[rushtong]

Addresses

https://broadworkbench.atlassian.net/browse/DT-4348

Stacked PRs (merge in order):

1. [DT-4348][risk=no] Render the local certs with render-configs.sh (1/5) #3177 Base and certs
2. [DT-4348][risk=no] Render consent.yaml, site.conf and oauth2.conf from terra-helmfile (2/5) #3178 Chart configs
3. [DT-4348][risk=no] Render the local compose files and .env (3/5) #3179 Compose
4. [DT-4348][risk=no] Export the dev database and fill the local index (4/5) #3180 Dump and index ← this PR
5. [DT-4348][risk=no] Render the local config in the Dev Container (5/5) #3181 Dev Container

Summary

Adds a database dump from dev (or staging) and fills the local Elasticsearch index.

• scripts/export-db.sh: runs the Cloud SQL proxy and pg_dump (from postgres:16.14-alpine, the same image as the local database) as containers on a temporary Docker network. The proxy publishes no ports. The token and the password go to Docker as environment variables, not on a command line. The dump is --no-owner --no-privileges, gzipped, and checked for the dump complete line before it moves into place. Only the newest dump stays. --db_env prod is refused before the script reads a secret.
• scripts/index-es.sh: calls POST /api/dataset/index through the local proxy with a gcloud token, and fails on a non-2xx status, an empty or non-JSON body, Error indexing datasets, or "errors": true in the bulk response.
• render-configs.sh: adds --export_db and --db_env. --all makes a dump only when there is none.
• scripts/db-connect.sh: moves to cloud-sql-proxy v2, on port 5433, because the local database publishes 5432.
• DEVNOTES.md: "Database dump" and "Elasticsearch index" sections. The reload command uses rm -sfv, so the old data volume, which holds a copy of the old dump, goes too.

Testing

• A stub run of --all true with a dump present skips the export. --db_env prod stops at once.
• Not tested: a real export and index-es.sh (need the VPN and a running stack). This PR must record the time of a full dev dump.

---

Have you read CONTRIBUTING.md lately? If not, do that first.

• Label PR with a Jira ticket number and include a link to the ticket
• Label PR with a security risk modifier [no, low, medium, high]
• PR describes scope of changes
• Get a minimum of one thumbs worth of review, preferably two if enough team members are available
• Get PO sign-off for all non-trivial UI or workflow changes
• Verify all tests go green
• Test this change deployed correctly and works on dev environment after deployment

🤖 Generated with Claude Code