---
# Schema initialization ConfigMap for PostgreSQL services
# Services: Authentik, Vault (optional), Temporal, others
# Applied via initdb Jobs after CNPG cluster is ready

apiVersion: v1
kind: ConfigMap
metadata:
  name: db-schemas
  namespace: ddb
  labels:
    app: postgresql-schemas
data:
  # Authentik schema (minimal — Authentik creates most tables via Django ORM)
  authentik-init.sql: |
    CREATE SCHEMA IF NOT EXISTS authentik;
    GRANT USAGE ON SCHEMA authentik TO app;
    GRANT CREATE ON SCHEMA authentik TO app;

  # Temporal schema
  temporal-init.sql: |
    CREATE SCHEMA IF NOT EXISTS temporal;
    GRANT USAGE ON SCHEMA temporal TO app;
    GRANT CREATE ON SCHEMA temporal TO app;

  # Vault schema (if using PostgreSQL backend)
  vault-init.sql: |
    CREATE SCHEMA IF NOT EXISTS vault;
    GRANT USAGE ON SCHEMA vault TO app;
    GRANT CREATE ON SCHEMA vault TO app;

  # Application schema (generic)
  app-init.sql: |
    -- Default app schema (public)
    GRANT USAGE ON SCHEMA public TO app;
    GRANT CREATE ON SCHEMA public TO app;