PocketBase as a standalone database server

The pocketbase driver no longer embeds PocketBase: Warp keeps its data as
PocketBase collections on a server of its own and reaches it only through
the REST API, the way the postgres driver reaches PostgreSQL.
database.connection_string is the server's URL, and Warp signs in as the
superuser in WARP_PB_SUPERUSER_EMAIL / WARP_PB_SUPERUSER_PASSWORD (or a
WARP_PB_SUPERUSER_FILE of the two).

Every SQL table is a superuser-only collection of the same name and
columns, created by warp migrate. Reads go through PocketBase's SQL
endpoint with the SQL drivers' queries, via a read-only database/sql
driver that inlines arguments, moves long ones into warp_params and pages
past 1000 rows. Writes are record operations in batch requests under one
write lock in the Warp process. Media is a protected file field in
warp_media, local or in the S3 bucket Warp writes into PocketBase's
settings. Search matches word prefixes with LIKE. The storage tests run
against an in-process PocketBase and pass as on SQLite.

Docker: the PocketBase stacks get a pocketbase service running
tajniak81/pocketbase-docker-root (WARP_PB_IMAGE), with a pb-data volume
and its admin UI on loopback; the AIO images run that PocketBase binary
as a process beside the homeserver, making up a superuser when none is
set. The .env examples, READMEs, docs and warp.yaml.example follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Docker/docker-compose.pocketbase.prod.yml

@@ -5,10 +5,11 @@
 #   cp .env.pocketbase.prod.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.prod.yml up -d
 #
-# PocketBase is embedded in the homeserver (the pocketbase database driver),
-# so it is not a container of its own: its data directory, with media in
-# its storage, is /data/pb_data in the warp-data volume. Set WARP_PB_S3_*
-# in .env to keep media in an S3 bucket instead (docs/configuration.md).
+# PocketBase is the homeserver's database, in a container of its own: Warp's
+# collections, and media in PocketBase's storage, are in the pb-data volume,
+# and the homeserver reaches it at http://pocketbase:8070 as the superuser
+# set in .env. Set WARP_PB_S3_* in .env to keep media in an S3 bucket
+# instead (docs/configuration.md).
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
 # client http://localhost:8080.
@@ -26,10 +27,38 @@
 name: warp-pocketbase
 
 services:
+  # PocketBase, the homeserver's database: Warp's collections, and media in
+  # PocketBase's storage, are in the pb-data volume. The image creates the
+  # superuser from .env on its first start, and never changes it after: a
+  # new password goes in through the admin UI, then into .env. The admin UI
+  # is http://localhost:8070/_/ on loopback; WARP_PB_BIND=0.0.0.0 exposes
+  # it, behind a reverse proxy only.
+  pocketbase:
+    image: ${WARP_PB_IMAGE:-tajniak81/pocketbase-docker-root:latest}
+    pull_policy: always
+    restart: unless-stopped
+    environment:
+      PB_PORT: "8070"
+      PB_ADMIN_EMAIL: ${WARP_PB_SUPERUSER_EMAIL:?set WARP_PB_SUPERUSER_EMAIL in .env}
+      PB_ADMIN_PASSWORD: ${WARP_PB_SUPERUSER_PASSWORD:?set WARP_PB_SUPERUSER_PASSWORD in .env}
+    volumes:
+      - ${WARP_PB_DATA_VOLUME:-pb-data}:/pb/pb_data
+    ports:
+      - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health >/dev/null || exit 1"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+      start_period: 10s
+
   warp:
     image: ${WARP_REGISTRY:-10.2.1.10:5500/admin}/warp:${WARP_VERSION:-latest}
     pull_policy: always
     restart: unless-stopped
+    depends_on:
+      pocketbase:
+        condition: service_healthy
     # The signing key is created on first start and kept in the volume:
     # losing it means other servers no longer recognise this one.
     entrypoint: ["/bin/sh", "-c"]
@@ -38,7 +67,7 @@ services:
     env_file: .env
     environment:
       WARP_DB_DRIVER: pocketbase
-      WARP_DB_CONNECTION_STRING: /data/pb_data
+      WARP_DB_CONNECTION_STRING: http://pocketbase:8070
     volumes:
       - ${WARP_DATA_VOLUME:-warp-data}:/data
     ports:
@@ -69,4 +98,7 @@ services:
       - "${WARP_WEB_PORT:-8080}:8080"
 
 volumes:
+  # The homeserver's signing key.
   warp-data:
+  # PocketBase's pb_data: the database, and media unless it is in S3.
+  pb-data: