Assemble the Postgres DSN from DATABASE_ENGINE/HOST/PORT/NAME/USER/
PASSWORD/OPTIONS so only the password needs to live in a secret; the
rest can go in a ConfigMap. DATABASE_URL remains a full-DSN override
(used by the sqlite test suite). Credentials are percent-encoded, the
port and options are omitted when empty, and the k8s migrate
initContainer now also reads the config ConfigMap.
Single-file deployment under deploy/k8s/tavolo.yaml:
- Namespace, ConfigMap and Secret (placeholders) for the app
- Ephemeral Redis Deployment + Service (sessions and live games are
disposable, mirroring the docker-compose no-volume choice)
- App Deployment with an aerich-migrate initContainer so the schema is
upgraded before rollout, /api/health probes and a hardened pod
security context
- ClusterIP Service; Postgres and the OIDC provider stay in their own
namespaces and are referenced by DNS
woggioni