feat(apps): Add pgweb

2026-10-10 12:23:13 +05:30
parent 1a104cb0c5
commit 390c2e332d
20 changed files with 347 additions and 0 deletions
@@ -24,6 +24,13 @@ spec:
        name: legislative
        passwordSecret:
          name: legislative-db
+      - ensure: present
+        inRoles:
+          - pg_read_all_data
+        login: true
+        name: pgweb
+        passwordSecret:
+          name: pgweb-db
      - ensure: present
        login: true
        name: redoost
@@ -31,8 +38,12 @@ spec:
          name: redoost-db
  postgresql:
    # Each app role may only connect to the database of the same name.
+    # pgweb is read-only and may browse every database except authentik's,
+    # which holds credentials and session tokens.
    pg_hba:
      - host sameuser all all scram-sha-256
+      - host authentik pgweb all reject
+      - host all pgweb all scram-sha-256
      - host all all all reject
  resources:
    limits: