Split database config into DATABASE_* components

Assemble the Postgres DSN from DATABASE_ENGINE/HOST/PORT/NAME/USER/
PASSWORD/OPTIONS so only the password needs to live in a secret; the
rest can go in a ConfigMap. DATABASE_URL remains a full-DSN override
(used by the sqlite test suite). Credentials are percent-encoded, the
port and options are omitted when empty, and the k8s migrate
initContainer now also reads the config ConfigMap.

deploy/k8s/tavolo.yaml

@@ -45,6 +45,17 @@ metadata:
 data:
   # In-cluster Redis deployed by this file.
   REDIS_URL: redis://redis.tavolo.svc.cluster.local:6379/0
+  # Postgres (external, lives in another namespace): everything except the
+  # password, which is the only entry in the tavolo-secrets Secret.
+  # Use its Service DNS name, e.g. postgres.<namespace>.svc.cluster.local.
+  DATABASE_ENGINE: postgres
+  DATABASE_HOST: REPLACE_ME
+  DATABASE_PORT: "5432"
+  DATABASE_NAME: REPLACE_ME
+  DATABASE_USER: REPLACE_ME
+  # Extra DSN query parameters appended to the URL (e.g. ssl=require).
+  # Empty means none.
+  DATABASE_OPTIONS: ""
   # The image bakes STATIC_DIR=/app/web/dist; repeat it here for clarity.
   STATIC_DIR: /app/web/dist
   GAME_TTL_SECONDS: "86400"
@@ -72,9 +83,9 @@ metadata:
     app.kubernetes.io/part-of: tavolo
 type: Opaque
 stringData:
-  # Postgres lives in another namespace; use its Service DNS name:
-  #   postgres://USER:PASS@postgres.<namespace>.svc.cluster.local:5432/<db>
-  DATABASE_URL: REPLACE_ME
+  # The only Postgres secret: the password for DATABASE_USER at
+  # DATABASE_HOST (both configured in the tavolo-config ConfigMap).
+  DATABASE_PASSWORD: REPLACE_ME
   # Client secret for OIDC_CLIENT_ID at the provider.
   OIDC_CLIENT_SECRET: REPLACE_ME
 
@@ -199,6 +210,9 @@ spec:
           command: ["aerich", "upgrade"]
           workingDir: /app
           envFrom:
+            # Migrations need the non-secret DATABASE_* parts too.
+            - configMapRef:
+                name: tavolo-config
             - secretRef:
                 name: tavolo-secrets
           resources: