phppgadmin-kubernetes/README.md

phpPgAdmin on Kubernetes

This repository builds the phpPgAdmin image and publishes its application-owned Helm chart. The chart owns the ConfigMap, Deployment, Service, probes, optional Ingress, and Traefik redirect Middleware. It is stateless and stores no database credentials or session data.

The homelab's live server list and Ingress hostname are in the separate homelab-gitops application. They contain endpoint names only; do not put PostgreSQL usernames or passwords in Git or chart values.

Image

The Dockerfile installs phpPgAdmin 7.14.7 on the shared registry.brunner.ninja/feedc0de/php-apache image. Main-branch CI publishes an immutable commit-tagged image and a chart whose appVersion selects that exact image. The chart's Git tag versions the chart independently.

Install

For the homelab, Argo CD is the only Kubernetes writer. Elsewhere, install from the public chart repository with your own values:

helm repo add brunner.ninja https://brunner.ninja/charts
helm repo update brunner.ninja
helm upgrade --install phppgadmin brunner.ninja/phppgadmin \
  --namespace default --create-namespace --wait --timeout 5m

To install the chart directly from a checkout, run ./chart/install.sh. Set VALUES_FILE to a cluster-specific values file when configuring server endpoints or Ingress.

The CI workflow needs QUAY_USERNAME and QUAY_TOKEN to publish its image, PACKAGE_USERNAME and PACKAGE_TOKEN to publish the chart, and GITOPS_TOKEN to promote the chart version in homelab-gitops. It has no Kubernetes credentials.

Validate locally with:

./test.sh

Internet exposure

The homelab instance is public and presents direct PostgreSQL login. Use long, unique database passwords, restrictive PostgreSQL roles and pg_hba.conf rules, TLS for remote database connections, and suitable external access controls. The chart retains phpPgAdmin's extra-login security defaults.