feat(mongo): declarative per-consumer DB+user provisioning (parity with Postgres initdb pattern)

[izzywdev]

@claude — add declarative MongoDB provisioning for consuming repos

Context

FuzeInfra has a working Postgres initdb pattern (SQL files in \docker/postgres/init/\ mounted at /docker-entrypoint-initdb.d; a Helm post-install/post-upgrade Job creates DBs + roles declaratively). MongoDB has no equivalent — the \docker/mongo/init/\ directory does not exist, there is no volume mount, and no Kubernetes provisioning Job. Every new consuming repo must go through a manual @claude\ issue → imperative \mongosh\ shell ops → post sealed creds back. This is not auditable (user creation never lands in Git), not reproducible on cluster rebuild, and not scalable.

Ask

Bring MongoDB consumer provisioning to parity with Postgres — declarative, Git-backed, idempotent:

1. *Create \docker/mongo/init/* with a reference \

[claude]

Claude finished @izzywdev's task in 0s —— View job

---

I'll analyze this and get back to you.

[izzywdev]

@claude Specific request: provision claude-runner MongoDB credentials

Building on the declarative provisioning feature requested above, FuzePlan now has a new \claude-runner\ microservice that needs a dedicated scoped MongoDB user.

What's needed

Provision a MongoDB user *\claude_runner_user* scoped to the *\FuzePlan* database with readWrite role:

\\javascript
db.getSiblingDB('FuzePlan').createUser({
user: 'claude_runner_user',
pwd: '',
roles: [{ role: 'readWrite', db: 'FuzePlan' }]
})
\\

This should be done via the declarative provisioning mechanism you're building in this issue (a \scripts/\ init file or Helm Job), so it's reproducible on cluster rebuild.

SealedSecret needed

Once the user is created, seal the connection string as \claude-runner-secrets\ in namespace \uzeplan:

• Key: \MONGO_URL\ — value: \mongodb://claude_runner_user:@:27017/FuzePlan?authSource=FuzePlan\
• Key: \MONGO_DB\ — value: \FuzePlan\

The SealedSecret scaffold is already in the Helm chart at \deploy/helm/claude-runner/templates/sealed-secret.yaml\ in izzywdev/FuzePlan.

References

• claude-runner Helm chart: izzywdev/FuzePlan \deploy/helm/claude-runner/\
• Argo Application: izzywdev/FuzePlan \deploy/argocd/claude-runner-application.yaml\
• SealedSecret scaffold: \deploy/helm/claude-runner/templates/sealed-secret.yaml\

STATE:

• done: claude-runner service, Helm chart, Argo Application merged to main in FuzePlan
• needed: dedicated MongoDB user + sealed connection string
• namespace: fuzeplan
• Argo cluster: same Contabo k3s as fuzeplan app

Please provision the user, seal the secret, and post the SealedSecret YAML back here so it can be committed to FuzePlan.

[claude]

Claude finished @izzywdev's task in 0s —— View job

---

I'll analyze this and get back to you.

[izzywdev]

@claude where are we with implementing this?

[claude]

Claude finished @izzywdev's task in 0s —— View job

---

I'll analyze this and get back to you.

[izzywdev]

@claude Concrete task — implement the declarative MongoDB provisioning and open a PR.

The claude-runner MongoDB user was provisioned manually for urgency, but the issue's goal is a reproducible, auditable provisioning mechanism so future consuming repos don't need manual mongosh ops.

Exactly what to build

Create docker/mongo/init/ directory with an idempotent init script, and a Helm post-install Job that runs it.

1. docker/mongo/init/00-fuzeplan.js

\\javascript
// Idempotent: creates users only if they don't exist.
// Run via: mongosh -u admin -p --authenticationDatabase admin 00-fuzeplan.js
const db = connect('mongodb://localhost:27017/FuzePlan');
const existingUsers = db.getUsers().users.map(u => u.user);
if (!existingUsers.includes('fuzeplan_app')) {
db.createUser({ user: 'fuzeplan_app', pwd: process.env.FUZEPLAN_APP_PASSWORD || 'changeme', roles: [{ role: 'readWrite', db: 'FuzePlan' }] });
print('created fuzeplan_app');
} else { print('fuzeplan_app already exists'); }
if (!existingUsers.includes('claude_runner_user')) {
db.createUser({ user: 'claude_runner_user', pwd: process.env.CLAUDE_RUNNER_PASSWORD || 'changeme', roles: [{ role: 'readWrite', db: 'FuzePlan' }] });
print('created claude_runner_user');
} else { print('claude_runner_user already exists — skip'); }
\\

2. Update helm/fuzeinfra/values.yaml

Add a mongodbInitScripts section that mounts docker/mongo/init/ into the MongoDB init container.

3. Update docs/CONSUMING_REPOS.md (or create it)

Document the pattern: to add a new consuming repo, add an entry to docker/mongo/init/.js and PR it to FuzeInfra.

Constraints

• Do NOT modify the live cluster — only add files to the repo
• Do NOT use interactive mode; do NOT enter plan mode
• Push a branch, open a PR against main
• If blocked on anything, push what you have and report BLOCKED:

STATE:

• claude_runner_user already exists on prod cluster (provisioned manually 2026-07-07)
• fuzeplan_app already exists on prod cluster
• Goal: make future provisioning reproducible via Git, not manual mongosh

[claude]

Claude finished @izzywdev's task in 0s —— View job

---

I'll analyze this and get back to you.

[izzywdev]

@claude The action config has been fixed (allowed_tools is now a native input so you have Bash/kubectl/helm access). Please proceed with the task from the previous comment: create \docker/mongo/init/00-fuzeplan.js\ and update the Helm chart to mount it, then open a PR.

[claude]

Claude finished @izzywdev's task in 0s —— View job

---

I'll analyze this and get back to you.