From 7e70b8d6a19839d9abcdbd4f864cadfc23c19ddd Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sun, 9 Aug 2026 02:11:35 +0200
Subject: [PATCH] Reserve apps-pg role and database for coulomb-social

Managed role coulomb_social with passwordSecret
coulomb-social-app-credentials; Database CR coulomb_social_db.
Activates when apps-pg cluster is deployed.
---
 helm/apps-pg-cluster.yaml   |  6 ++++++
 helm/apps-pg-databases.yaml | 17 +++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/helm/apps-pg-cluster.yaml b/helm/apps-pg-cluster.yaml
index 7d9ecdb..5224d81 100644
--- a/helm/apps-pg-cluster.yaml
+++ b/helm/apps-pg-cluster.yaml
@@ -45,6 +45,12 @@ spec:
         login: true
         passwordSecret:
           name: vergabe-app-credentials
+      - name: coulomb_social             # CSOC-WP-0002 (coulomb-social)
+
+        ensure: present
+        login: true
+        passwordSecret:
+          name: coulomb-social-app-credentials
   # HA replica + connection pooler are deferred (RAILIANCE-WP-0003 Notes):
   #   services:
   #     additional:
diff --git a/helm/apps-pg-databases.yaml b/helm/apps-pg-databases.yaml
index 73e7ebf..afb28a7 100644
--- a/helm/apps-pg-databases.yaml
+++ b/helm/apps-pg-databases.yaml
@@ -19,3 +19,20 @@ spec:
   name: vergabe_db
   owner: vergabe
   ensure: present
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: coulomb-social-db                  # CSOC-WP-0002
+  namespace: databases
+  labels:
+    app.kubernetes.io/name: apps-pg
+    app.kubernetes.io/component: database-instance
+    railiance.io/layer: s3-platform
+    railiance.io/consumer: coulomb-social
+spec:
+  cluster:
+    name: apps-pg
+  name: coulomb_social_db
+  owner: coulomb_social
+  ensure: present