# phpPgAdmin on Kubernetes

This repository builds the phpPgAdmin image and publishes its application-owned
Helm chart. The chart owns the ConfigMap, Deployment, Service, probes, optional
Ingress, and Traefik redirect Middleware. It is stateless and stores no
database credentials or session data.

The homelab's live server list and Ingress hostname are in the separate
[homelab-gitops application](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/phppgadmin).
They contain endpoint names only; do not put PostgreSQL usernames or passwords
in Git or chart values.

## Image

The Dockerfile installs phpPgAdmin 7.14.7 on the shared
`registry.brunner.ninja/feedc0de/php-apache` image. Main-branch CI publishes an
immutable commit-tagged image and a chart whose `appVersion` selects that exact
image. The chart repository tag follows the bundled phpPgAdmin fork release:
`v7.14.7-mod` publishes chart `7.14.7-mod`; later chart commits append the Git
describe count and hash.

## Install

For the homelab, Argo CD is the only Kubernetes writer. Elsewhere, install from
the public chart repository with your own values:

```sh
helm repo add brunner.ninja https://brunner.ninja/charts
helm repo update brunner.ninja
helm upgrade --install phppgadmin brunner.ninja/phppgadmin \
  --namespace default --create-namespace --wait --timeout 5m
```

To install the chart directly from a checkout, run `./chart/install.sh`. Set
`VALUES_FILE` to a cluster-specific values file when configuring server
endpoints or Ingress.

The CI workflow needs `QUAY_USERNAME` and `QUAY_TOKEN` to publish its image,
`PACKAGE_USERNAME` and `PACKAGE_TOKEN` to publish the chart, and
`GITOPS_TOKEN` to promote the chart version in homelab-gitops. It has no
Kubernetes credentials.

Validate locally with:

```sh
./test.sh
```

## Internet exposure

The homelab instance is public and presents direct PostgreSQL login. Use long,
unique database passwords, restrictive PostgreSQL roles and `pg_hba.conf`
rules, TLS for remote database connections, and suitable external access
controls. The chart retains phpPgAdmin's extra-login security defaults.