refactor: externalize postgres

[cmdoret]

Summary

• Drop postgres chart dependency.
• Update values accordingly.
• Add script + just recipe to bootstrap postgres database.
• Add documentation on postgres setup pre-requisite.

additional changes

• Render helm templates in CI.
• Add guards for nil values in templating for optional values.
• Move openwebui oauth secret to a Secret resource.

[Copilot]

Pull request overview

This PR refactors the Helm chart to remove the embedded PostgreSQL subchart and instead require an externally managed PostgreSQL instance, with accompanying bootstrap tooling and documentation. It also tightens Helm templating for optional values and adds a CI check to render templates.

Changes:

• Remove the Bitnami PostgreSQL chart dependency and update chart values/templates to use external PostgreSQL connection details.
• Add a DB bootstrap SQL script + just recipe, plus documentation describing the PostgreSQL prerequisite.
• Improve Helm template robustness for optional model sub-maps and move the OpenWebUI OAuth client secret into a Kubernetes Secret.

Reviewed changes

Copilot reviewed 20 out of 22 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
values.yaml	Updates defaults for external PostgreSQL and adds optional value blocks/guards.
tools/scripts/bootstrap-db.sql	Adds idempotent SQL to create expected roles/databases externally.
tools/nix/flake.nix	Adds postgresql to dev tooling for local DB bootstrap.
tools/just/helm.just	Adjusts helm helper recipes (cleanup + dependency fetch).
tools/helm/lint-values.yaml	Updates dummy values to include external PG host fields.
tools/config/treefmt.toml	Updates treefmt excludes list.
templates/postgres-initdb-scripts.yaml	Removes in-chart initdb ConfigMap (no longer deploying PG).
templates/postgres_secret.yaml	Reworks Secret content to target external PostgreSQL URL and adds required-value guards.
templates/postgres_initdb_secret.yaml	Removes in-chart initdb Secret (no longer deploying PG).
templates/openwebui/oauth_secret.yaml	Adds a Secret resource for the OpenWebUI OAuth client secret.
templates/openwebui/deployment.yaml	Switches OAuth secret usage to valueFrom and tweaks liveness threshold.
templates/models/pvc.yaml	Adds nil-safety defaults for optional persistence sub-map.
templates/models/knative-serving.yaml	Adds nil-safety defaults for optional sub-maps (persistence/image/cacheDir).
README.md	Documents external PostgreSQL prerequisite and updates contributing link.
justfile	Adds db-bootstrap recipe to run the new bootstrap SQL.
docs/postgresql.md	New doc describing external PostgreSQL requirements and bootstrap flow.
Chart.yaml	Removes the Bitnami PostgreSQL dependency.
Chart.lock	Updates dependency lockfile after removing PostgreSQL subchart.
.tpl.env	Adds env template for DB bootstrap password file paths.
.helmignore	Updates chart packaging ignores (sources/tools/docs/agentic files).
.gitignore	Updates ignore patterns for env + agentic files.
.github/workflows/helm.yaml	Adds CI step to render Helm templates with dummy values.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 22 changed files in this pull request and generated 2 comments.

Suppressed comments (5)

templates/openwebui/oauth_secret.yaml:9

• This stringData value is emitted as an unquoted YAML scalar. Secrets that YAML interprets as a number, alias, mapping, or comment can make the Kubernetes Secret invalid or alter its value. Quote the rendered scalar, as the other chart Secrets do.

  OAUTH_CLIENT_SECRET: {{ .Values.authentik.oauthApp.clientSecret | required ".Values.authentik.oauthApp.clientSecret is required" }}

templates/openwebui/deployment.yaml:50

• Moving this value from the Deployment into a fixed-name Secret removes the rollout trigger for credential changes. Secret-backed environment variables are read only when a container starts, so a Helm upgrade that rotates clientSecret updates the Secret but leaves existing OpenWebUI pods using the old credential. Add a checksum of the Secret/value to the pod-template annotations (or otherwise change the pod template when the Secret changes).

              valueFrom:
                secretKeyRef:
                  name: openwebui-oauth
                  key: OAUTH_CLIENT_SECRET

templates/postgres_secret.yaml:15

• The database name and password are inserted as raw URI components. A valid password containing characters such as @, /, ?, #, or a quote produces a different/invalid connection URI and can also break the rendered YAML. Percent-encode the userinfo/path components and quote the complete YAML scalar.

  OPENWEBUI_DATABASE_URL: "postgresql://{{ $db }}:{{ $pg.password | required ".Values.openwebui.postgres.password is required" }}@{{ $pg.host | required ".Values.openwebui.postgres.host is required" }}:5432/{{ $db }}?sslmode=require"

.github/workflows/helm.yaml:17

• This render check is placed in the reusable publish workflow, but pipeline.yaml:38-44 invokes that workflow only for version tags. Pull requests and normal pushes therefore never execute the new check, so malformed templates can merge and are discovered only when a release tag is being published. Run this step from the regular CI workflow (or invoke this workflow for PRs) instead.

      - name: Render templates with dummy values
        run: |
          nix develop --no-pure-eval --accept-flake-config "./tools/nix#ci" --command \
            just helm::template --values tools/helm/lint-values.yaml

README.md:67

• This says apiKey is required only for external models, but templates/models/model_secret.yaml:1-10 ranges over every model and applies required unconditionally; internal models without this value also fail rendering and use it as VLLM_API_KEY. Document the actual requirement so the example is usable.

    apiKey: # required: the API key to use for external APIs, if not hosted by us.