From 7849b6bb647b4a6aea46e804da4de9f1fbf9d6de Mon Sep 17 00:00:00 2001
From: Claude Bot <claude-bot@renner.uno>
Date: Wed, 22 Jul 2026 15:56:45 +0200
Subject: [PATCH] feat(woodpecker): cut server over to wp-pg postgres (#295,
 #324)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stage 2/3 of the sqlite->CNPG migration. Points woodpecker-server at the
wp-pg Postgres cluster (creds from the CNPG-generated wp-pg-app secret via a
lib/pq keyword DSN). The sqlite data was migrated one-time via pgloader
(schema-first/data-only, per seed/woodpecker/MIGRATION.md); parity verified
(all 18 tables match, booleans correct, sequences reset).

The sqlite PVC + volumeMount are intentionally KEPT for now (rollback = revert
these env vars) — they're dropped in stage 3 (StatefulSet->Deployment) after a
soak. Image stays v3.13.0 (no version bump during the migration).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 kubernetes/apps/woodpecker/server.yaml | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/kubernetes/apps/woodpecker/server.yaml b/kubernetes/apps/woodpecker/server.yaml
index e3288650..aad51123 100644
--- a/kubernetes/apps/woodpecker/server.yaml
+++ b/kubernetes/apps/woodpecker/server.yaml
@@ -12,7 +12,10 @@ metadata:
     secret.reloader.stakater.com/reload: woodpecker-secret
 spec:
   serviceName: woodpecker
-  replicas: 1 # SQLite => single writer.
+  # Backed by the wp-pg CNPG Postgres cluster (was sqlite-on-PVC, #295/#324).
+  # Kept at 1 replica: woodpecker-server isn't clustered, and the DB is now
+  # external so this is just the single control-plane instance.
+  replicas: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: woodpecker
@@ -60,10 +63,24 @@ spec:
             # (retired LXCs tracked in #199) has been superseded.
             - name: WOODPECKER_PLUGINS_PRIVILEGED
               value: woodpeckerci/plugin-docker-buildx
+            # Postgres on the wp-pg CNPG cluster (creds from the CNPG-generated
+            # wp-pg-app secret). lib/pq keyword DSN — robust to any special
+            # chars in the generated password (unlike a URL DSN). WP_DB_* must
+            # precede the DATASOURCE for k8s $(VAR) interpolation to resolve.
+            - name: WP_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: wp-pg-app
+                  key: username
+            - name: WP_DB_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: wp-pg-app
+                  key: password
             - name: WOODPECKER_DATABASE_DRIVER
-              value: sqlite3
+              value: postgres
             - name: WOODPECKER_DATABASE_DATASOURCE
-              value: "/var/lib/woodpecker/woodpecker.sqlite?_journal=WAL&_busy_timeout=10000&_synchronous=NORMAL"
+              value: "host=wp-pg-rw.apps.svc.cluster.local port=5432 user=$(WP_DB_USER) password=$(WP_DB_PASS) dbname=woodpecker sslmode=require"
           # AGENT_SECRET + GITEA_CLIENT + GITEA_SECRET come from the SOPS secret.
           envFrom:
             - secretRef:
-- 
2.54.0