geo ip 데이터 load후 api 수행하도록 구조 변경

2025-12-09 15:12:36 +09:00
parent ecaca02400
commit 2d3345bb6d
9 changed files with 525 additions and 190 deletions
--- a/4
+++ b/4
@@ -8,7 +8,8 @@ COPY go.mod ./
 RUN go mod download

 COPY . .
-RUN CGO_ENABLED=0 go build -o /bin/geoip ./cmd/server
+RUN CGO_ENABLED=0 go build -o /bin/geoip ./cmd/server && \
+    CGO_ENABLED=0 go build -o /bin/geoip-loader ./cmd/loader

 FROM debian:trixie-slim

@@ -17,6 +18,7 @@ RUN useradd --create-home --shell /usr/sbin/nologin appuser
 WORKDIR /app

 COPY --from=builder /bin/geoip /usr/local/bin/geoip
+COPY --from=builder /bin/geoip-loader /usr/local/bin/geoip-loader
 COPY GeoLite2-City.mmdb /data/GeoLite2-City.mmdb

 ENV GEOIP_DB_PATH=/data/GeoLite2-City.mmdb
--- a/Dockerfile.postgres
+++ b/Dockerfile.postgres
@@ -1,25 +0,0 @@
-FROM postgres:16-bookworm AS builder
-
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-    build-essential \
-    ca-certificates \
-    git \
-    libmaxminddb-dev \
-    postgresql-server-dev-16 && \
-    rm -rf /var/lib/apt/lists/*
-
-WORKDIR /tmp/maxminddb_fdw
-RUN git clone https://github.com/klayemore/maxminddb_fdw.git . && \
-    make && \
-    make install
-
-FROM postgres:16-bookworm
-COPY --from=builder /usr/lib/postgresql/16/lib/maxminddb_fdw.so /usr/lib/postgresql/16/lib/maxminddb_fdw.so
-COPY --from=builder /usr/share/postgresql/16/extension/maxminddb_fdw* /usr/share/postgresql/16/extension/
-
-RUN mkdir -p /data && chown postgres:postgres /data
-
-ENV POSTGRES_DB=geoip
-ENV POSTGRES_USER=geoip_admin
-ENV POSTGRES_PASSWORD=geoip_admin
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # GeoIP REST (Go Fiber)

-간단한 GeoIP 조회 API입니다. `GeoLite2-City.mmdb`를 사용해 IP를 나라/지역/도시/위도/경도로 매핑합니다.
+간단한 GeoIP 조회 API입니다. 기본은 `GeoLite2-City.mmdb`를 사용해 IP를 나라/지역/도시/위도/경도로 매핑하며, 선택적으로 PostgreSQL + `maxminddb_fdw`로 가져온 데이터를 조회할 수 있습니다. 초기 적재 후에는 DB만으로 조회가 가능하도록 읽기 전용 테이블과 함수가 생성됩니다.

 ## 요구 사항
 - Go 1.25+
@@ -14,16 +14,31 @@ go mod tidy            # 필요한 경우 go.sum 생성
 PORT=8080 GEOIP_DB_PATH=./GeoLite2-City.mmdb go run ./cmd/server
 ```

-### Docker Compose
+### Docker 최초 실행시
+```bash
+docker network create --driver bridge --attachable geo-ip
+``` 
+
+### Docker Compose (PostgreSQL + FDW + API)
 ```bash
 docker compose up --build
 ```
- `GeoLite2-City.mmdb`가 컨테이너에 read-only로 마운트됩니다.
- 기본 포트: `8080`.
+- 서비스
+  - `postgres` (5432): `Dockerfile.postgres`로 `maxminddb_fdw`를 빌드하여 확장 설치 후 `GeoLite2-City.mmdb`를 FDW로 읽고, 로컬 테이블로 적재합니다. 초기 적재 완료 후 mmdb 없이도 DB에서 조회가 가능합니다.
