feat: use postgres

notification/docs/runbook.md

@@ -7,10 +7,16 @@ This runbook covers startup, steady-state verification, shutdown, and common
 
 Before starting the process, confirm:
 
-- `NOTIFICATION_REDIS_ADDR` points to the Redis deployment that stores
-  notification records, routes, idempotency reservations, malformed intents,
-  dead letters, stream offsets, and route schedules
-- Redis ACL, DB, TLS, and timeout settings match the target environment
+- `NOTIFICATION_REDIS_MASTER_ADDR` points to the Redis master deployment
+  that hosts the inbound `notification:intents` stream, the persisted
+  consumer offset, the outbound `gateway:client-events` and
+  `mail:delivery_commands` streams, and the temporary `route_leases:*` keys
+- `NOTIFICATION_REDIS_PASSWORD` matches the connection password
+  (mandatory; the deprecated `NOTIFICATION_REDIS_USERNAME` /
+  `NOTIFICATION_REDIS_TLS_ENABLED` env vars are rejected at startup)
+- `NOTIFICATION_POSTGRES_PRIMARY_DSN` points to the PostgreSQL primary
+  hosting the `notification` schema; the role must own
+  `records`, `routes`, `dead_letters`, and `malformed_intents`
 - `NOTIFICATION_USER_SERVICE_BASE_URL` points to the trusted internal
   `User Service`
 - `NOTIFICATION_GATEWAY_CLIENT_EVENTS_STREAM` matches the stream consumed by
@@ -19,11 +25,18 @@ Before starting the process, confirm:
   `Mail Service`
 - administrator email variables are populated for notification types that
   should notify administrators
+- retention knobs (`NOTIFICATION_RECORD_RETENTION`,
+  `NOTIFICATION_MALFORMED_INTENT_RETENTION`,
+  `NOTIFICATION_CLEANUP_INTERVAL`) are sized for the expected operator
+  history window
 - OpenTelemetry exporter settings point at the intended collector when traces
   or metrics are expected outside the process
 
-At startup the process performs a bounded Redis `PING`. Startup fails fast if
-configuration validation or Redis connectivity fails.
+At startup the process performs a bounded Redis `PING`, opens the
+PostgreSQL pool, runs the embedded goose migrations, and only then starts
+the internal HTTP probe. Startup fails fast if configuration validation,
+Redis connectivity, PostgreSQL connectivity, or migration application
+fails.
 
 Known startup caveats: