fix: harden workspace registry installation docs

docs/install/examples/server-compose.workspace-registry.yaml

@@ -1,19 +1,27 @@
-# Server registry example. Copy to a reviewed, untracked operator directory and set host paths
-# and Git values in its .env. The core remains non-root (UID 10001) and never receives secrets
-# through the Git checkout.
+# Server registry example. Copy to a reviewed, untracked operator directory and set absolute host
+# paths and Git values in .env. Add a selected Git transport override from this directory.
 name: thothii-workspace-registry-server
 
 services:
   core:
     image: thothii-core:local
     build:
-      context: ../../..
+      context: ${THT_SOURCE_ROOT:?set THT_SOURCE_ROOT to the absolute ThothII source checkout}
       dockerfile: docker/core.Dockerfile
     environment:
       HOST: 0.0.0.0
       PORT: "8787"
       AUTH_MODE: upstream
       THOTH_PUBLIC_EXPOSURE: "true"
+      THT_SESSION_STORAGE: postgres
+      THT_CONFIG: /app/harness/workspaces/server-sessions.yaml
+      THT_SESSION_DB_HOST: ${THT_SESSION_DB_HOST:?set THT_SESSION_DB_HOST}
+      THT_SESSION_DB_PORT: ${THT_SESSION_DB_PORT:-5432}
+      THT_SESSION_DB_NAME: ${THT_SESSION_DB_NAME:?set THT_SESSION_DB_NAME}
+      THT_SESSION_RUNTIME_USER: ${THT_SESSION_RUNTIME_USER:?set THT_SESSION_RUNTIME_USER}
+      THT_SESSION_RUNTIME_PASSWORD_FILE: /run/secrets/session_runtime_password
+      THT_SESSION_DB_SSLMODE: ${THT_SESSION_DB_SSLMODE:-verify-full}
+      THT_SESSION_DB_SSLROOTCERT: /run/secrets/session_ca.pem
       THT_HARNESS_DIR: /app/harness
       THT_BIN: /opt/venv/bin/tht
       SETTINGS_FILE: /data/settings/settings.json
@@ -24,19 +32,15 @@ services:
       THT_WORKSPACE_GIT_AUTHOR_NAME: ${THT_WORKSPACE_GIT_AUTHOR_NAME:-Thoth Workspace Registry}
       THT_WORKSPACE_GIT_AUTHOR_EMAIL: ${THT_WORKSPACE_GIT_AUTHOR_EMAIL:-thoth-workspace-registry@localhost}
       THT_WORKSPACE_SECRET_ROOTS: /run/secrets
-      GIT_CONFIG_COUNT: "2"
-      GIT_CONFIG_KEY_0: credential.helper
-      GIT_CONFIG_VALUE_0: store --file=/run/secrets/workspace-registry-git-credentials
-      GIT_CONFIG_KEY_1: http.sslCAInfo
-      GIT_CONFIG_VALUE_1: /run/secrets/workspace-registry-git-ca
-      GIT_SSH_COMMAND: ssh -i /run/secrets/workspace-registry-git-ssh-key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/run/secrets/workspace-registry-git-known-hosts
     volumes:
       - ${THT_HOST_DATA_ROOT:-/srv/thothii/data}:/data
       - ${THT_WORKSPACE_REGISTRY_HOST_PATH:-/srv/thothii/workspace-registry}:/data/workspace-registry
-      - ${THT_WORKSPACE_GIT_CREDENTIALS_FILE:-/srv/thothii/secrets/git-credentials}:/run/secrets/workspace-registry-git-credentials:ro
-      - ${THT_WORKSPACE_GIT_CA_FILE:-/srv/thothii/secrets/git-ca.pem}:/run/secrets/workspace-registry-git-ca:ro
-      - ${THT_WORKSPACE_GIT_SSH_KEY_FILE:-/srv/thothii/secrets/git-ssh-key}:/run/secrets/workspace-registry-git-ssh-key:ro
-      - ${THT_WORKSPACE_GIT_KNOWN_HOSTS_FILE:-/srv/thothii/secrets/git-known-hosts}:/run/secrets/workspace-registry-git-known-hosts:ro
+      - ${THT_SERVER_WORKSPACE_CONFIG:?set THT_SERVER_WORKSPACE_CONFIG}:/app/harness/workspaces/server-sessions.yaml:ro
+    secrets:
+      - source: session_runtime_password
+        target: session_runtime_password
+      - source: session_ca
+        target: session_ca.pem
     networks:
       - portal
     restart: unless-stopped
@@ -45,3 +49,9 @@ networks:
   portal:
     external: true
     name: ${THT_PORTAL_NETWORK:-omics_portal_omics_network}
+
+secrets:
+  session_runtime_password:
+    file: ${THT_SESSION_RUNTIME_PASSWORD_SOURCE:?set THT_SESSION_RUNTIME_PASSWORD_SOURCE}
+  session_ca:
+    file: ${THT_SESSION_CA_SOURCE:?set THT_SESSION_CA_SOURCE}