From 57e41178c3c11f5885967fababd139f6f28bd6d6 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@sirius0xdev.com>
Date: Sun, 24 May 2026 20:02:20 +0000
Subject: [PATCH] feat(customer1): add trading_dashboard database to
 siriusdevops-pgdb CNPG cluster

- Add trading_dashboard role + Database CR on siriusdevops-pgdb
- Create SOPS-encrypted credentials secret (template)
- Update trade-dashboard to use the new dedicated DB
  - New host: siriusdevops-pgdb-rw
  - New database: trading_dashboard
  - New credentials secret
---
 .../siriusdevops-db/kustomization.yaml        |  3 +++
 .../pg-cluster-siriusdevops.yaml              |  6 ++++++
 .../trading-dashboard-db-credentials.yaml     | 19 +++++++++++++++++++
 .../siriusdevops-db/trading-dashboard-db.yaml | 10 ++++++++++
 .../customer1/trade-dashboard/configmap.yaml  |  5 ++---
 .../customer1/trade-dashboard/deployment.yaml | 10 ++++++++--
 6 files changed, 48 insertions(+), 5 deletions(-)
 create mode 100644 apps/base/customer1/siriusdevops-db/trading-dashboard-db-credentials.yaml
 create mode 100644 apps/base/customer1/siriusdevops-db/trading-dashboard-db.yaml

diff --git a/apps/base/customer1/siriusdevops-db/kustomization.yaml b/apps/base/customer1/siriusdevops-db/kustomization.yaml
index 4ddba78..afe39ba 100644
--- a/apps/base/customer1/siriusdevops-db/kustomization.yaml
+++ b/apps/base/customer1/siriusdevops-db/kustomization.yaml
@@ -6,3 +6,6 @@ resources:
   - waitlist-db-credentials.yaml
   - waitlist-db.yaml
   - siriusdevops-scheduled-backup.yaml
+  # New trading dashboard DB
+  - trading-dashboard-db-credentials.yaml
+  - trading-dashboard-db.yaml
diff --git a/apps/base/customer1/siriusdevops-db/pg-cluster-siriusdevops.yaml b/apps/base/customer1/siriusdevops-db/pg-cluster-siriusdevops.yaml
index eb44ed7..5cc2b1e 100644
--- a/apps/base/customer1/siriusdevops-db/pg-cluster-siriusdevops.yaml
+++ b/apps/base/customer1/siriusdevops-db/pg-cluster-siriusdevops.yaml
@@ -17,6 +17,12 @@ spec:
         login: true
         passwordSecret:
           name: waitlist-db-credentials
+      # NEW - Trading Dashboard role
+      - name: trading_dashboard
+        ensure: present
+        login: true
+        passwordSecret:
+          name: trading-dashboard-db-credentials
 
   bootstrap:
     initdb:
diff --git a/apps/base/customer1/siriusdevops-db/trading-dashboard-db-credentials.yaml b/apps/base/customer1/siriusdevops-db/trading-dashboard-db-credentials.yaml
new file mode 100644
index 0000000..727ba54
--- /dev/null
+++ b/apps/base/customer1/siriusdevops-db/trading-dashboard-db-credentials.yaml
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: trading-dashboard-db-credentials
+  namespace: customer1
+type: Opaque
+stringData:
+  username: trading_dashboard
+  password: CHANGE_ME_TO_STRONG_PASSWORD
+sops:
+  # Run `sops -e -i trading-dashboard-db-credentials.yaml` after filling in the password
+  kms: []
+  gcp_kms: []
+  azure_kv: []
+  hc_vault: []
+  age: []
+  lastmodified: ""
+  mac: ""
+  encrypted_regex: ^(data|stringData)$
diff --git a/apps/base/customer1/siriusdevops-db/trading-dashboard-db.yaml b/apps/base/customer1/siriusdevops-db/trading-dashboard-db.yaml
new file mode 100644
index 0000000..25f2b78
--- /dev/null
+++ b/apps/base/customer1/siriusdevops-db/trading-dashboard-db.yaml
@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: trading-dashboard-db
+  namespace: customer1
+spec:
+  cluster:
+    name: siriusdevops-pgdb
+  name: trading_dashboard
+  owner: trading_dashboard
diff --git a/apps/base/customer1/trade-dashboard/configmap.yaml b/apps/base/customer1/trade-dashboard/configmap.yaml
index 6d1616c..cd33ad6 100644
--- a/apps/base/customer1/trade-dashboard/configmap.yaml
+++ b/apps/base/customer1/trade-dashboard/configmap.yaml
@@ -4,7 +4,6 @@ metadata:
   name: trade-dashboard-config
   namespace: customer1
 data:
-  DB_USER: "trading"
-  DB_HOST: "hermes-pgdb-rw.customer1.svc.cluster.local"
+  DB_HOST: "siriusdevops-pgdb-rw.customer1.svc.cluster.local"
   DB_PORT: "5432"
-  DB_NAME: "trading_data"
+  DB_NAME: "trading_dashboard"
diff --git a/apps/base/customer1/trade-dashboard/deployment.yaml b/apps/base/customer1/trade-dashboard/deployment.yaml
index 06bedda..7ff391c 100644
--- a/apps/base/customer1/trade-dashboard/deployment.yaml
+++ b/apps/base/customer1/trade-dashboard/deployment.yaml
@@ -41,12 +41,12 @@ spec:
             - name: DB_USER
               valueFrom:
                 secretKeyRef:
-                  name: trading-db-credentials
+                  name: trading-dashboard-db-credentials
                   key: username
             - name: DB_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: trading-db-credentials
+                  name: trading-dashboard-db-credentials
                   key: password
           startupProbe:
             httpGet:
@@ -61,3 +61,9 @@ spec:
               port: 8000
             initialDelaySeconds: 30
             periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 8000
+            initialDelaySeconds: 5
+            periodSeconds: 10