Mikiri WAF does not publish its own PostgreSQL image. Use the official postgres image, or an existing PostgreSQL server. The steps below use PostgreSQL 17 on the Docker network mikiri-waf from the Docker images page.
mkdir -p /opt/mikiri-waf/postgresql
docker run -d --name mikiri-waf-db --network mikiri-waf --restart unless-stopped \
-e POSTGRES_PASSWORD=YOUR_PASSWORD \
-v /opt/mikiri-waf/postgresql:/var/lib/postgresql/data \
postgres:17
YOUR_PASSWORD is the password of the PostgreSQL superuser. Do not use this example password. The data directory must be empty on the first start.
Port 5432 is available to other containers on the mikiri-waf network as the host name mikiri-waf-db. Publish it on the Docker host only when a client outside this network must connect:
-p 5432:5432
docker exec without a password.API
docker exec -u postgres mikiri-waf-db psql -c "CREATE DATABASE api;"
docker exec -u postgres mikiri-waf-db psql -c "CREATE ROLE api PASSWORD 'YOUR_PASSWORD';"
docker exec -u postgres mikiri-waf-db psql -c "GRANT ALL ON DATABASE api TO api;"
docker exec -u postgres mikiri-waf-db psql -c "ALTER ROLE api WITH LOGIN;"
docker exec -u postgres mikiri-waf-db psql -d api -c "GRANT ALL ON ALL TABLES IN SCHEMA public TO api;"
docker exec -u postgres mikiri-waf-db psql -d api -c "GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO api;"
docker exec -u postgres mikiri-waf-db psql -d api -c "GRANT CREATE ON SCHEMA public TO api;"
WMC
docker exec -u postgres mikiri-waf-db psql -c "CREATE DATABASE wmc;"
docker exec -u postgres mikiri-waf-db psql -c "CREATE ROLE wmc PASSWORD 'YOUR_PASSWORD';"
docker exec -u postgres mikiri-waf-db psql -c "GRANT ALL ON DATABASE wmc TO wmc;"
docker exec -u postgres mikiri-waf-db psql -c "ALTER ROLE wmc WITH LOGIN;"
docker exec -u postgres mikiri-waf-db psql -d wmc -c "GRANT ALL ON ALL TABLES IN SCHEMA public TO wmc;"
docker exec -u postgres mikiri-waf-db psql -d wmc -c "GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO wmc;"
docker exec -u postgres mikiri-waf-db psql -d wmc -c "GRANT CREATE ON SCHEMA public TO wmc;"
Use a different password for each role. In the agent configuration, set the database host to mikiri-waf-db and the port to 5432.
Stop and replace the container. Keep the data volume.
docker pull postgres:17
docker stop mikiri-waf-db
docker rm mikiri-waf-db
docker run -d --name mikiri-waf-db --network mikiri-waf --restart unless-stopped \
-e POSTGRES_PASSWORD=YOUR_PASSWORD \
-v /opt/mikiri-waf/postgresql:/var/lib/postgresql/data \
postgres:17
POSTGRES_PASSWORD is applied only when the data directory is initialized. An existing volume keeps the password that was set on the first start.