feat(data): add CNPG managed roles + Database CRs for authentik/temporal — replaces missing helmfile post-sync user creation

authentik/temporal DB users+databases were never provisioned (old helmfile hook
gone; db-init-job only made schemas in shared app DB). Adds managed.roles
(authentik/temporal login roles, passwords from basic-auth secrets) + Database CRs
(dedicated DBs owned by each role). Role secrets applied out-of-band (SOPS), not in
kustomize resources so data-schemas app doesn't choke on ciphertext.

k8s/data/authentik-database.yaml

@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: authentik
+  namespace: ddb
+spec:
+  name: authentik
+  owner: authentik
+  cluster:
+    name: ddb-cluster

k8s/data/db-role-secrets.enc.yaml

@@ -0,0 +1,49 @@
+apiVersion: ENC[AES256_GCM,data:u74=,iv:vPf+N0mpxoTTHn8t3W6kiIbNrXGOFngfnc5vk3gzq+Y=,tag:OlJWpHdVqQHeA96OdJoA7A==,type:str]
+kind: ENC[AES256_GCM,data:9f6uPGLQ,iv:V5KjMaBQoQRwMxHRoStLIlSYW0zqgcORLX5GKYKZ7hY=,tag:zLozLmSNHOd2/lFxFfnxtw==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:uNU+lZyIdW0bwLQHoecYqdU=,iv:ov6MQQ9e7s+dRoQbZQPbjtB5j42dckyg27nx+LWJw0I=,tag:74nJSTgy9pZ5LH/O3xpwSA==,type:str]
+    namespace: ENC[AES256_GCM,data:xIre,iv:Gv//YoAeIoFgFbW9OJkHPv1Fz8NEAzB+qSpNYXm1008=,tag:Vsj/V3wLX8mUnHrMGZZxFw==,type:str]
+type: ENC[AES256_GCM,data:pkm2nd/50FTigAJyEW2mEcgKVR0Y61VA,iv:DQ3k8Xp54nySnVEJvbiMXYJ+0ssUC8oSDLsoRut+qMg=,tag:ZwVH9ivA5hBCCkiGjXPbUw==,type:str]
+stringData:
+    username: ENC[AES256_GCM,data:TeIYIIDS+RWp,iv:feJ2lRnPWnDKIMgSEz4A070k2ZrDFz7VzF7vthxoQuM=,tag:QYeI+6qeuyL3hIZSH7eQWg==,type:str]
+    password: ENC[AES256_GCM,data:ACIyp9eAiQtuzcN8piX5XX/UzHEjobxT1M6usFV6jwQ=,iv:AnmrpNo9JqtWYMwh4ghWXZfmeCTXFqzkfN69CPbWkpM=,tag:kZ2jfUAvtG39+Og/Km2fwA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSaFFueUY2MUZ1dzRkelRL
+            aklvRytMSVBJQjA4UXdqSjlRQUo2R0lyTTFVCktUNWl1cWttZDdVd2ZyR0lPVERj
+            T1ZpMkRrZGgvWFJVRnZOdlZJc3RNcTAKLS0tIHVwY0JNMXVWeTZnWW9BQnM0TCtK
+            bVJ0eU05N3hIT3Z6TWdSOUxxeGh1b1UKuQ23KqCTNlEk3c8gbQsFGQwkN4gkI7Z2
+            HauqbNHQoU64smns+HPDoHq7z87xRlQ8c8efNpIGhfYgS/nf1eGXbg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
+    lastmodified: "2026-07-21T06:35:41Z"
+    mac: ENC[AES256_GCM,data:VeVffJWYwoqNe/irAsWrl1rAOr2xMnsPgSCqiszaoF1807iU7FSpuvSOCAbaOJXSKgJ/MBflnegCIsDb7a1W4BcwhwuMGoGl2C2vBs2YPZvqTzfnfXAGrWCbZdyCh16Dg8nZQlwRe2QwokqW+t3j1qAYfq4KVu8MLi648adRIt0=,iv:mCMQXdfVQNDgY1ZHEQGBC4YaHwkCsyo+oADMJ7p23B8=,tag:7c9VkImsgkjSxOkM1Q3qgg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
+---
+apiVersion: ENC[AES256_GCM,data:DxA=,iv:eWizGuPMW/RfEkLvL4pei42sov2EUwSDHKrtdraSxWw=,tag:E1w/dzFGqUIr+W+wY4YKNA==,type:str]
+kind: ENC[AES256_GCM,data:amkGISvV,iv:13KTCVXg9EKQLfz4cCCPxfHAnPHZ0AheDmn8HIm87rw=,tag:wHfOOTJsrN2iiOTsSN507A==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:lpkz7+GPScHzbUsBL276Gw==,iv:ce+pCqVqXZD7G6LZzFGMCK58k2icd07cE9DTJYOid5I=,tag:ug6gUmLuTkyy0eRsTGJqOw==,type:str]
+    namespace: ENC[AES256_GCM,data:sCqW,iv:5rvJSGBshQsjrUkizUekMpS0Fpyfkf7IcNL8aZR3lks=,tag:cFtIZO6F9eAdzE+IVv1wyg==,type:str]
+type: ENC[AES256_GCM,data:aUYmzPoRlh2uDcjhZ5OD82ScAtBxd1Fm,iv:ovGv+qPiiLBC1mVSEX+QuJOkAjqPAUO/e+Nux2xuVKg=,tag:gaZwWSH7LF1FCKZr+P+R1A==,type:str]
+stringData:
+    username: ENC[AES256_GCM,data:kvKdlAd1ox4=,iv:NcwxeRHzyRECQ7cLUwOeEiKkHMG7FhFMZRsfUfdtBmM=,tag:zfS+ZOFMHA6Q3LCkM2GSqA==,type:str]
+    password: ENC[AES256_GCM,data:7/ZJxWr39GrKA+i50S7wLBjt2Kaz9aG1ML44VGyRWi0=,iv:y0KlJ5ogdBDGzL6IPIjqD6Ir/S6K6v1dGTg8wxxp8n4=,tag:zwnCvi7RPqQdLJvfk69KgA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSaFFueUY2MUZ1dzRkelRL
+            aklvRytMSVBJQjA4UXdqSjlRQUo2R0lyTTFVCktUNWl1cWttZDdVd2ZyR0lPVERj
+            T1ZpMkRrZGgvWFJVRnZOdlZJc3RNcTAKLS0tIHVwY0JNMXVWeTZnWW9BQnM0TCtK
+            bVJ0eU05N3hIT3Z6TWdSOUxxeGh1b1UKuQ23KqCTNlEk3c8gbQsFGQwkN4gkI7Z2
+            HauqbNHQoU64smns+HPDoHq7z87xRlQ8c8efNpIGhfYgS/nf1eGXbg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
+    lastmodified: "2026-07-21T06:35:41Z"
+    mac: ENC[AES256_GCM,data:VeVffJWYwoqNe/irAsWrl1rAOr2xMnsPgSCqiszaoF1807iU7FSpuvSOCAbaOJXSKgJ/MBflnegCIsDb7a1W4BcwhwuMGoGl2C2vBs2YPZvqTzfnfXAGrWCbZdyCh16Dg8nZQlwRe2QwokqW+t3j1qAYfq4KVu8MLi648adRIt0=,iv:mCMQXdfVQNDgY1ZHEQGBC4YaHwkCsyo+oADMJ7p23B8=,tag:7c9VkImsgkjSxOkM1Q3qgg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

