## Summary
- Remove the checker NixOS module, including its systemd service, system user/group, SOPS secret declaration, and nginx virtual host.
- Remove the checker flake input and its now-unreachable lock-file dependency graph.
## Validation
- `tobserver-agent check` — passed all formatting, whitespace, no-build flake, strict NixOS assertion/systemd unit, secret-policy, and Gitleaks checks.
- Focused Nix evaluation confirmed the checker service, user, nginx virtual host, and SOPS secret declaration are absent; `flake.lock` no longer contains the checker input.
## Risks and limitations
- Deployment will stop exposing the checker service and nginx virtual host, but existing runtime state, a mutable system user, DNS records, ACME data, and the encrypted checker secret may remain until a human removes them if desired.
## Manual follow-up
- Review and merge this pull request in Codeberg.
- Deploy manually on Tobserver after merge.
- After deployment, verify the checker unit and virtual host are absent; optionally clean up checker DNS, runtime state, user, ACME data, and the encrypted secret through the appropriate human-managed process.
Reviewed-on: https://codeberg.org/oibot/Tobserver/pulls/9
## Summary
- Provision a digest-pinned PostgreSQL 18 container through rootless Podman with health-gated systemd readiness, loopback-only publishing, graceful shutdown, and the persistent `bitcoin-pulse-db` volume.
- Declare separate SOPS credential paths for the administrator, migration, and application roles, stage them privately for first-start initialization, and reuse the role bootstrap SQL from the pinned BitcoinPulseAPI input.
- Document human-managed secret provisioning, least-privilege verification, container recreation, graceful shutdown, and coordinated credential rotation.
## Validation
- `tobserver-agent check` passed:
- `nixpkgs-fmt --check`
- `git diff --check`
- `nix flake check --no-build`
- Tobserver system derivation path evaluation
- Gitleaks patch scan
- Evaluated the OCI container, systemd service, rootless user, and NixOS assertions; all assertions pass and the generated configuration contains the expected loopback port, health readiness, persistent volume, and shutdown settings.
## Risks and limitations
- Runtime startup, shutdown, persistence, and role behavior require Linux deployment verification and were not executed on macOS.
- The encrypted SOPS keys are intentionally absent from this agent-authored change; the service must not be deployed before a human provisions them.
- Static uid/gid 400 is reserved for the dedicated rootless container account and should be checked for conflicts during review.
## Manual follow-up
- Add `bitcoin-pulse/postgres/admin-password`, `bitcoin-pulse/postgres/migration-password`, and `bitcoin-pulse/postgres/app-password` to `secrets/tobserver.yaml` using `sops`; commit only encrypted values.
- Review and merge this pull request.
- Deploy manually on Tobserver after merge and encrypted secret provisioning.
- Run the startup, loopback binding, role privilege, restart/persistence, and graceful-shutdown checks in `docs/bitcoin-pulse-postgresql.md`.
Reviewed-on: https://codeberg.org/oibot/Tobserver/pulls/5
