# Authentik DB Init Job
# Creates authentik database and user in PostgreSQL.
# Run once before deploying Authentik.
#
# Deploy:
#   kubectl create secret generic authentik-secret \
#     --namespace <ns> \
#     --from-literal=db-password='<password>' \
#     --from-literal=secret-key='<random-50-chars>'
#   kubectl apply -f authentik-db-init.yaml -n <ns>
#
# Watch completion:
#   kubectl get jobs -n <ns> -w
#   kubectl logs job/authentik-db-init -n <ns>

apiVersion: batch/v1
kind: Job
metadata:
  name: authentik-db-init
spec:
  template:
    spec:
      restartPolicy: OnFailure
      containers:
        - name: authentik-db-init
          image: postgres:16
          env:
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-secret
                  key: password
            - name: AUTHENTIK_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: authentik-secret
                  key: db-password
          command:
            - /bin/sh
            - -c
            - |
              psql -h postgres -U postgres <<EOF
              CREATE USER authentik_user WITH PASSWORD '${AUTHENTIK_DB_PASSWORD}';
              CREATE DATABASE authentik_db OWNER authentik_user;
              EOF