k8s/data/ddb-cluster.yaml

@@ -28,6 +28,23 @@ spec:
         - CREATE EXTENSION IF NOT EXISTS pgcrypto;
         - CREATE EXTENSION IF NOT EXISTS pg_trgm;
 
+  # Per-app login roles, passwords sourced from secrets (CNPG reconciles the
+  # role password to match the secret). Their databases are separate Database
+  # CRs (see authentik-database.yaml / temporal-database.yaml) owned by these
+  # roles. Replaces the old helmfile post-sync user-creation hook.
+  managed:
+    roles:
+      - name: authentik
+        ensure: present
+        login: true
+        passwordSecret:
+          name: authentik-db-role
+      - name: temporal
+        ensure: present
+        login: true
+        passwordSecret:
+          name: temporal-db-role
+
   # Disable superuser (security)
   enableSuperuserAccess: false
 

k8s/data/kustomization.yaml

@@ -14,3 +14,7 @@ resources:
   - schemas.yaml
   - db-init-job.yaml
   - forgejo-database.yaml
+  - authentik-database.yaml
+  - temporal-database.yaml
+# db-role-secrets.enc.yaml is applied out-of-band (SOPS-encrypted, bootstrap) —
+# NOT listed here, or the data-schemas ArgoCD app would fail on the ciphertext.

k8s/data/temporal-database.yaml

@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: temporal
+  namespace: ddb
+spec:
+  name: temporal
+  owner: temporal
+  cluster:
+    name: ddb-cluster