# v-b1 — Externalize Resources

**New concepts (2):** external Docker network; named volume for persistence.
`init.sql` seeding is the *how* of persistence, not a third concept.

## What changed from v-b0
- PGDATA now lives in a **named external volume** (`minbase_pgdata`) → survives `down`.
- The stack runs on an **external network** (`minbasenet`) you own.

## Prerequisites (create the external resources once)
```
docker network create minbasenet
docker volume  create minbase_pgdata
```

## Run it
```
docker compose up -d
```

## "Why" sidebar (junior track)
- `init.sql` runs **only** when the data directory is empty (first cold start). Once
  the volume has data, Postgres skips the entrypoint scripts — that's why re-running
  `up` does not duplicate seed rows.
- `external: true` means Compose references but never creates/destroys the resource.
  `docker compose down` leaves your data intact; `down -v` still won't touch an
  external volume. You must `docker volume rm` it deliberately.
- **Backup awareness (deferred):** now that data persists, a real deployment needs a
  backup story. `pg_dump -U postgres app > backup.sql` is the one-liner. Automated
  backups to S3 are Advanced-tier (v-a5) — but never call a stack "production-ready"
  with zero backup.

## Verification
1. Volume + network exist: `docker volume ls | grep minbase_pgdata`,
   `docker network ls | grep minbasenet`.
2. **Persistence works (v-b0's failure is fixed):**
   ```
   curl -X POST http://localhost:3000/candidates -H "Content-Type: application/json" -d '{"name":"Ginny"}'
   docker compose down
   docker compose up -d
   curl http://localhost:3000/candidates
   ```
   Ginny is **still there** now.
3. **init.sql does not re-run:** the seed rows are not duplicated after restart.

## Secrets policy

**Local-only dev defaults.** The Basic tier keeps clearly-labelled literals so the lesson runs with no setup: `devpassword` (postgres superuser, inline in `compose.yml`). They are teaching values: **never reuse them** anywhere reachable from a network, and never copy them into a real deployment. Every published port in this variant binds to `127.0.0.1` only. Real, random, per-install secrets start at v-b8 (generated by `install.sh`) and the Intermediate tier (v-i2…v-i5). A committed `.env.secret` is never acceptable; only `*.example` files are tracked.