/*
 * examples/pgserver_demo.prg — PostgreSQL-wire server example.
 *
 * Run this PRG to expose your Five workareas to any psql / pgx /
 * JDBC / DBeaver / Tableau client over TCP. The server speaks
 * PostgreSQL protocol v3 so existing PG drivers connect with no
 * client-side changes.
 *
 *   ./five build examples/pgserver_demo.prg _FiveSql2/src/*.prg \
 *      -o /tmp/pgserver
 *   /tmp/pgserver
 *
 * Then from another terminal:
 *   psql 'postgres://alice@127.0.0.1:5432/alice?sslmode=require' \
 *        -c "SELECT 1 AS one, 'hello' AS greet"
 *
 * Stop with Ctrl-C.
 */

PROCEDURE Main()

   /* TLS — auto-generate a self-signed cert for the demo.
    * Production deployments load a CA-signed pair via
    * PG_TLS_LOAD( "cert.pem", "key.pem" ). */
   PG_TLS_SELF_SIGNED( "/tmp/pg_cert.pem", "/tmp/pg_key.pem", "localhost" )

   /* Users — minimum one role to log in. Plaintext kept in
    * memory; production should source these from a secured
    * config file or vault. */
   PG_ADD_ROLE( "alice", "swordfish" )
   PG_ADD_ROLE( "bob",   "hunter2"   )

   /* Source-IP allowlist (pg_hba.conf equivalent). Skip
    * entirely to accept any source. */
   PG_ALLOW_IP( "127.0.0.1/32" )
   PG_ALLOW_IP( "::1/128" )

   /* Open the tables you want to expose. The server runs queries
    * against whatever workareas are open in the PRG process.
    * Uncomment as needed:
    *   USE customers SHARED NEW
    *   USE orders    SHARED NEW
    */

   /* Start — blocks. SPAWN this if you want to keep doing work
    * in the main thread:
    *   SPAWN {|| PG_SERVER_START( ":5432", "md5" ) }
    */
   ? "FiveSql2 PG-wire server starting on :5432"
   ? "Connect with: psql 'postgres://alice@127.0.0.1:5432/alice?sslmode=require'"
   PG_SERVER_START( ":5432", "md5" )

   RETURN