55 lines
2.1 KiB
Markdown
55 lines
2.1 KiB
Markdown
# phpPgAdmin on Kubernetes
|
|
|
|
This repository builds the phpPgAdmin image and publishes its application-owned
|
|
Helm chart. The chart owns the ConfigMap, Deployment, Service, probes, optional
|
|
Ingress, and Traefik redirect Middleware. It is stateless and stores no
|
|
database credentials or session data.
|
|
|
|
The homelab's live server list and Ingress hostname are in the separate
|
|
[homelab-gitops application](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/phppgadmin).
|
|
They contain endpoint names only; do not put PostgreSQL usernames or passwords
|
|
in Git or chart values.
|
|
|
|
## Image
|
|
|
|
The Dockerfile installs phpPgAdmin 7.14.7 on the shared
|
|
`registry.brunner.ninja/feedc0de/php-apache` image. Main-branch CI publishes an
|
|
immutable commit-tagged image and a chart whose `appVersion` selects that exact
|
|
image. The chart repository tag follows the bundled phpPgAdmin fork release:
|
|
`v7.14.7-mod` publishes chart `7.14.7-mod`; later chart commits append the Git
|
|
describe count and hash.
|
|
|
|
## Install
|
|
|
|
For the homelab, Argo CD is the only Kubernetes writer. Elsewhere, install from
|
|
the public chart repository with your own values:
|
|
|
|
```sh
|
|
helm repo add brunner.ninja https://brunner.ninja/charts
|
|
helm repo update brunner.ninja
|
|
helm upgrade --install phppgadmin brunner.ninja/phppgadmin \
|
|
--namespace default --create-namespace --wait --timeout 5m
|
|
```
|
|
|
|
To install the chart directly from a checkout, run `./chart/install.sh`. Set
|
|
`VALUES_FILE` to a cluster-specific values file when configuring server
|
|
endpoints or Ingress.
|
|
|
|
The CI workflow needs `QUAY_USERNAME` and `QUAY_TOKEN` to publish its image,
|
|
`PACKAGE_USERNAME` and `PACKAGE_TOKEN` to publish the chart, and
|
|
`GITOPS_TOKEN` to promote the chart version in homelab-gitops. It has no
|
|
Kubernetes credentials.
|
|
|
|
Validate locally with:
|
|
|
|
```sh
|
|
./test.sh
|
|
```
|
|
|
|
## Internet exposure
|
|
|
|
The homelab instance is public and presents direct PostgreSQL login. Use long,
|
|
unique database passwords, restrictive PostgreSQL roles and `pg_hba.conf`
|
|
rules, TLS for remote database connections, and suitable external access
|
|
controls. The chart retains phpPgAdmin's extra-login security defaults.
|