+  - `api` (8080): 기본적으로 Postgres 백엔드(`GEOIP_BACKEND=postgres`)를 사용해 조회합니다.
+- 볼륨
+  - `./GeoLite2-City.mmdb:/data/GeoLite2-City.mmdb:ro` (Postgres 초기 적재용)
+  - `pgdata` (DB 데이터 지속)

 ## 환경 변수
- `PORT` (기본 `8080`): 서버 리스닝 포트
- `GEOIP_DB_PATH` (기본 `/data/GeoLite2-City.mmdb`): GeoIP 데이터베이스 경로
+- 공통
+  - `PORT` (기본 `8080`): 서버 리스닝 포트
+  - `GEOIP_BACKEND` (`mmdb`|`postgres`, 기본 `mmdb`)
+- MMDB 모드
+  - `GEOIP_DB_PATH` (기본 `/data/GeoLite2-City.mmdb`): GeoIP 데이터베이스 경로
+- Postgres 모드
+  - `DATABASE_URL`: 예) `postgres://geoip_readonly:geoip_readonly@postgres:5432/geoip?sslmode=disable`
+  - `GEOIP_LOOKUP_QUERY` (선택): 기본은 `geoip.lookup_city($1)` 사용

 ## 사용법
 - 헬스체크: `GET /health`
@@ -49,6 +64,17 @@ curl "http://localhost:8080/lookup?ip=1.1.1.1"
 ```

 ## 개발 참고
- 주요 코드: `cmd/server/main.go`, `internal/geo/resolver.go`
+- 주요 코드: `cmd/server/main.go`, `internal/geo` (MMDB/Postgres resolver)
 - 테스트 실행: `go test ./...`
+  - Postgres 통합 테스트 실행 시 `GEOIP_TEST_DATABASE_URL`을 설정하면 DB 백엔드 조회 테스트가 수행됩니다(미설정 시 skip).
 - 컨테이너 빌드: `docker build -t geoip:local .`
+
+## Postgres/FDW 쿼리 예시
+- 단건 조회 함수 (CIDR 매칭): `SELECT * FROM geoip.lookup_city('1.1.1.1');`
+- 원시 테이블 조회: `SELECT * FROM geoip.city_blocks LIMIT 5;`
+- API는 `lookup_city(inet)`를 사용하여 가장 구체적인 네트워크(prefix) 한 건을 반환합니다.
+
+## 보안 및 운영 주의사항
+- GeoLite2 라이선스 준수: `GeoLite2-City.mmdb` 교체 시 기존 파일을 대체하여 재시작하세요.
+- Postgres 포트(5432) 외부 노출 시 방화벽/보안 그룹으로 제한하고 강한 비밀번호를 사용하세요.
+- DB는 읽기 전용 계정(`geoip_readonly`)을 기본으로 사용하며, 초기 스키마에서 `default_transaction_read_only`를 강제합니다.
