Provision dedicated `mendys` Postgres role + Mongo user (MendysRobotics prod blocked)

[izzywdev]

@claude — cross-repo request from MendysRobotics (tracking: izzywdev/MendysRobotics#134).

Problem

MendysRobotics prod is blocked: no dedicated mendys datastore identity exists on the shared FuzeInfra datastores. Peer apps have one (fuzekeys-db-credentials, fuzesocial-app-db-credentials in the fuzeinfra namespace); mendys does not. The app connects with an empty credential and fails:

psycopg2.OperationalError: connection to server at "fuzeinfra-postgres.fuzeinfra", port 5432 failed: fe_sendauth: no password supplied

Consumers CrashLoop; Mongo-backed data falls back to mock. Verified via cluster-query: fuzeinfra-secrets holds only the shared admin role, and there is no mendys-*-db-credentials secret.

Please provision (same pattern as fuzekeys / fuzesocial)

1. PostgreSQL: role mendys (with password) + database mendys on fuzeinfra-postgres.fuzeinfra:5432, role granted full access.
2. MongoDB: user mendys with readWrite on db mendys (authSource admin) on fuzeinfra-mongodb.fuzeinfra:27017.
3. Publish the creds the way peer apps do (e.g. a mendys-db-credentials Secret in the fuzeinfra namespace) and/or hand off so they can be loaded into MendysRobotics repo secrets MENDYS_PG_USERNAME/MENDYS_PG_PASSWORD/MENDYS_MONGO_USERNAME/MENDYS_MONGO_PASSWORD. Please do not paste raw secret values here — use the standard sealed-secrets / secure hand-off.

After provisioning (MendysRobotics side, ready)

Populate the four repo secrets → re-run seal-secrets → mendys-secrets gets valid DATABASE_URL/MONGODB_URL → roll backend + enable consumers via Argo. All app-side work (rollout fix, dashboard fix, async site-discoverer, Brands UI) is already merged and waiting only on this.

Refs: izzywdev/MendysRobotics#134

[claude]

Claude finished @izzywdev's task in 0s —— View job

---

I'll analyze this and get back to you.

[izzywdev]

@claude why are you returning within 0s? debug please

[claude]

Claude finished @izzywdev's task in 0s —— View job

---

I'll analyze this and get back to you.

[izzywdev]

Handler fix + mendys provisioning — PR #167

Root cause of the "0s" handler (closing the loop from the failed run): the SHA 428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d pinned as # v1 was a development/test commit in the action repo — not a release tag. At that commit the action's own e2e Playwright suite ran instead of the delegated task. PR #167 replaces it with f87768c6d25f92ae6efa7175e223ef77d4cbf97f (the real v1.0.166 SHA) and adds actionlint + CODEOWNERS guardrails.

Postgres provisioning (PR #167):

• helm/fuzeinfra/values.yaml — added mendys to serviceDatabases (disabled by default, role mendys_svc, database mendys)
• helm/fuzeinfra/values-contabo.yaml — placeholder entry with enabled: false; flip to true once the SealedSecret is in place

MongoDB provisioning (PR #167):

• docker/mongo/init/01-mendys.js — idempotent init script, user mendys_app, readWrite on mendys DB

---

Remaining steps for MendysRobotics (cannot be done without the consuming repo's SealedSecret)

To activate, the MendysRobotics team needs to:

1. Generate passwords (alphanumeric only — shell metacharacters break the provisioning job):

   PG_PW=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 32)
   MONGO_PW=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 32)

2. Seal mendys-db-credentials for the fuzeinfra namespace (sealed for namespace=fuzeinfra, so the provisioning Job can read it):

   scripts/seal-secret.sh fuzeinfra/mendys-db-credentials \
     password="$PG_PW" \
     --out deploy/sealed/mendys-db-credentials-fuzeinfra.yaml
   git add deploy/sealed/mendys-db-credentials-fuzeinfra.yaml && git commit && git push
   # Then open a PR to FuzeInfra to flip values-contabo.yaml mendys.enabled: true

3. Set GitHub Actions secrets in MendysRobotics:

   gh secret set MENDYS_PG_USERNAME   --body "mendys_svc"   --repo izzywdev/MendysRobotics
   gh secret set MENDYS_PG_PASSWORD   --body "$PG_PW"       --repo izzywdev/MendysRobotics
   gh secret set MENDYS_MONGO_USERNAME --body "mendys_app"  --repo izzywdev/MendysRobotics
   gh secret set MENDYS_MONGO_PASSWORD --body "$MONGO_PW"   --repo izzywdev/MendysRobotics

4. Once the SealedSecret is present in fuzeinfra namespace and the enabled: true PR merges, Argo CD will run the provisioning Job on next sync and the role/database will be live.

Note: raw password values are never posted here — the pattern above keeps them only in the shell session and in GitHub's encrypted secrets store.

BLOCKED: waiting for MendysRobotics to commit the mendys-db-credentials SealedSecret (step 2 above) before the Postgres provisioning Job can run. Once that PR is open, @claude can flip the enabled: true gate here.

---

Generated by Claude Code

[claude]

Claude finished @izzywdev's task in 0s —— View job

---

I'll analyze this and get back to you.