Database Setup
Liquibase changelogs live in docs/db/changelog (master, module and version files) and are run with the Liquibase CLI outside of the application. The build copies them to the test classpath only, where tests apply them to an in-memory database.
Running Migrations
liquibase --changelog-file=./docs/db/changelog/db.changelog-master.xml --url=jdbc:postgresql://localhost:5432/secure_keystore --username=secure_keystore status
liquibase --changelog-file=./docs/db/changelog/db.changelog-master.xml --url=jdbc:postgresql://localhost:5432/secure_keystore --username=secure_keystore update
liquibase --changelog-file=./docs/db/changelog/db.changelog-master.xml --url=offline:postgresql --output-file=./docs/db/generated-postgresql-script.sql updateSQL
Pass the password with --password or LIQUIBASE_COMMAND_PASSWORD; never commit it. To run the migrations in a container, see Docker Deployment.
Changeset Rules
Changesets are append-only:
- one file per change, named
<yyyymmdd>-<topic>.xml, included in order fromchangesets/secure-keystore/1.0.x/db.changelog-version.xml - the
changeSetid is an integer starting from 1 per file logicalFilePath="secure-keystore/1.0.x/<fileName>"- each changeset has a
<comment> - the last changeset of a version carries
<tagDatabase tag="secure-keystore/1.0.x"/>
Never edit an applied changeset.
Database Roles
In this version, migrations and the running service use the same database role, a deliberate trade-off for the proof of concept. The service does not authenticate callers yet, so run it only on an isolated network.
Production recommendation: run migrations with a separate schema-owner role and run the service with a restricted, non-owner role (only the data privileges it needs, no DDL). The migration image applies the changelog with the owner’s credentials.