--- a/cmd/loader/main.go
+++ b/cmd/loader/main.go
@@ -0,0 +1,378 @@
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"strconv"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/oschwald/maxminddb-golang"
+)
+
+const (
+	defaultMMDBPath      = "/data/GeoLite2-City.mmdb"
+	defaultSchema        = "geoip"
+	defaultLoaderTimeout = 5 * time.Minute
+)
+
+type cityRecord struct {
+	City struct {
+		GeoNameID uint              `maxminddb:"geoname_id"`
+		Names     map[string]string `maxminddb:"names"`
+	} `maxminddb:"city"`
+	Country struct {
+		IsoCode string            `maxminddb:"iso_code"`
+		Names   map[string]string `maxminddb:"names"`
+	} `maxminddb:"country"`
+	Subdivisions []struct {
+		IsoCode string            `maxminddb:"iso_code"`
+		Names   map[string]string `maxminddb:"names"`
+	} `maxminddb:"subdivisions"`
+	Location struct {
+		Latitude  float64 `maxminddb:"latitude"`
+		Longitude float64 `maxminddb:"longitude"`
+		TimeZone  string  `maxminddb:"time_zone"`
+	} `maxminddb:"location"`
+}
+
+type cityRow struct {
+	network    string
+	geonameID  int
+	country    string
+	countryISO string
+	region     string
+	regionISO  string
+	city       string
+	latitude   float64
+	longitude  float64
+	timeZone   string
+}
+
+func main() {
+	ctx, cancel := context.WithTimeout(context.Background(), defaultLoaderTimeout)
+	defer cancel()
+
+	dbURL := os.Getenv("DATABASE_URL")
+	if dbURL == "" {
+		log.Fatal("DATABASE_URL is required")
+	}
+
+	mmdbPath := env("GEOIP_DB_PATH", defaultMMDBPath)
+	skipIfSame := envBool("GEOIP_LOADER_SKIP_IF_SAME_HASH", true)
+	force := envBool("GEOIP_LOADER_FORCE", false)
+
+	log.Printf("starting mmdb load from %s", mmdbPath)
+
+	hash, err := fileSHA256(mmdbPath)
+	if err != nil {
+		log.Fatalf("failed to hash mmdb: %v", err)
+	}
+
+	conn, err := pgx.Connect(ctx, dbURL)
+	if err != nil {
+		log.Fatalf("failed to connect database: %v", err)
+	}
+	defer conn.Close(context.Background())
+
+	if err := ensureSchema(ctx, conn); err != nil {
+		log.Fatalf("failed to ensure schema: %v", err)
+	}
+
+	existingHash, err := currentHash(ctx, conn)
+	if err != nil {
+		log.Fatalf("failed to read metadata: %v", err)
+	}
+	if skipIfSame && !force && existingHash == hash {
+		log.Printf("mmdb hash unchanged (%s), skipping load", hash)
+		return
+	}
+
+	rowSource, err := newNetworkSource(mmdbPath)
+	if err != nil {
+		log.Fatalf("failed to open mmdb: %v", err)
+	}
+	defer rowSource.Close()
+
+	if err := loadNetworks(ctx, conn, rowSource); err != nil {
+		log.Fatalf("failed to load networks: %v", err)
+	}
+
+	if err := upsertHash(ctx, conn, hash); err != nil {
+		log.Fatalf("failed to update metadata: %v", err)
+	}
+
+	log.Printf("loaded mmdb into Postgres (%d rows), hash=%s", rowSource.Rows(), hash)
+}
+
+func env(key, fallback string) string {
+	if val := os.Getenv(key); val != "" {
+		return val
+	}
+	return fallback
+}
+
+func envBool(key string, fallback bool) bool {
+	val := os.Getenv(key)
+	if val == "" {
+		return fallback
+	}
+	parsed, err := strconv.ParseBool(val)
+	if err != nil {
+		return fallback
+	}
+	return parsed
+}
+
+func fileSHA256(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+func ensureSchema(ctx context.Context, conn *pgx.Conn) error {
+	ddl := fmt.Sprintf(`
+CREATE SCHEMA IF NOT EXISTS %s;
+
+CREATE TABLE IF NOT EXISTS %s.geoip_metadata (
+  key text PRIMARY KEY,
+  value text NOT NULL,
+  updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS %s.city_lookup (
