From 1add377fb7062f7061d68c2d01f20669b5776bb2 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Mon, 19 Oct 2026 08:50:17 +0200
Subject: [PATCH] Remove legacy Kubernetes CD bootstrap

---
 ci-deployer.yaml        |  88 -----------
 create-ci-kubeconfig.sh |  50 ------
 phppgadmin.yaml         | 333 ----------------------------------------
 3 files changed, 471 deletions(-)
 delete mode 100644 ci-deployer.yaml
 delete mode 100755 create-ci-kubeconfig.sh
 delete mode 100644 phppgadmin.yaml

diff --git a/ci-deployer.yaml b/ci-deployer.yaml
deleted file mode 100644
index 1fd818f..0000000
--- a/ci-deployer.yaml
+++ /dev/null
@@ -1,88 +0,0 @@
-# Bootstrap this file once with an administrator identity. CI can update only
-# the existing phpPgAdmin resources and cannot call the Kubernetes Secrets API.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: phppgadmin-deployer
-  namespace: default
-automountServiceAccountToken: false
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: phppgadmin-deployer
-  namespace: default
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    resourceNames:
-      - phppgadmin-config
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    resourceNames:
-      - phppgadmin
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-    resourceNames:
-      - phppgadmin
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-    resourceNames:
-      - phppgadmin
-    verbs:
-      - get
-      - patch
-      - update
-  - apiGroups:
-      - traefik.io
-    resources:
-      - middlewares
-    resourceNames:
-      - phppgadmin-root-redirect
-    verbs:
-      - get
-      - patch
-      - update
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: phppgadmin-deployer
-  namespace: default
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: phppgadmin-deployer
-subjects:
-  - kind: ServiceAccount
-    name: phppgadmin-deployer
-    namespace: default
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: phppgadmin-deployer-token
-  namespace: default
-  annotations:
-    kubernetes.io/service-account.name: phppgadmin-deployer
-type: kubernetes.io/service-account-token
diff --git a/create-ci-kubeconfig.sh b/create-ci-kubeconfig.sh
deleted file mode 100755
index 1becd0c..0000000
--- a/create-ci-kubeconfig.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-project_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
-namespace=${NAMESPACE:-default}
-service_account=${SERVICE_ACCOUNT:-phppgadmin-deployer}
-secret=${TOKEN_SECRET:-phppgadmin-deployer-token}
-
-[[ $(kubectl config current-context) == kubernetes-admin@kubernetes ]] || { echo "Wrong Kubernetes context" >&2; exit 1; }
-kubectl apply --dry-run=server --filename "${project_dir}/ci-deployer.yaml" >&2
-kubectl apply --filename "${project_dir}/ci-deployer.yaml" >&2
-
-for attempt in {1..30}; do
-  if kubectl --namespace "${namespace}" get secret "${secret}" \
-      --output=jsonpath='{.data.token}' 2>/dev/null | grep -q .; then
-    break
-  fi
-  if [[ "${attempt}" == 30 ]]; then
-    echo "Timed out waiting for the service-account token" >&2
-    exit 1
-  fi
-  sleep 1
-done
-
-workdir=$(mktemp --directory)
-trap 'rm -rf "${workdir}"' EXIT
-
-server=$(kubectl config view --minify --output=jsonpath='{.clusters[0].cluster.server}')
-kubectl --namespace "${namespace}" get secret "${secret}" \
-  --output=jsonpath='{.data.ca\.crt}' | base64 --decode > "${workdir}/ca.crt"
-token=$(kubectl --namespace "${namespace}" get secret "${secret}" \
-  --output=jsonpath='{.data.token}' | base64 --decode)
-
-export KUBECONFIG="${workdir}/config"
-kubectl config set-cluster cluster \
-  --server="${server}" \
-  --certificate-authority="${workdir}/ca.crt" \
-  --embed-certs=true >/dev/null
-kubectl config set-credentials "${service_account}" --token="${token}" >/dev/null
-kubectl config set-context phppgadmin \
-  --cluster=cluster \
-  --user="${service_account}" \
-  --namespace="${namespace}" >/dev/null
-kubectl config use-context phppgadmin >/dev/null
-
-echo "Store the following single line as the Gitea Actions secret KUBE_CONFIG_BASE64." >&2
-echo "Treat it as a password; do not commit it." >&2
-base64 --wrap=0 "${KUBECONFIG}"
-printf '\n'
diff --git a/phppgadmin.yaml b/phppgadmin.yaml
deleted file mode 100644
index de519a6..0000000
--- a/phppgadmin.yaml
+++ /dev/null
@@ -1,333 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: phppgadmin-config
-  namespace: default
-  labels:
-    app.kubernetes.io/name: phppgadmin
-data:
-  config.inc.php: |
-    <?php
-
-    /**
-     * Central phpPgAdmin configuration.  As a user you may modify the
-     * settings here for your particular configuration.
