From 909e8f376cf43cc2c5a511ddaafdbbd0e997b522 Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Sat, 27 Jun 2026 08:10:49 -0300
Subject: [PATCH] veles: build database url from split secrets

---
 services/veles/backend-deployment.yaml               | 6 +++++-
 services/veles/oneoffs/veles-secrets-ensure-job.yaml | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/services/veles/backend-deployment.yaml b/services/veles/backend-deployment.yaml
index a02831eed..cac74a6b9 100644
--- a/services/veles/backend-deployment.yaml
+++ b/services/veles/backend-deployment.yaml
@@ -24,9 +24,13 @@ spec:
         vault.hashicorp.com/agent-inject-secret-veles-env.sh: "kv/data/atlas/veles/veles-db"
         vault.hashicorp.com/agent-inject-template-veles-env.sh: |
           {{- with secret "kv/data/atlas/veles/veles-db" }}
-          export DATABASE_URL="{{ .Data.data.DATABASE_URL }}"
+          unset DATABASE_URL
+          export VELES_DATABASE_HOST="{{ .Data.data.POSTGRES_HOST }}"
+          export VELES_DATABASE_PORT="{{ .Data.data.POSTGRES_PORT }}"
+          export VELES_DATABASE_NAME="{{ .Data.data.POSTGRES_DB }}"
           export VELES_DATABASE_USER="{{ .Data.data.POSTGRES_USER }}"
           export VELES_DATABASE_PASSWORD="{{ .Data.data.POSTGRES_PASSWORD }}"
+          export VELES_DATABASE_SSLMODE="disable"
           {{- end }}
           {{- with secret "kv/data/atlas/veles/veles-oidc" }}
           export VELES_OIDC_CLIENT_SECRET="{{ .Data.data.client_secret }}"
diff --git a/services/veles/oneoffs/veles-secrets-ensure-job.yaml b/services/veles/oneoffs/veles-secrets-ensure-job.yaml
index 4b7ef67b9..92221bc40 100644
--- a/services/veles/oneoffs/veles-secrets-ensure-job.yaml
+++ b/services/veles/oneoffs/veles-secrets-ensure-job.yaml
@@ -96,7 +96,7 @@ spec:
                 --arg db "veles" \
                 --arg user "veles" \
                 --arg password "${db_password}" \
-                '{data:{POSTGRES_HOST:$host,POSTGRES_PORT:$port,POSTGRES_DB:$db,POSTGRES_USER:$user,POSTGRES_PASSWORD:$password,DATABASE_URL:("postgresql://"+$user+":"+$password+"@"+$host+":"+$port+"/"+$db+"?sslmode=disable")}}')"
+                '{data:{POSTGRES_HOST:$host,POSTGRES_PORT:$port,POSTGRES_DB:$db,POSTGRES_USER:$user,POSTGRES_PASSWORD:$password,DATABASE_URL:("postgresql://"+($user|@uri)+":"+($password|@uri)+"@"+$host+":"+$port+"/"+($db|@uri)+"?sslmode=disable")}}')"
               write_secret veles/veles-db "${db_payload}"
 
               status="$(read_secret veles/app-secrets /tmp/app-secrets.json)"