Add Terraform-managed Postgres DB secret for pal-e-docs namespace #23

Merged

forgejo_admin merged 2 commits from 22-paledocs-db-secret into main

2026-03-06 17:30:02 +00:00

forgejo_admin commented

2026-03-06 17:17:09 +00:00

Owner

Summary

Creates a kubernetes_secret_v1.paledocs_db_url resource in the pal-e-docs namespace containing the DATABASE_URL for the paledocs Postgres user
Adds the corresponding paledocs_db_password sensitive variable
Follows the established pattern used by cnpg_s3_creds

Changes

terraform/variables.tf -- added paledocs_db_password variable (type = string, sensitive = true)
terraform/main.tf -- added kubernetes_secret_v1.paledocs_db_url resource in the CNPG section, after cnpg_s3_creds

Test Plan

tofu fmt -check passes
tofu validate passes
tofu plan shows only the new secret resource (1 to add, 0 to change, 0 to destroy)
After apply, verify: kubectl get secret paledocs-db-url -n pal-e-docs -o jsonpath='{.data.DATABASE_URL}' | base64 -d
Lucas must add paledocs_db_password to k3s.tfvars before applying

tofu plan output (targeted)

  # kubernetes_secret_v1.paledocs_db_url will be created
  + resource "kubernetes_secret_v1" "paledocs_db_url" {
      + data                           = (sensitive value)
      + id                             = (known after apply)
      + type                           = "Opaque"
      + wait_for_service_account_token = true

      + metadata {
          + generation       = (known after apply)
          + name             = "paledocs-db-url"
          + namespace        = "pal-e-docs"
          + resource_version = (known after apply)
          + uid              = (known after apply)
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Review Checklist

Passed automated review-fix loop
No secrets committed
No unnecessary file changes
Commit messages are descriptive

plan-2026-02-26-tf-modularize-postgres -- Phase 3, Part A
Forgejo issue: #22

## Summary - Creates a `kubernetes_secret_v1.paledocs_db_url` resource in the `pal-e-docs` namespace containing the `DATABASE_URL` for the paledocs Postgres user - Adds the corresponding `paledocs_db_password` sensitive variable - Follows the established pattern used by `cnpg_s3_creds` ## Changes - `terraform/variables.tf` -- added `paledocs_db_password` variable (`type = string`, `sensitive = true`) - `terraform/main.tf` -- added `kubernetes_secret_v1.paledocs_db_url` resource in the CNPG section, after `cnpg_s3_creds` ## Test Plan - [x] `tofu fmt -check` passes - [x] `tofu validate` passes - [x] `tofu plan` shows only the new secret resource (1 to add, 0 to change, 0 to destroy) - [ ] After apply, verify: `kubectl get secret paledocs-db-url -n pal-e-docs -o jsonpath='{.data.DATABASE_URL}' | base64 -d` - [ ] Lucas must add `paledocs_db_password` to `k3s.tfvars` before applying ### tofu plan output (targeted) ``` # kubernetes_secret_v1.paledocs_db_url will be created + resource "kubernetes_secret_v1" "paledocs_db_url" { + data = (sensitive value) + id = (known after apply) + type = "Opaque" + wait_for_service_account_token = true + metadata { + generation = (known after apply) + name = "paledocs-db-url" + namespace = "pal-e-docs" + resource_version = (known after apply) + uid = (known after apply) } } Plan: 1 to add, 0 to change, 0 to destroy. ``` ## Review Checklist - [x] Passed automated review-fix loop - [x] No secrets committed - [x] No unnecessary file changes - [x] Commit messages are descriptive ## Related Notes - `plan-2026-02-26-tf-modularize-postgres` -- Phase 3, Part A - Forgejo issue: #22

forgejo_admin added 1 commit

2026-03-06 17:17:09 +00:00

Add Terraform-managed Postgres DB secret for pal-e-docs namespace 8c0bf79843

Creates kubernetes_secret_v1.paledocs_db_url containing the DATABASE_URL
for the paledocs user to connect to the CNPG cluster cross-namespace.
Follows the established pattern used by cnpg_s3_creds.

Closes #22

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

forgejo_admin referenced this pull request

2026-03-06 17:21:33 +00:00

Create Terraform-managed Postgres DB secret for pal-e-docs namespace #22

forgejo_admin added 1 commit

2026-03-06 17:23:22 +00:00

Use data source lookup for pal-e-docs namespace 7bb8e33ec3

Replace hardcoded namespace string with a data source reference to
match the pattern used by other secrets in main.tf. The namespace
is managed by pal-e-services, so a data lookup is appropriate.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

forgejo_admin referenced this pull request

2026-03-06 17:24:14 +00:00

Create Terraform-managed Postgres DB secret for pal-e-docs namespace #22

forgejo_admin merged commit d089872650 into main

2026-03-06 17:30:02 +00:00

forgejo_admin deleted branch 22-paledocs-db-secret

2026-03-06 17:30:02 +00:00

forgejo_admin referenced this pull request from a commit

2026-03-06 17:30:03 +00:00

Add Terraform-managed Postgres DB secret for pal-e-docs namespace (#23)

forgejo_admin referenced this pull request

2026-03-14 15:03:40 +00:00