Keep the engine's state in SQLite, not Postgres

One process owns this database — the image has run a single uvicorn
worker for that reason since the four-engines bug — so a file beside the
flows is the honest shape for it, and it is what lets `fluksio serve`
need no infrastructure at all. Live values, node execution and the work
queue never came here anyway; what does is a rollup a minute at a time,
a row per cascade and the run history, and WAL keeps the readers going
while that one writer works.

DATA_DIR is now the one setting that moves everything an installation
keeps; the rest derive from it and the images still spell theirs out.
The schema is prepared in-process at startup, so the prestart service is
gone, and the ten Postgres-only revisions collapse into one portable
baseline.

Three things only worked because psycopg was casting for us: a token's
subject arriving as a string where the column is a UUID, `greatest`, and
`date_bin`. The timestamps needed a column type of their own — SQLite
stores no offset, and a naive datetime read back either raises against an
aware `now` or serialises as local time.

Postgres stays in the stack only for Umami, behind the analytics profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/fluksio/core/config.py

@@ -1,3 +1,4 @@
+import os
 import secrets
 import warnings
 from pathlib import Path
@@ -8,13 +9,24 @@ from pydantic import (
     BeforeValidator,
     EmailStr,
     HttpUrl,
-    PostgresDsn,
     computed_field,
     model_validator,
 )
 from pydantic_settings import BaseSettings, SettingsConfigDict
 from typing_extensions import Self
 
+#: Everything the engine keeps on disk, relative to :attr:`Settings.DATA_DIR`.
+#: One setting to move the lot; each still overridable on its own, which is
+#: what the container images do.
+DERIVED_PATHS = {
+    "FLOWS_DIR": "flows",
+    "SECRETS_FILE": "secrets.enc",
+    "ALERTS_FILE": "alerts.json",
+    "PANELS_FILE": "panels.json",
+    "OAUTH_PRIVATE_KEY_FILE": "oauth-key.pem",
+    "CLOUD_CONFIG_FILE": "cloud.json",
+}
+
 
 def parse_cors(v: Any) -> list[str] | str:
     if isinstance(v, str) and not v.startswith("["):
@@ -26,8 +38,10 @@ def parse_cors(v: Any) -> list[str] | str:
 
 class Settings(BaseSettings):
     model_config = SettingsConfigDict(
-        # Use top level .env file (one level above ./backend/)
-        env_file="../.env",
+        # The stack's own file, one level above ./backend/. An installed
+        # `fluksio` has no such tree, so its CLI points this at the data
+        # directory instead — and at nothing it might find in the cwd.
+        env_file=os.environ.get("FLUKSIO_ENV_FILE", "../.env"),
         env_ignore_empty=True,
         extra="ignore",
     )
@@ -38,6 +52,14 @@ class Settings(BaseSettings):
     FRONTEND_HOST: str = "http://localhost:5173"
     ENVIRONMENT: Literal["local", "staging", "production"] = "local"
 
+    #: Everything this installation keeps: the database, the flow repository,
+    #: secrets, artifacts and the user venv. The paths below derive from it
+    #: unless they are set explicitly.
+    DATA_DIR: Path = Path("flow-data")
+    #: Any SQLAlchemy URL. The default puts SQLite in the data directory, which
+    #: is what makes `fluksio serve` need no infrastructure at all.
+    DATABASE_URL: str | None = None
+
     # Flows live on disk as a git repository; secrets stay outside it.
     FLOWS_DIR: Path = Path("flow-data/flows")
     SECRETS_FILE: Path = Path("flow-data/secrets.enc")
@@ -80,6 +102,22 @@ class Settings(BaseSettings):
         list[AnyUrl] | str, BeforeValidator(parse_cors)
     ] = []
 
+    @model_validator(mode="before")
+    @classmethod
+    def _derive_data_paths(cls, data: Any) -> Any:
+        """Put every stored thing under ``DATA_DIR`` unless it was named.
+
+        ``setdefault``, so the container images keep their explicit ``/data``
+        paths and a checkout keeps ``flow-data/``.
+        """
+        if not isinstance(data, dict):
+            return data
+        base = Path(str(data.get("DATA_DIR", "flow-data"))).expanduser()
+        data["DATA_DIR"] = base
+        for key, name in DERIVED_PATHS.items():
+            data.setdefault(key, base / name)
+        return data
+
     @computed_field  # type: ignore[prop-decorator]
     @property
     def oauth_issuer(self) -> str:
@@ -105,25 +143,21 @@ class Settings(BaseSettings):
             self.FRONTEND_HOST
         ]
 
-    PROJECT_NAME: str
+    PROJECT_NAME: str = "Fluksio"
     SENTRY_DSN: HttpUrl | None = None
-    POSTGRES_SERVER: str
-    POSTGRES_PORT: int = 5432
-    POSTGRES_USER: str
-    POSTGRES_PASSWORD: str = ""
-    POSTGRES_DB: str = ""
 
     @computed_field  # type: ignore[prop-decorator]
     @property
-    def SQLALCHEMY_DATABASE_URI(self) -> PostgresDsn:
-        return PostgresDsn.build(
-            scheme="postgresql+psycopg",
-            username=self.POSTGRES_USER,
-            password=self.POSTGRES_PASSWORD,
-            host=self.POSTGRES_SERVER,
-            port=self.POSTGRES_PORT,
-            path=self.POSTGRES_DB,
-        )
+    def SQLALCHEMY_DATABASE_URI(self) -> str:
+        """SQLite in the data directory, unless a URL says otherwise.
+
+        One engine process owns this database — the same reason the image runs
+        a single uvicorn worker — so a file beside the flows is the honest
+        shape for it, and needs nothing running to be one.
+        """
+        if self.DATABASE_URL:
+            return self.DATABASE_URL
+        return f"sqlite:///{(self.DATA_DIR / 'fluksio.db').expanduser().resolve()}"
 
     SMTP_TLS: bool = True
     SMTP_SSL: bool = False
@@ -148,8 +182,10 @@ class Settings(BaseSettings):
         return bool(self.SMTP_HOST and self.EMAILS_FROM_EMAIL)
 
     EMAIL_TEST_USER: EmailStr = "test@example.com"
-    FIRST_SUPERUSER: EmailStr
-    FIRST_SUPERUSER_PASSWORD: str
+    # Absent means "the CLI will make one on first run" — a pip install is not
+    # asked for two environment variables before it can start.
+    FIRST_SUPERUSER: EmailStr | None = None
+    FIRST_SUPERUSER_PASSWORD: str | None = None
 
     def _check_default_secret(self, var_name: str, value: str | None) -> None:
         if value == "changethis":
@@ -165,7 +201,6 @@ class Settings(BaseSettings):
     @model_validator(mode="after")
     def _enforce_non_default_secrets(self) -> Self:
         self._check_default_secret("SECRET_KEY", self.SECRET_KEY)
-        self._check_default_secret("POSTGRES_PASSWORD", self.POSTGRES_PASSWORD)
         self._check_default_secret(
             "FIRST_SUPERUSER_PASSWORD", self.FIRST_SUPERUSER_PASSWORD
         )
@@ -173,4 +208,6 @@ class Settings(BaseSettings):
         return self
 
 
-settings = Settings()  # type: ignore
+# No arguments and no required environment: a fresh install boots on the
+# defaults above, into a data directory of its own.
+settings = Settings()