+  network cidr PRIMARY KEY,
+  geoname_id integer,
+  country text,
+  country_iso_code text,
+  region text,
+  region_iso_code text,
+  city text,
+  latitude double precision,
+  longitude double precision,
+  time_zone text
+);
+`, defaultSchema, defaultSchema, defaultSchema)
+
+	_, err := conn.Exec(ctx, ddl)
+	return err
+}
+
+func currentHash(ctx context.Context, conn *pgx.Conn) (string, error) {
+	var hash sql.NullString
+	err := conn.QueryRow(ctx, `SELECT value FROM geoip.geoip_metadata WHERE key = 'mmdb_sha256'`).Scan(&hash)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+	return hash.String, nil
+}
+
+func upsertHash(ctx context.Context, conn *pgx.Conn, hash string) error {
+	_, err := conn.Exec(ctx, `
+INSERT INTO geoip.geoip_metadata(key, value, updated_at)
+VALUES ('mmdb_sha256', $1, now())
+ON CONFLICT (key) DO UPDATE
+  SET value = EXCLUDED.value,
+      updated_at = EXCLUDED.updated_at;
+`, hash)
+	return err
+}
+
+type networkSource struct {
+	reader *maxminddb.Reader
+	iter   *maxminddb.Networks
+	err    error
+	row    cityRow
+	count  int
+}
+
+func newNetworkSource(path string) (*networkSource, error) {
+	reader, err := maxminddb.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	return &networkSource{
+		reader: reader,
+		iter:   reader.Networks(),
+	}, nil
+}
+
+func (s *networkSource) Close() {
+	if s.reader != nil {
+		_ = s.reader.Close()
+	}
+}
+
+func (s *networkSource) Rows() int {
+	return s.count
+}
+
+func (s *networkSource) Next() bool {
+	if !s.iter.Next() {
+		s.err = s.iter.Err()
+		return false
+	}
+
+	var rec cityRecord
+	network, err := s.iter.Network(&rec)
+	if err != nil {
+		s.err = err
+		return false
+	}
+
+	s.row = cityRow{
+		network:    network.String(),
+		geonameID:  int(rec.City.GeoNameID),
+		country:    rec.Country.Names["en"],
+		countryISO: rec.Country.IsoCode,
+		region:     firstName(rec.Subdivisions),
+		regionISO:  firstISO(rec.Subdivisions),
+		city:       rec.City.Names["en"],
+		latitude:   rec.Location.Latitude,
+		longitude:  rec.Location.Longitude,
+		timeZone:   rec.Location.TimeZone,
+	}
+	s.count++
+	if s.count%500000 == 0 {
+		log.Printf("loader progress: %d rows processed", s.count)
+	}
+	return true
+}
+
+func (s *networkSource) Values() ([]any, error) {
+	return []any{
+		s.row.network,
+		s.row.geonameID,
+		s.row.country,
+		s.row.countryISO,
+		s.row.region,
+		s.row.regionISO,
+		s.row.city,
+		s.row.latitude,
+		s.row.longitude,
+		s.row.timeZone,
+	}, nil
+}
+
+func (s *networkSource) Err() error {
+	if s.err != nil {
+		return s.err
+	}
+	return s.iter.Err()
+}
+
+func firstName(subdivisions []struct {
+	IsoCode string            `maxminddb:"iso_code"`
+	Names   map[string]string `maxminddb:"names"`
+}) string {
+	if len(subdivisions) == 0 {
+		return ""
+	}
+	return subdivisions[0].Names["en"]
+}
+
+func firstISO(subdivisions []struct {
+	IsoCode string            `maxminddb:"iso_code"`
+	Names   map[string]string `maxminddb:"names"`
+}) string {
+	if len(subdivisions) == 0 {
+		return ""
+	}
+	return subdivisions[0].IsoCode
+}
+
+func loadNetworks(ctx context.Context, conn *pgx.Conn, src *networkSource) error {
+	tx, err := conn.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		_ = tx.Rollback(ctx)
+	}()
+
+	_, err = tx.Exec(ctx, `DROP TABLE IF EXISTS geoip.city_lookup_new; CREATE TABLE geoip.city_lookup_new (LIKE geoip.city_lookup INCLUDING ALL);`)
+	if err != nil {
+		return err
+	}
+
+	columns := []string{
+		"network",
