feat: add PostgreSQL SSL support and /health

Author: DragonStuff

Dockerfile

@@ -48,6 +48,28 @@ RUN  \
 # Update CA Certs
 RUN update-ca-certificates
 
+# Copy AWS RDS certificate bundle for psql SSL connections
+COPY global-bundle.pem /etc/ssl/certs/aws-global-bundle.pem
+RUN chmod 644 /etc/ssl/certs/aws-global-bundle.pem
+
+# Configure SSL for postgres user to use the AWS CA bundle
+# This creates the .postgresql directory for the postgres user and sets up SSL config
+RUN mkdir -p /var/lib/postgresql/.postgresql && \
+    ln -s /etc/ssl/certs/aws-global-bundle.pem /var/lib/postgresql/.postgresql/root.crt && \
+    chown -R postgres:postgres /var/lib/postgresql/.postgresql && \
+    chmod 700 /var/lib/postgresql/.postgresql && \
+    chmod 644 /var/lib/postgresql/.postgresql/root.crt
+
+# Also set up for root user
+RUN mkdir -p /root/.postgresql && \
+    ln -s /etc/ssl/certs/aws-global-bundle.pem /root/.postgresql/root.crt && \
+    chmod 700 /root/.postgresql && \
+    chmod 644 /root/.postgresql/root.crt
+
+# Set default PostgreSQL client SSL mode to require (not require client certs)
+ENV PGSSLMODE=require
+ENV PGSSLROOTCERT=/etc/ssl/certs/aws-global-bundle.pem
+
 # Configure postgres.
 RUN true \
     && echo "host all all 0.0.0.0/0 md5" >> /etc/postgresql/16/main/pg_hba.conf \
@@ -85,6 +107,7 @@ COPY conf.d/postgres-tuning.conf /etc/postgresql/16/main/conf.d/
 COPY config.sh /app/config.sh
 COPY init.sh /app/init.sh
 COPY start.sh /app/start.sh
+COPY server.py /app/server.py
 
 # Collapse image to single layer.
 FROM scratch

README.md

@@ -20,6 +20,19 @@ docker run -it \
 
 After the import is complete, you can access the Nominatim API at `http://localhost:8080/search?q=avenue%20pasteur`.
 
+## Health Check Endpoint
+
+The service includes a health check endpoint at `/health` that always returns HTTP 200 with service status:
+
+```sh
+curl http://localhost:8080/health
+```
+
+Response:
+```json
+{"status":"online","service":"nominatim"}
+```
+
 ## Accessing Different Versions
 
 You can pull specific versions of the Nominatim Docker image by specifying the tag. For example, to use Nominatim version `5.2`: