied credentials, binds the host port to loopback, uses read-only/no-new-privileges hardening with explicit writable tmpfs paths, and authenticates the healthcheck with the configured values. No hardcoded database credential remains.

Verification: python -m pytest backend/tests/test_repo_hygiene.py -q → 20 passed; Ruff and git diff --check passed.

[github-actions]

PR governance metadata gate update for e3dbed9a0d4e08348f94d26de09a2fabbdcfa96b: no current blocking failures remain.

PR governance metadata gate is ready; all current-head requirements passed.

[seonghobae]

The failed Strix run for current head 90a8768cd206c5b97ba0a1110c38faa9ec33a9ed emitted only the configured MODEL QUALITY WARNING policy signal and no MEDIUM+ vulnerability. The fail-closed quality-warning handling is fixed in ContextualWisdomLab/.github#1177; this PR remains source-clean and is being revalidated after that central gate change.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}