refactor(cnpg): unify all apps on 'app' database user/credentials pattern

k8s/security/iam/authentik-values.yaml

@@ -23,13 +23,14 @@ authentik:
     enabled: false   # do not phone home to Sentry
 
   # PostgreSQL connection — points at CloudNativePG cluster in ddb namespace.
-  # password is injected via helmfile --set at deploy time.
+  # Uses 'app' bootstrap user (CNPG simple pattern, same as Forgejo).
+  # Credentials injected from ddb-cluster-app secret via env vars below.
   postgresql:
     host: ddb-cluster-rw.ddb.svc.cluster.local
     port: 5432
     name: authentik
-    user: authentik
-    password: ""  # injected via helmfile --set authentik.postgresql.password
+    user: app  # All apps use shared 'app' user (CNPG design pattern)
+    password: ""  # overridden by AUTHENTIK_POSTGRESQL__PASSWORD env var
 
   # Redis connection — bundled subchart, standalone mode (no sentinel/cluster).
   redis:
@@ -123,7 +124,23 @@ server:
   volumes: *caVolumes
   volumeMounts: *caVolumeMounts
   initContainers: *caInitContainers
-  env: *caEnv
+  env:
+    # Merge CA trust env vars
+    - name: REQUESTS_CA_BUNDLE
+      value: /merged/ca-bundle.crt
+    - name: SSL_CERT_FILE
+      value: /merged/ca-bundle.crt
+    # Override database credentials to use 'app' from ddb-cluster-app
+    - name: AUTHENTIK_POSTGRESQL__USER
+      valueFrom:
+        secretKeyRef:
+          name: ddb-cluster-app
+          key: username
+    - name: AUTHENTIK_POSTGRESQL__PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: ddb-cluster-app
+          key: password
   podAnnotations:
     configmap.reloader.stakater.com/reload: "homelab-ca"
     homelab.io/restart-at: "2026-06-21T13-40"
@@ -178,7 +195,23 @@ worker:
   volumes: *caVolumes
   volumeMounts: *caVolumeMounts
   initContainers: *caInitContainers
-  env: *caEnv
+  env:
+    # Merge CA trust env vars
+    - name: REQUESTS_CA_BUNDLE
+      value: /merged/ca-bundle.crt
+    - name: SSL_CERT_FILE
+      value: /merged/ca-bundle.crt
+    # Override database credentials to use 'app' from ddb-cluster-app
+    - name: AUTHENTIK_POSTGRESQL__USER
+      valueFrom:
+        secretKeyRef:
+          name: ddb-cluster-app
+          key: username
+    - name: AUTHENTIK_POSTGRESQL__PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: ddb-cluster-app
+          key: password
   podAnnotations:
     configmap.reloader.stakater.com/reload: "homelab-ca"
     homelab.io/restart-at: "2026-06-21T13-40"