-     *
-     * $Id: config.inc.php-dist,v 1.55 2008/02/18 21:10:31 xzilla Exp $
-     */
-
-    // An example server.  Create as many of these as you wish,
-    // indexed from zero upwards.
-
-    // Display name for the server on the login screen
-    $conf['servers'][0]['desc'] = 'arschrock';
-
-    // Hostname or IP address for server.  Use '' for UNIX domain socket.
-    // use 'localhost' for TCP/IP connection on this computer
-    $conf['servers'][0]['host'] = 'arschrock';
-
-    // Database port on server (5432 is the PostgreSQL default)
-    $conf['servers'][0]['port'] = 5432;
-
-    // Database SSL mode
-    // Possible options: disable, allow, prefer, require
-    // To require SSL on older servers use option: legacy
-    // To ignore the SSL mode, use option: unspecified
-    $conf['servers'][0]['sslmode'] = 'allow';
-
-    // Change the default database only if you cannot connect to template1.
-    // For a PostgreSQL 8.1+ server, you can set this to 'postgres'.
-    $conf['servers'][0]['defaultdb'] = 'template1';
-
-    // Specify the path to the database dump utilities for this server.
-    // You can set these to '' if no dumper is available.
-    $conf['servers'][0]['pg_dump_path'] = '/usr/bin/pg_dump';
-    $conf['servers'][0]['pg_dumpall_path'] = '/usr/bin/pg_dumpall';
-
-    $conf['servers'][1]['desc'] = 'nextcloud-postgresql.nextcloud.svc.cluster.local';
-    $conf['servers'][1]['host'] = 'nextcloud-postgresql.nextcloud.svc.cluster.local';
-    $conf['servers'][1]['port'] = 5432;
-    $conf['servers'][1]['sslmode'] = 'allow';
-    $conf['servers'][1]['defaultdb'] = 'template1';
-
-    $conf['servers'][2]['desc'] = 'postgresql.default.svc.cluster.local';
-    $conf['servers'][2]['host'] = 'postgresql.default.svc.cluster.local';
-    $conf['servers'][2]['port'] = 5432;
-    $conf['servers'][2]['sslmode'] = 'allow';
-    $conf['servers'][2]['defaultdb'] = 'template1';
-
-    $conf['servers'][3]['desc'] = 'postgresql.authentik.svc.cluster.local';
-    $conf['servers'][3]['host'] = 'postgresql.authentik.svc.cluster.local';
-    $conf['servers'][3]['port'] = 5432;
-    $conf['servers'][3]['sslmode'] = 'allow';
-    $conf['servers'][3]['defaultdb'] = 'template1';
-
-    $conf['servers'][4]['desc'] = 'postgresql.gramps.svc.cluster.local';
-    $conf['servers'][4]['host'] = 'postgresql.gramps.svc.cluster.local';
-    $conf['servers'][4]['port'] = 5432;
-    $conf['servers'][4]['sslmode'] = 'allow';
-    $conf['servers'][4]['defaultdb'] = 'template1';
-
-    $conf['servers'][5]['desc'] = 'postgresql.matrix.svc.cluster.local';
-    $conf['servers'][5]['host'] = 'postgresql.matrix.svc.cluster.local';
-    $conf['servers'][5]['port'] = 5432;
-    $conf['servers'][5]['sslmode'] = 'allow';
-    $conf['servers'][5]['defaultdb'] = 'template1';
-
-    /* Groups definition */
-    /* Groups allow administrators to logicaly group servers together under
-     * group nodes in the left browser tree
-     *
-     * The group '0' description
-     */
-    //$conf['srv_groups'][0]['desc'] = 'group one';
-
-    /* Add here servers indexes belonging to the group '0' separated by comma */
-    //$conf['srv_groups'][0]['servers'] = '0,1,2';
-
-    /* A server can belong to multi groups. Here server 1 is referenced in both
-     * 'group one' and 'group two'*/
-    //$conf['srv_groups'][1]['desc'] = 'group two';
-    //$conf['srv_groups'][1]['servers'] = '3,1';
-
