improve postgres support

README.md

@@ -101,6 +101,18 @@ The backfill command:
 - Rebuilds hourly/latest vCenter totals caches.
 - Recomputes daily/monthly rows for `vcenter_aggregate_totals` from registered summary snapshots.
 
+If you want a one-time SQLite-to-Postgres import and exit, use:
+
+```shell
+vctp -settings /path/to/vctp.yml -import-sqlite /path/to/legacy.sqlite3
+```
+
+The import command:
+- Requires `settings.database_driver: postgres`.
+- Copies data from the SQLite source into matching Postgres tables.
+- Auto-creates runtime tables (hourly/daily/monthly snapshot tables and cache tables) when needed.
+- Replaces existing data in imported Postgres tables during the run.
+
 ## Database Configuration
 By default the app uses SQLite and creates/opens `db.sqlite3`.
 
@@ -123,6 +135,56 @@ settings:
   database_url: postgres://user:pass@localhost:5432/vctp?sslmode=disable
 ```
 
+### Initial PostgreSQL Setup
+Create a dedicated PostgreSQL role and database (run as a PostgreSQL superuser):
+
+```sql
+CREATE ROLE vctp_user LOGIN PASSWORD 'change-this-password';
+CREATE DATABASE vctp OWNER vctp_user;
+```
+
+Connect to the new database and grant privileges required for migrations and runtime table/index management:
+
+```sql
+\c vctp
+GRANT CONNECT, TEMP ON DATABASE vctp TO vctp_user;
+GRANT USAGE, CREATE ON SCHEMA public TO vctp_user;
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO vctp_user;
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO vctp_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO vctp_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO vctp_user;
+```
+
+Recommended auth/network configuration:
+
+- Ensure PostgreSQL is listening on the expected interface/port in `postgresql.conf` (for example, `listen_addresses` and `port`).
+- Allow vCTP connections in `pg_hba.conf`. Example entries:
+
+```conf
+# local socket
+local   vctp   vctp_user                  scram-sha-256
+# TCP from application subnet
+host    vctp   vctp_user   10.0.0.0/24    scram-sha-256
+```
+
+- Reload/restart PostgreSQL after config changes (`SELECT pg_reload_conf();` or your service manager).
+- Ensure host firewall/network ACLs allow traffic to PostgreSQL (default `5432`).
+
+Example `vctp.yml` database settings:
+
+```yaml
+settings:
+  database_driver: postgres
+  enable_experimental_postgres: true
+  database_url: postgres://vctp_user:change-this-password@db-hostname:5432/vctp?sslmode=disable
+```
+
+Validate connectivity before starting vCTP:
+
+```shell
+psql "postgres://vctp_user:change-this-password@db-hostname:5432/vctp?sslmode=disable"
+```
+
 PostgreSQL migrations live in `db/migrations_postgres`, while SQLite migrations remain in
 `db/migrations`.