Adds loomio app.

loomio/versions/3/db-init-job.yaml

@@ -15,9 +15,7 @@ spec:
         - |
           set -e
           echo "Initializing Loomio database..."
-          # Patch schema.rb to use IF NOT EXISTS for pghero schema
+          DISABLE_DATABASE_ENVIRONMENT_CHECK=1 bundle exec rake db:migrate db:seed
-          sed -i 's/create_schema "pghero"/execute "CREATE SCHEMA IF NOT EXISTS pghero"/g' db/schema.rb
-          bundle exec rake db:schema:load db:seed
           echo "Database initialization complete"
         env:
         - name: RAILS_ENV
@@ -39,6 +37,68 @@ spec:
             secretKeyRef:
               name: loomio-secrets
               key: secretCookieToken
+      initContainers:
+      - name: create-db
+        image: postgres:17-alpine
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 999
+          runAsGroup: 999
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: [ALL]
+          readOnlyRootFilesystem: true
+          seccompProfile:
+            type: RuntimeDefault
+        env:
+        - name: PGHOST
+          value: "{{ .db.host }}"
+        - name: PGPORT
+          value: "{{ .db.port }}"
+        - name: PGUSER
+          value: postgres
+        - name: PGPASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: loomio-secrets
+              key: postgres.password
+        - name: APP_DB_NAME
+          value: "{{ .db.name }}"
+        - name: APP_DB_USER
+          value: "{{ .db.user }}"
+        - name: APP_DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: loomio-secrets
+              key: dbPassword
+        command:
+        - sh
+        - -c
+        - |
+          set -e
+          echo "Waiting for PostgreSQL to be ready..."
+          until pg_isready -h $PGHOST -p $PGPORT -U $PGUSER; do
+            sleep 2
+          done
+          psql -v ON_ERROR_STOP=1 <<-EOSQL
+            DO \$\$ BEGIN
+              IF NOT EXISTS (SELECT FROM pg_user WHERE usename = '$APP_DB_USER') THEN
+                CREATE USER $APP_DB_USER WITH PASSWORD '$APP_DB_PASSWORD';
+              ELSE
+                ALTER USER $APP_DB_USER WITH PASSWORD '$APP_DB_PASSWORD';
+              END IF;
+            END \$\$;
+            SELECT 'CREATE DATABASE $APP_DB_NAME OWNER $APP_DB_USER'
+            WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '$APP_DB_NAME')\gexec
+            GRANT ALL PRIVILEGES ON DATABASE $APP_DB_NAME TO $APP_DB_USER;
+          EOSQL
+          psql -d "$APP_DB_NAME" -v ON_ERROR_STOP=1 <<-EOSQL
+            GRANT ALL ON SCHEMA public TO $APP_DB_USER;
+            CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
+            CREATE EXTENSION IF NOT EXISTS hstore;
+            CREATE EXTENSION IF NOT EXISTS pgcrypto;
+          EOSQL
+          echo "Database and user created"
         securityContext:
           runAsNonRoot: false
           runAsUser: 0

loomio/versions/3/deployment-channels.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: loomio-channels
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      component: channels
+  template:
+    metadata:
+      labels:
+        component: channels
+    spec:
+      containers:
+      - name: channels
+        image: loomio/loomio_channel_server:latest
+        ports:
+        - containerPort: 3000
+          name: http
+        env:
+        - name: PORT
+          value: "3000"
+        - name: REDIS_URL
+          value: {{ .redisUrl }}
+        - name: APP_URL
+          value: http://loomio.{{ .namespace }}.svc.cluster.local:80
+        resources:
+          requests:
+            memory: 256Mi
+            cpu: 50m
+          limits:
+            memory: 1Gi
+            cpu: 500m
+        livenessProbe:
+          tcpSocket:
+            port: 3000
+          initialDelaySeconds: 30
+          periodSeconds: 30
+        readinessProbe:
+          tcpSocket:
+            port: 3000
+          initialDelaySeconds: 10
+          periodSeconds: 10
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 1000
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: [ALL]
+          readOnlyRootFilesystem: false
+          seccompProfile:
+            type: RuntimeDefault

loomio/versions/3/deployment-worker.yaml

@@ -80,7 +80,7 @@ spec:
         resources:
           requests:
             memory: 256Mi
-            cpu: 100m
+            cpu: 50m
           limits:
             memory: 1Gi
             cpu: 500m

loomio/versions/3/deployment.yaml

@@ -99,8 +99,8 @@ spec:
           mountPath: /loomio/log
         resources:
           requests:
-            memory: 512Mi
+            memory: 256Mi
-            cpu: 200m
+            cpu: 50m
           limits:
             memory: 2Gi
             cpu: 1000m

loomio/versions/3/kustomization.yaml

@@ -7,8 +7,10 @@ resources:
   - pvc-uploads.yaml
   - pvc-storage.yaml
   - deployment.yaml
+  - deployment-channels.yaml
   - deployment-worker.yaml
   - service.yaml
+  - service-channels.yaml
   - ingress.yaml
   - db-init-job.yaml
 

loomio/versions/3/manifest.yaml

@@ -1,4 +1,4 @@
-version: 3.0.11-2
+version: 3.0.11-5
 requires:
   - name: postgres
     installed_as: postgres

loomio/versions/3/service-channels.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: loomio-channels
+spec:
+  selector:
+    component: channels
+  ports:
+  - port: 80
+    targetPort: 3000
+    protocol: TCP
+    name: http