-    /* A group can be nested in one or more existing groups using the 'parents'
-     * parameter. Here the group 'group three' contains only one server and will
-     * appear as a subgroup in both 'group one' and 'group two':
-     */
-    //$conf['srv_groups'][2]['desc'] = 'group three';
-    //$conf['srv_groups'][2]['servers'] = '4';
-    //$conf['srv_groups'][2]['parents'] = '0,1';
-
-    /* Warning: Only groups with no parents appears at the root of the tree. */
-
-    /* You can apply specific theme depending on servers, users and databases
-     * The priority order is :
-     *   * the theme defined for a server
-     *   * the theme defined for a database apply over the server one
-     *   * the theme defined for a user apply over the database one
-     */
-    /* Example for servers */
-    //$conf['servers'][0]['theme']['default'] = 'default';
-    /* Example for users */
-    //$conf['servers'][0]['theme']['user']['specific_user'] = 'default';
-    /* Example for databases */
-    //$conf['servers'][0]['theme']['db']['specific_db'] = 'default';
-
-    // Default language. E.g.: 'english', 'polish', etc.  See lang/ directory
-    // for all possibilities. If you specify 'auto' (the default) it will use
-    // your browser preference.
-    $conf['default_lang'] = 'auto';
-
-    // If extra session security is true, then PHP's session cookies will have
-    // SameSite cookie flags set to prevent CSRF attacks.  If you're using
-    // auto-start sessions, autostarted sessions will be destroyed and
-    // restarted with SameSite on.  If this this solution is not acceptable for
-    // your situation, you will need to either turn off auot-start sessions, or
-    // turn off secure sessions.  Versions of PHP below 7.3 do not have access
-    // to this feature and will be vulnerable to CSRF attacks.
-    $conf['extra_session_security'] = true;
-
-    // AutoComplete uses AJAX interaction to list foreign key values
-    // on insert fields. It currently only works on single column
-    // foreign keys. You can choose one of the following values:
-    // 'default on' enables AutoComplete and turns it on by default.
-    // 'default off' enables AutoComplete but turns it off by default.
-    // 'disable' disables AutoComplete.
-    $conf['autocomplete'] = 'default on';
-
-    // If extra login security is true, then logins via phpPgAdmin with no
-    // password or certain usernames (pgsql, postgres, root, administrator)
-    // will be denied. Only set this false once you have read the FAQ and
-    // understand how to change PostgreSQL's pg_hba.conf to enable
-    // passworded local connections.
-    $conf['extra_login_security'] = true;
-
-    // Only show owned databases?
-    // Note: This will simply hide other databases in the list - this does
-    // not in any way prevent your users from seeing other database by
-    // other means. (e.g. Run 'SELECT * FROM pg_database' in the SQL area.)
-    $conf['owned_only'] = false;
-
-    // Display comments on objects?  Comments are a good way of documenting
-    // a database, but they do take up space in the interface.
-    $conf['show_comments'] = true;
-
-    // Display "advanced" objects? Setting this to true will show
-    // aggregates, types, operators, operator classes, conversions,
-    // languages and casts in phpPgAdmin. These objects are rarely
-    // administered and can clutter the interface.
