PocketBase as a standalone database server

The pocketbase driver no longer embeds PocketBase: Warp keeps its data as
PocketBase collections on a server of its own and reaches it only through
the REST API, the way the postgres driver reaches PostgreSQL.
database.connection_string is the server's URL, and Warp signs in as the
superuser in WARP_PB_SUPERUSER_EMAIL / WARP_PB_SUPERUSER_PASSWORD (or a
WARP_PB_SUPERUSER_FILE of the two).

Every SQL table is a superuser-only collection of the same name and
columns, created by warp migrate. Reads go through PocketBase's SQL
endpoint with the SQL drivers' queries, via a read-only database/sql
driver that inlines arguments, moves long ones into warp_params and pages
past 1000 rows. Writes are record operations in batch requests under one
write lock in the Warp process. Media is a protected file field in
warp_media, local or in the S3 bucket Warp writes into PocketBase's
settings. Search matches word prefixes with LIKE. The storage tests run
against an in-process PocketBase and pass as on SQLite.

Docker: the PocketBase stacks get a pocketbase service running
tajniak81/pocketbase-docker-root (WARP_PB_IMAGE), with a pb-data volume
and its admin UI on loopback; the AIO images run that PocketBase binary
as a process beside the homeserver, making up a superuser when none is
set. The .env examples, READMEs, docs and warp.yaml.example follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Docker/docker-compose.pocketbase.seaweedfs.split.yml

@@ -7,7 +7,7 @@
 #   cp .env.pocketbase.seaweedfs.split.example .env      # then edit it
 #   docker compose -f docker-compose.pocketbase.seaweedfs.split.yml up -d --build
 #
-# The database stays in /data/pb_data (warp-data); media goes to the bucket
+# The database is PocketBase's, in pb-data; media goes to the bucket
 # WARP_PB_S3_BUCKET (default warp) in SeaweedFS (seaweed-data). Over
 # docker-compose.pocketbase.seaweedfs.yml this buys SeaweedFS's admin UI,
 # where S3 identities are created and revoked under Object Store → Users,
@@ -170,6 +170,30 @@ services:
       retries: 12
       start_period: 15s
 
+  # PocketBase, the homeserver's database: Warp's collections, and media in
+  # PocketBase's storage, are in the pb-data volume. The image creates the
+  # superuser from .env on its first start, and never changes it after: a
+  # new password goes in through the admin UI, then into .env. The admin UI
+  # is http://localhost:8070/_/ on loopback; WARP_PB_BIND=0.0.0.0 exposes
+  # it, behind a reverse proxy only.
+  pocketbase:
+    image: ${WARP_PB_IMAGE:-tajniak81/pocketbase-docker-root:latest}
+    restart: unless-stopped
+    environment:
+      PB_PORT: "8070"
+      PB_ADMIN_EMAIL: ${WARP_PB_SUPERUSER_EMAIL:?set WARP_PB_SUPERUSER_EMAIL in .env}
+      PB_ADMIN_PASSWORD: ${WARP_PB_SUPERUSER_PASSWORD:?set WARP_PB_SUPERUSER_PASSWORD in .env}
+    volumes:
+      - ${WARP_PB_DATA_VOLUME:-pb-data}:/pb/pb_data
+    ports:
+      - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health >/dev/null || exit 1"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+      start_period: 10s
+
   warp:
     build:
       context: ..
@@ -177,6 +201,8 @@ services:
     image: warp:latest
     restart: unless-stopped
     depends_on:
+      pocketbase:
+        condition: service_healthy
       seaweedfs-s3:
         condition: service_healthy
     # The signing key is created on first start and kept in the volume:
@@ -187,7 +213,7 @@ services:
     env_file: .env
     environment:
       WARP_DB_DRIVER: pocketbase
-      WARP_DB_CONNECTION_STRING: /data/pb_data
+      WARP_DB_CONNECTION_STRING: http://pocketbase:8070
       # The gateway on the compose network; these override whatever .env
       # says about S3.
       WARP_PB_S3_ENABLED: "true"
@@ -231,7 +257,10 @@ services:
       - "${WARP_WEB_PORT:-8080}:8080"
 
 volumes:
+  # The homeserver's signing key.
   warp-data:
+  # PocketBase's pb_data: the database, and media unless it is in S3.
+  pb-data:
   # Master, volume and filer share it, as `weed server -dir` lays it out.
   seaweed-data:
   # The admin UI's session key and maintenance state; no object data.