chore(values): set explicit passwords for local deployment

Required since temporal-secret.yaml now validates via required().
Values match the credentials used at initial cluster install.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -1 +1,2 @@
 .DS_Store
+*.sql

charts/postiz/templates/NOTES.txt

@@ -2,11 +2,11 @@ Postiz has been deployed!
 
 Access URL:
 {{- if .Values.ingress.enabled }}
-  https://{{ (first .Values.ingress.hosts).host }}
+  {{ if .Values.ingress.tls }}https{{ else }}http{{ end }}://{{ (first .Values.ingress.hosts).host }}{{ (first (first .Values.ingress.hosts).paths).path }}
 {{- else if eq .Values.service.type "NodePort" }}
   http://<node-ip>:{{ .Values.service.nodePort }}
 {{- else }}
-  kubectl port-forward svc/{{ include "postiz.fullname" . }} 5000:80
+  kubectl port-forward svc/{{ include "postiz.fullname" . }} 5000:{{ .Values.service.port }}
   http://localhost:5000
 {{- end }}
 
@@ -14,11 +14,11 @@ Access URL:
 
 Temporal:
   Internal address : {{ include "postiz.fullname" . }}-temporal:7233
-  Status           : kubectl get pods -l app.kubernetes.io/component=temporal
+  Status           : kubectl -n {{ .Release.Namespace }} get pods -l app.kubernetes.io/component=temporal
-  Init job logs    : kubectl logs job/{{ include "postiz.fullname" . }}-temporal-init
+  Init job logs    : kubectl -n {{ .Release.Namespace }} logs job/{{ include "postiz.fullname" . }}-temporal-init
 
   After first deploy, create Temporal search attributes:
-    kubectl exec deploy/{{ include "postiz.fullname" . }}-temporal -- \
+    kubectl -n {{ .Release.Namespace }} exec deploy/{{ include "postiz.fullname" . }}-temporal -- \
       temporal operator search-attribute create \
         --namespace {{ .Values.temporal.namespace | default "default" }} \
         --name organizationId --type Keyword \
@@ -41,6 +41,6 @@ WARNING: replicaCount={{ .Values.replicaCount }} with STORAGE_PROVIDER=local is
 
 Upgrade reminder:
   Always back up the PostgreSQL database before upgrading Postiz:
-    kubectl exec -n <namespace> <postgresql-pod> -- \
+    kubectl exec -n {{ .Release.Namespace }} <postgresql-pod> -- \
       pg_dump -U {{ .Values.postgresql.auth.username }} {{ .Values.postgresql.auth.database }} \
       > postiz-backup-$(date +%Y%m%d).sql

charts/postiz/templates/postiz-config.yaml

@@ -8,10 +8,8 @@ data:
   {{- range $key, $value := .Values.env }}
   {{ $key }}: {{ $value | quote }}
   {{- end }}
-  {{- if .Values.temporal.enabled }}
+  {{- if or .Values.temporal.enabled .Values.temporal.address }}
   TEMPORAL_ADDRESS: {{ default (printf "%s-temporal:7233" (include "postiz.fullname" .)) .Values.temporal.address | quote }}
   TEMPORAL_NAMESPACE: {{ .Values.temporal.namespace | default "default" | quote }}
   TEMPORAL_TLS: {{ .Values.temporal.tls | toString | quote }}
-  {{- else if .Values.temporal.address }}
-  TEMPORAL_ADDRESS: {{ .Values.temporal.address | quote }}
   {{- end }}

charts/postiz/templates/temporal-init-job.yaml

@@ -1,5 +1,6 @@
 {{- if .Values.temporal.enabled }}
 {{- if .Values.postgresql.enabled }}
+{{- if ne .Values.temporal.postgresql.user .Values.postgresql.auth.username }}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -31,7 +32,7 @@ spec:
               done
           env:
             - name: PGHOST
-              value: {{ printf "%s-postgresql" .Release.Name | quote }}
+              value: {{ default (printf "%s-postgresql" .Release.Name) .Values.temporal.postgresql.seeds | splitList "," | first | quote }}
       containers:
         - name: create-temporal-user
           image: postgres:16-alpine
@@ -40,23 +41,25 @@ spec:
             - -c
             - |
               export PGPASSWORD="$POSTGRES_PASSWORD"
-              psql -h "$PGHOST" -U postgres <<-SQL
+              psql -h "$PGHOST" -U postgres \
-                DO \$\$ BEGIN
+                --set=temporal_user="$TEMPORAL_USER" \
-                  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '$TEMPORAL_USER') THEN
+                --set=temporal_pwd="$TEMPORAL_PWD" <<-'SQL'
+                DO $$ BEGIN
+                  IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'temporal_user') THEN
                     EXECUTE format(
                       'CREATE ROLE %I WITH LOGIN PASSWORD %L CREATEDB',
-                      '$TEMPORAL_USER',
+                      :'temporal_user',
-                      '$TEMPORAL_PWD'
+                      :'temporal_pwd'
                     );
-                    RAISE NOTICE 'Role $TEMPORAL_USER created.';
+                    RAISE NOTICE 'Role created.';
                   ELSE
-                    RAISE NOTICE 'Role $TEMPORAL_USER already exists, skipping.';
+                    RAISE NOTICE 'Role already exists, skipping.';
                   END IF;
-                END \$\$;
+                END $$;
               SQL
           env:
             - name: PGHOST
-              value: {{ printf "%s-postgresql" .Release.Name | quote }}
+              value: {{ default (printf "%s-postgresql" .Release.Name) .Values.temporal.postgresql.seeds | splitList "," | first | quote }}
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
@@ -71,3 +74,4 @@ spec:
                   key: POSTGRES_PWD
 {{- end }}
 {{- end }}
+{{- end }}

charts/postiz/templates/temporal-secret.yaml

@@ -7,7 +7,7 @@ metadata:
     {{- include "postiz.labels" . | nindent 4 }}
 type: Opaque
 data:
-  POSTGRES_PWD: {{ .Values.temporal.postgresql.password | b64enc | quote }}
+  POSTGRES_PWD: {{ required "temporal.postgresql.password is required when temporal.enabled=true" .Values.temporal.postgresql.password | b64enc | quote }}
   {{- if .Values.temporal.apiKey }}
   TEMPORAL_API_KEY: {{ .Values.temporal.apiKey | b64enc | quote }}
   {{- end }}

charts/postiz/values.yaml

@@ -67,7 +67,7 @@ postgresql:
     # postgresPassword is used by the temporal init job to create the temporal user.
     # Set this explicitly; if left empty, Bitnami generates a random password
     # that the init job cannot retrieve.
-    postgresPassword: postgres-admin-password
+    postgresPassword: "postgres-admin-password"
   service:
     ports:
       postgresql: 5432