-    $conf['show_advanced'] = false;
-
-    // Display "system" objects?
-    $conf['show_system'] = false;
-
-    // Minimum length users can set their password to.
-    $conf['min_password_length'] = 1;
-
-    // Width of the left frame in pixels (object browser)
-    $conf['left_width'] = 200;
-
-    // Which look & feel theme to use
-    $conf['theme'] = 'default';
-
-    // Show OIDs when browsing tables?
-    // Only supported in versions <=11
-    $conf['show_oids'] = false;
-
-    // Max rows to show on a page when browsing record sets
-    $conf['max_rows'] = 30;
-
-    // Max chars of each field to display by default in browse mode
-    $conf['max_chars'] = 50;
-
-    // Send XHTML strict headers?
-    $conf['use_xhtml_strict'] = false;
-
-    // Base URL for PostgreSQL documentation.
-    // '%s', if present, will be replaced with the PostgreSQL version
-    // (e.g. 8.4 )
-    $conf['help_base'] = 'http://www.postgresql.org/docs/%s/interactive/';
-
-    // Configuration for ajax scripts
-    // Time in seconds. If set to 0, refreshing data using ajax will be disabled (locks and activity pages)
-    $conf['ajax_refresh'] = 3;
-
-    /** Plugins management
-     * Add plugin names to the following array to activate them
-     * Example:
-     *   $conf['plugins'] = array(
-     *     'Example',
-     *     'Slony'
-     *   );
-     */
-    $conf['plugins'] = array();
-
-    /*****************************************
-     * Don't modify anything below this line *
-     *****************************************/
-
-    $conf['version'] = 19;
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: phppgadmin
-  namespace: default
-  labels:
-    app: phppgadmin
-    app.kubernetes.io/name: phppgadmin
-spec:
-  replicas: 1
-  revisionHistoryLimit: 3
-  minReadySeconds: 5
-  progressDeadlineSeconds: 600
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 0
-      maxSurge: 1
-  selector:
-    matchLabels:
-      app: phppgadmin
-  template:
-    metadata:
-      annotations:
-        deployment.brunner.ninja/revision: manual
-      labels:
-        app: phppgadmin
-        app.kubernetes.io/name: phppgadmin
-    spec:
-      automountServiceAccountToken: false
-      terminationGracePeriodSeconds: 30
-      containers:
-        - name: phppgadmin
-          # CI replaces latest with the immutable source commit tag on main.
-          image: registry.brunner.ninja/feedc0de/phppgadmin:latest
-          imagePullPolicy: Always
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          startupProbe:
-            httpGet:
-              path: /phppgadmin/
-              port: http
-            periodSeconds: 2
-            timeoutSeconds: 2
-            failureThreshold: 60
-          readinessProbe:
-            httpGet:
-              path: /phppgadmin/
-              port: http
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 2
-          livenessProbe:
-            httpGet:
-              path: /phppgadmin/
-              port: http
-            periodSeconds: 15
-            timeoutSeconds: 3
-            failureThreshold: 3
-          volumeMounts:
-            - name: phppgadmin-config
-              mountPath: /etc/phppgadmin/config.inc.php
-              subPath: config.inc.php
-      volumes:
-        - name: phppgadmin-config
-          configMap:
-            name: phppgadmin-config
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: phppgadmin
-  namespace: default
-  labels:
-    app: phppgadmin
-    app.kubernetes.io/name: phppgadmin
-spec:
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: phppgadmin
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: phppgadmin
-  namespace: default
-  labels:
-    app.kubernetes.io/name: phppgadmin
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.middlewares: default-phppgadmin-root-redirect@kubernetescrd
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: phppgadmin.brunner.ninja
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: phppgadmin
-                port:
-                  name: http
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: phppgadmin-root-redirect
-  namespace: default
-  labels:
-    app.kubernetes.io/name: phppgadmin
-spec:
-  redirectRegex:
-    regex: ^https://phppgadmin\.brunner\.ninja/?$
-    replacement: https://phppgadmin.brunner.ninja/phppgadmin/
-    permanent: true