[shipmill-romamo]

Spec for #81: docs/specs/006-standalone-postgresql.md, a PostgreSQL Service with no application Cloudfall deploys.

• A database entry names exactly one of application or owner; an owner role is created by Cloudfall and its password comes from the existing sops secrets store through passwordRef (names and a SHA-256 in the record, never the value)
• Optional remoteAccess (a listen address plus allowed-source CIDRs) maps to hostssl lines in pg_hba.conf and source-restricted nftables rules; absent means loopback only, and validation refuses it on a server with no firewall or with an open source
• Backups, the restore drill and data copy key on the database name today, so they work unchanged for an owner database
• Configs that validate today validate and render byte-identically
• Out of scope: pooling, replication, a CA-verified certificate, and restoring the guide's app-elsewhere path (after a proving run)

Merging this PR approves the spec.

🤖 Generated with Claude Code

[shipmill-romamo]

@romamo Decision needed: do you approve this spec as written? Merging a spec is its approval (the spec gate), so shipmill holds it for your review instead of merging it on green CI.

1. Approve (recommended once you've read it): merge it yourself, or reply "1" and shipmill merges it on the next tick, then splits it into build issues and starts the build
2. Request changes: reply or review with what to change; shipmill revises the spec in this PR and asks again
3. Refuse: close the PR; the issue reads SPEC_REFUSED and triage decides again (postpone or won't fix)

Reply here with a number or your own answer; shipmill takes this up on the tick after your reply.