+		"geoname_id",
+		"country",
+		"country_iso_code",
+		"region",
+		"region_iso_code",
+		"city",
+		"latitude",
+		"longitude",
+		"time_zone",
+	}
+
+	log.Printf("loader copy: starting bulk copy")
+	copied, err := tx.CopyFrom(ctx, pgx.Identifier{defaultSchema, "city_lookup_new"}, columns, src)
+	if err != nil {
+		return err
+	}
+	log.Printf("loader copy: finished bulk copy (rows=%d)", copied)
+
+	if _, err := tx.Exec(ctx, `
+  ALTER TABLE IF EXISTS geoip.city_lookup RENAME TO city_lookup_old;
+  ALTER TABLE geoip.city_lookup_new RENAME TO city_lookup;
+  DROP TABLE IF EXISTS geoip.city_lookup_old;
+`); err != nil {
+		return err
+	}
+
+	if _, err := tx.Exec(ctx, `
+  CREATE INDEX IF NOT EXISTS city_lookup_network_gist ON geoip.city_lookup USING gist (network inet_ops);
+  CREATE INDEX IF NOT EXISTS city_lookup_geoname_id_idx ON geoip.city_lookup (geoname_id);
+`); err != nil {
+		return err
+	}
+
+	if _, err := tx.Exec(ctx, `
+  CREATE OR REPLACE FUNCTION geoip.lookup_city(ip inet)
+  RETURNS TABLE (
+      ip inet,
+      country text,
+      region text,
+      city text,
+      latitude double precision,
+      longitude double precision
+  ) LANGUAGE sql STABLE AS $$
+      SELECT
+          $1::inet AS ip,
+          c.country,
+          c.region,
+          c.city,
+          c.latitude,
+          c.longitude
+      FROM geoip.city_lookup c
+      WHERE c.network >>= $1
+      ORDER BY masklen(c.network) DESC
+      LIMIT 1;
+  $$;
+`); err != nil {
+		return err
+	}
+
+	return tx.Commit(ctx)
+}
--- a/deploy/postgres/init/00_geoip.sql
+++ b/deploy/postgres/init/00_geoip.sql
@@ -1,156 +1,47 @@
 SET client_min_messages TO WARNING;

-CREATE EXTENSION IF NOT EXISTS maxminddb_fdw;
-CREATE EXTENSION IF NOT EXISTS btree_gist;
-
-CREATE SERVER IF NOT EXISTS geoip_fdw
-  FOREIGN DATA WRAPPER maxminddb_fdw
-  OPTIONS (database '/data/GeoLite2-City.mmdb');
-
 CREATE SCHEMA IF NOT EXISTS geoip;
 SET search_path TO geoip, public;

-- 1) FDW 원본 테이블 (읽기 전용)
-DROP FOREIGN TABLE IF EXISTS city_blocks_ipv4 CASCADE;
-CREATE FOREIGN TABLE city_blocks_ipv4 (
-  network cidr,
-  geoname_id integer,
-  registered_country_geoname_id integer,
-  represented_country_geoname_id integer,
-  is_anonymous_proxy boolean,
-  is_satellite_provider boolean,
-  postal_code text,
-  latitude double precision,
-  longitude double precision,
-  accuracy_radius integer,
-  metro_code integer,
-  time_zone text,
-  is_anycast boolean
-) SERVER geoip_fdw OPTIONS (table 'City_Blocks_IPV4');
+CREATE TABLE IF NOT EXISTS geoip_metadata (
+  key text PRIMARY KEY,
+  value text NOT NULL,
+  updated_at timestamptz NOT NULL DEFAULT now()
+);

-DROP FOREIGN TABLE IF EXISTS city_blocks_ipv6 CASCADE;
-CREATE FOREIGN TABLE city_blocks_ipv6 (
-  network cidr,
-  geoname_id integer,
-  registered_country_geoname_id integer,
-  represented_country_geoname_id integer,
-  is_anonymous_proxy boolean,
-  is_satellite_provider boolean,
-  postal_code text,
-  latitude double precision,
-  longitude double precision,
-  accuracy_radius integer,
-  metro_code integer,
-  time_zone text,
-  is_anycast boolean
-) SERVER geoip_fdw OPTIONS (table 'City_Blocks_IPV6');
-
-DROP FOREIGN TABLE IF EXISTS city_locations_fdw CASCADE;
-CREATE FOREIGN TABLE city_locations_fdw (
-  geoname_id integer,
-  locale_code text,
-  continent_code text,
-  continent_name text,
-  country_iso_code text,
-  country_name text,
-  subdivision_1_iso_code text,
-  subdivision_1_name text,
-  subdivision_2_iso_code text,
-  subdivision_2_name text,
-  city_name text,
-  metro_code text,
-  time_zone text,
-  is_in_european_union boolean
-) SERVER geoip_fdw OPTIONS (table 'City_Locations', language 'English');
-
-- 2) 로컬 영구 테이블로 적재 (초기화 후 mmdb 없이 동작)
-DROP TABLE IF EXISTS city_blocks CASCADE;
-CREATE TABLE city_blocks (
+CREATE TABLE IF NOT EXISTS city_lookup (
  network cidr PRIMARY KEY,
  geoname_id integer,
-  registered_country_geoname_id integer,
-  represented_country_geoname_id integer,
-  is_anonymous_proxy boolean,
-  is_satellite_provider boolean,
-  postal_code text,
+  country text,
+  country_iso_code text,
+  region text,
+  region_iso_code text,
+  city text,
  latitude double precision,
  longitude double precision,
-  accuracy_radius integer,
-  metro_code integer,
-  time_zone text,
-  is_anycast boolean
+  time_zone text
 );

-INSERT INTO city_blocks
-SELECT * FROM city_blocks_ipv4
-UNION ALL
-SELECT * FROM city_blocks_ipv6;
-
-DROP TABLE IF EXISTS city_locations CASCADE;
-CREATE TABLE city_locations (
-  geoname_id integer PRIMARY KEY,
-  locale_code text,
-  continent_code text,
-  continent_name text,
-  country_iso_code text,
-  country_name text,
-  subdivision_1_iso_code text,
-  subdivision_1_name text,
-  subdivision_2_iso_code text,
-  subdivision_2_name text,
-  city_name text,
-  metro_code text,
-  time_zone text,
-  is_in_european_union boolean
-);
-
-INSERT INTO city_locations
-SELECT * FROM city_locations_fdw;
-
-CREATE INDEX IF NOT EXISTS city_blocks_network_gist ON city_blocks USING gist (network inet_ops);
-CREATE INDEX IF NOT EXISTS city_blocks_geoname_id_idx ON city_blocks (geoname_id);
-CREATE INDEX IF NOT EXISTS city_locations_geoname_id_idx ON city_locations (geoname_id);
-
-- 3) 조인 뷰와 조회 함수 (local table 기반)
-CREATE OR REPLACE VIEW city_block_locations AS
-SELECT
-  b.network,
-  l.country_iso_code,
-  l.country_name,
-  l.subdivision_1_iso_code AS region_iso_code,
-  l.subdivision_1_name AS region_name,
-  l.city_name,
-  b.latitude,
-  b.longitude,
-  b.time_zone,
-  b.accuracy_radius,
-  b.metro_code
-FROM city_blocks b
-LEFT JOIN city_locations l USING (geoname_id);
+CREATE INDEX IF NOT EXISTS city_lookup_network_gist ON city_lookup USING gist (network inet_ops);
+CREATE INDEX IF NOT EXISTS city_lookup_geoname_id_idx ON city_lookup (geoname_id);

 CREATE OR REPLACE FUNCTION lookup_city(ip inet)
 RETURNS TABLE (
    ip inet,
    country text,
-    country_iso_code text,
    region text,
-    region_iso_code text,
    city text,
    latitude double precision,
-    longitude double precision,
-    time_zone text
-) LANGUAGE sql IMMUTABLE AS $$
+    longitude double precision
+) LANGUAGE sql STABLE AS $$
    SELECT
        $1::inet AS ip,
-        c.country_name AS country,
-        c.country_iso_code,
-        c.region_name AS region,
-        c.region_iso_code,
-        c.city_name AS city,
+        c.country,
+        c.region,
+        c.city,
        c.latitude,
-        c.longitude,
-        c.time_zone
-    FROM city_block_locations c
+        c.longitude
+    FROM city_lookup c
    WHERE c.network >>= $1
    ORDER BY masklen(c.network) DESC
    LIMIT 1;
--- a/deploy/postgres/init/01_tuning.sql
+++ b/deploy/postgres/init/01_tuning.sql
@@ -0,0 +1,2 @@
+-- Reduce checkpoint churn during bulk MMDB load
+ALTER SYSTEM SET max_wal_size = '4GB';
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,35 +1,58 @@
 services:
-  postgres:
-    build:
-      context: .
-      dockerfile: Dockerfile.postgres
-    environment:
-      - POSTGRES_DB=geoip
-      - POSTGRES_USER=geoip_admin
-      - POSTGRES_PASSWORD=geoip_admin
-    ports:
-      - "5432:5432"
-    volumes:
-      - pgdata:/var/lib/postgresql/data
-      - ./GeoLite2-City.mmdb:/data/GeoLite2-City.mmdb:ro
-      - ./deploy/postgres/init:/docker-entrypoint-initdb.d:ro
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U geoip_admin -d geoip"]
-      interval: 5s
-      timeout: 5s
-      retries: 5
-
  api:
    build: .
+    env_file:
+      - .env
    depends_on:
-      postgres:
+      db:
        condition: service_healthy
    ports:
-      - "8080:8080"
+      - "${PORT:-8080}:8080"
    environment:
-      - PORT=8080
-      - GEOIP_BACKEND=postgres
-      - DATABASE_URL=postgres://geoip_readonly:geoip_readonly@postgres:5432/geoip?sslmode=disable
-      - GEOIP_DB_PATH=/data/GeoLite2-City.mmdb
+      - PORT=${PORT:-8080}
+      - GEOIP_DB_PATH=${GEOIP_DB_PATH:-/data/GeoLite2-City.mmdb}
+      - GEOIP_BACKEND=${GEOIP_BACKEND:-mmdb}
+      - DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST:-db}:${POSTGRES_PORT:-5432}/${POSTGRES_DB}?sslmode=disable
+    command: >
+      sh -c '
+        if [ "${GEOIP_BACKEND}" = "postgres" ]; then
+          echo "[api] running geoip-loader before api start";
+          geoip-loader;
+        else
+          echo "[api] skipping geoip-loader (backend=${GEOIP_BACKEND})";
+        fi;
+        exec geoip
+      '
+    volumes:
+      - ./GeoLite2-City.mmdb:/data/GeoLite2-City.mmdb:ro
+    networks:
+      - geo-ip
+    
+  db:
+    image: postgres:17.7-trixie
+    env_file:
+      - .env
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+    ports:
+      - "${POSTGRES_PORT:-5432}:5432"
+    volumes:
+      - ./GeoLite2-City.mmdb:/data/GeoLite2-City.mmdb:ro
+      - ./deploy/postgres/init:/docker-entrypoint-initdb.d:ro
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    networks:
+      - geo-ip
+
 volumes:
-  pgdata:
+  postgres_data:
+
+networks:
+  geo-ip:
--- a/internal/geo/resolver_postgres_test.go
+++ b/internal/geo/resolver_postgres_test.go
@@ -0,0 +1,30 @@
+package geo
+
+import (
+	"os"
+	"testing"
+)
+
+func TestPostgresResolverLookup(t *testing.T) {
+	dsn := os.Getenv("GEOIP_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("GEOIP_TEST_DATABASE_URL not set; skipping Postgres integration test")
+	}
+
+	resolver, err := NewResolver(Config{
+		Backend:     BackendPostgres,
+		DatabaseURL: dsn,
+	})
+	if err != nil {
+		t.Fatalf("failed to init postgres resolver: %v", err)
+	}
+	defer resolver.Close()
+
+	loc, err := resolver.Lookup("1.1.1.1")
+	if err != nil {
+		t.Fatalf("lookup failed: %v", err)
+	}
+	if loc.IP == "" {
+		t.Fatalf("expected resolved IP, got empty")
+	}
+}
--- a/to-do.md
+++ b/to-do.md
@@ -16,7 +16,15 @@
 - [x] 초기화 SQL을 `/docker-entrypoint-initdb.d/`로 넣어 `CREATE EXTENSION maxminddb_fdw; SERVER maxminddb ...` 정의, 필요한 `FOREIGN TABLE`/`VIEW` 설계 (country/region/city/lat/lon/time_zone 등)
 - [x] FDW 기반 조회 최적화를 위한 `inet` 인자 함수/VIEW 설계(예: `SELECT * FROM city_location WHERE network >>= inet($1) ORDER BY masklen(network) DESC LIMIT 1`)
 - [x] 앱 구성 확장: `GEOIP_BACKEND=mmdb|postgres`, `DATABASE_URL` 등 env 추가, `internal/geo`에 Postgres resolver 구현 및 DI로 선택 연결, 시작 시 backend/DB 헬스 체크 로그
+- [ ] Postgres 컨테이너에 GeoLite mmdb 및 init SQL 디렉터리 마운트 추가 반영 후 compose.infra.yml/dev 실행 경로 검증
+- [x] docker-compose 단일 스택에서 db healthcheck 추가 후 api가 service_healthy 상태를 기다리도록 depends_on 조건 설정
 - [ ] Fiber 라우트에서 DB resolver와 파일 resolver가 동일한 응답 스키마를 반환하도록 리스폰스 변환/에러 핸들링 정리
 - [ ] 테스트: 파일 기반은 그대로 유지, DB resolver용 통합 테스트(테스트 컨테이너/compose) 및 테이블 기반 케이스 추가; 라이선스 문제 없이 쓸 수 있는 mmdb 픽스처 고려
 - [ ] 문서화: README에 Postgres/FDW 실행 방법, 샘플 쿼리, 보안/포트 노출 주의사항, mmdb 교체 절차 추가
 - [x] `go mod tidy` 재실행으로 의존성 정리 및 필요한 DB 드라이버 추가
+- [ ] `maxminddb_fdw` 제거 후 mmdb -> Postgres 적재 파이프라인 설계: mmdb SHA256을 테이블에 기록해 변경 시에만 스테이징 로드+인덱스 생성 후 트랜잭션 rename으로 교체, 변경 없으면 스킵
+- [ ] `maxminddb_fdw` 제거 후 mmdb -> Postgres 적재 파이프라인 설계: Go 기반 변환기로 스테이징 테이블에 로드하고 트랜잭션 rename으로 다운타임 없이 교체, 업데이트 주기/운영 방법 정의
+- [ ] 시행착오 기록: maxminddb-golang v1.11.0은 `reader.Networks()`가 에러를 반환하지 않는 단일 반환 함수임. `reader.Networks(0)`/다중 반환 처리 금지 (재시도하지 말 것)
+- [ ] compose에서 loader 단독 서비스 제거, api entrypoint에서 loader 실행 → post-start 훅으로 문서화 및 대기 전략 검토
+- [ ] Postgres 초기 설정 튜닝: `max_wal_size`를 4GB로 확대해 초기 bulk load 시 checkpoint 난발 방지 (deploy/postgres/init/01_tuning.sql 반영)
+- [ ] compose에서 api가 loader 완료 대기 때문에 기동 지연됨 → loader `service_started` 조건으로 완화, 향후 API 기동/데이터 적재 병행 여부 문서화 필요