PocketBase as a standalone database server

The pocketbase driver no longer embeds PocketBase: Warp keeps its data as
PocketBase collections on a server of its own and reaches it only through
the REST API, the way the postgres driver reaches PostgreSQL.
database.connection_string is the server's URL, and Warp signs in as the
superuser in WARP_PB_SUPERUSER_EMAIL / WARP_PB_SUPERUSER_PASSWORD (or a
WARP_PB_SUPERUSER_FILE of the two).

Every SQL table is a superuser-only collection of the same name and
columns, created by warp migrate. Reads go through PocketBase's SQL
endpoint with the SQL drivers' queries, via a read-only database/sql
driver that inlines arguments, moves long ones into warp_params and pages
past 1000 rows. Writes are record operations in batch requests under one
write lock in the Warp process. Media is a protected file field in
warp_media, local or in the S3 bucket Warp writes into PocketBase's
settings. Search matches word prefixes with LIKE. The storage tests run
against an in-process PocketBase and pass as on SQLite.

Docker: the PocketBase stacks get a pocketbase service running
tajniak81/pocketbase-docker-root (WARP_PB_IMAGE), with a pb-data volume
and its admin UI on loopback; the AIO images run that PocketBase binary
as a process beside the homeserver, making up a superuser when none is
set. The .env examples, READMEs, docs and warp.yaml.example follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Docker/docker-compose.pocketbase.s3.yml

@@ -6,7 +6,7 @@
 #   cp .env.pocketbase.s3.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.s3.yml up -d --build
 #
-# The database stays in /data/pb_data (warp-data); media goes to the bucket
+# The database is PocketBase's, in pb-data; media goes to the bucket
 # WARP_PB_S3_BUCKET (default warp) on WARP_PB_S3_ENDPOINT, which must already
 # exist: nothing here runs a gateway or creates the bucket. For a gateway on
 # this Docker host, use http://host.docker.internal:8333; the host entry below
@@ -24,12 +24,43 @@
 name: warp-pocketbase-s3
 
 services:
+  # PocketBase, the homeserver's database: Warp's collections, and media in
+  # PocketBase's storage, are in the pb-data volume. The image creates the
+  # superuser from .env on its first start, and never changes it after: a
+  # new password goes in through the admin UI, then into .env. The admin UI
+  # is http://localhost:8070/_/ on loopback; WARP_PB_BIND=0.0.0.0 exposes
+  # it, behind a reverse proxy only.
+  pocketbase:
+    image: ${WARP_PB_IMAGE:-tajniak81/pocketbase-docker-root:latest}
+    restart: unless-stopped
+    extra_hosts:
+      # Lets WARP_PB_S3_ENDPOINT name the Docker host as host.docker.internal:
+      # PocketBase is what talks to the bucket.
+      - "host.docker.internal:host-gateway"
+    environment:
+      PB_PORT: "8070"
+      PB_ADMIN_EMAIL: ${WARP_PB_SUPERUSER_EMAIL:?set WARP_PB_SUPERUSER_EMAIL in .env}
+      PB_ADMIN_PASSWORD: ${WARP_PB_SUPERUSER_PASSWORD:?set WARP_PB_SUPERUSER_PASSWORD in .env}
+    volumes:
+      - ${WARP_PB_DATA_VOLUME:-pb-data}:/pb/pb_data
+    ports:
+      - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health >/dev/null || exit 1"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+      start_period: 10s
+
   warp:
     build:
       context: ..
       dockerfile: Dockerfile
     image: warp:latest
     restart: unless-stopped
+    depends_on:
+      pocketbase:
+        condition: service_healthy
     extra_hosts:
       # Lets WARP_PB_S3_ENDPOINT name the Docker host as host.docker.internal.
       - "host.docker.internal:host-gateway"
@@ -48,7 +79,7 @@ services:
     env_file: .env
     environment:
       WARP_DB_DRIVER: pocketbase
-      WARP_DB_CONNECTION_STRING: /data/pb_data
+      WARP_DB_CONNECTION_STRING: http://pocketbase:8070
       WARP_PB_S3_ENABLED: "true"
       WARP_PB_S3_ENDPOINT: ${WARP_PB_S3_ENDPOINT:?set WARP_PB_S3_ENDPOINT in .env}
       WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
@@ -92,4 +123,7 @@ services:
       - "${WARP_WEB_PORT:-8080}:8080"
 
 volumes:
+  # The homeserver's signing key.
   warp-data:
+  # PocketBase's pb_data: the database, and media unless it is in S3.
+  pb-data: