From 09a027cf0f061c79c7517fcff4ad577c6f12859d Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Thu, 16 Jul 2026 23:16:33 +0200
Subject: [PATCH] fix: declare HWLAB production database and provider sources

---
 config/hwlab-node-lanes.yaml          |  2 +-
 config/platform-db/postgres-nc01.yaml | 63 +++++++++++++++++++++++++++
 2 files changed, 64 insertions(+), 1 deletion(-)

diff --git a/config/hwlab-node-lanes.yaml b/config/hwlab-node-lanes.yaml
index a66529c3..dbbb69ef 100644
--- a/config/hwlab-node-lanes.yaml
+++ b/config/hwlab-node-lanes.yaml
@@ -318,7 +318,7 @@ lanes:
           secretName: hwlab-production-bootstrap-admin
         codeAgentProvider:
           secretName: hwlab-production-code-agent-provider
-          sourceRef: hwlab/nc01-production-code-agent-provider.env
+          sourceRef: hwlab/nc01-v03-code-agent-provider.env
         codeAgentRuntime:
           controlPlaneTarget:
             node: NC01
diff --git a/config/platform-db/postgres-nc01.yaml b/config/platform-db/postgres-nc01.yaml
index b35c275f..70222024 100644
--- a/config/platform-db/postgres-nc01.yaml
+++ b/config/platform-db/postgres-nc01.yaml
@@ -151,6 +151,11 @@ postgres:
         user: tasktree
         address: 10.42.0.0/16
         method: scram-sha-256
+      - type: hostssl
+        database: hwlab_nc01_production
+        user: hwlab_nc01_production_app
+        address: 10.42.0.0/16
+        method: scram-sha-256
 
 secrets:
   source: master-local
@@ -256,6 +261,20 @@ secrets:
           TASKTREE_DB_NAME: tasktree
         randomHex:
           TASKTREE_DB_PASSWORD: 32
+    - name: hwlab-nc01-production-db-credentials
+      sourceRef: platform-db/hwlab-nc01-production-db.env
+      type: env
+      requiredKeys:
+        - HWLAB_NC01_PRODUCTION_DB_USER
+        - HWLAB_NC01_PRODUCTION_DB_PASSWORD
+        - HWLAB_NC01_PRODUCTION_DB_NAME
+      createIfMissing:
+        enabled: true
+        values:
+          HWLAB_NC01_PRODUCTION_DB_USER: hwlab_nc01_production_app
+          HWLAB_NC01_PRODUCTION_DB_NAME: hwlab_nc01_production
+        randomHex:
+          HWLAB_NC01_PRODUCTION_DB_PASSWORD: 32
 
 objects:
   roles:
@@ -322,6 +341,15 @@ objects:
         createdb: false
         createrole: false
         superuser: false
+    - name: hwlab_nc01_production_app
+      passwordRef:
+        sourceRef: platform-db/hwlab-nc01-production-db.env
+        key: HWLAB_NC01_PRODUCTION_DB_PASSWORD
+      login: true
+      attributes:
+        createdb: false
+        createrole: false
+        superuser: false
   databases:
     - name: agentrun_v02
       owner: agentrun_v02
@@ -363,6 +391,11 @@ objects:
       encoding: UTF8
       locale: C.UTF-8
       extensions: []
+    - name: hwlab_nc01_production
+      owner: hwlab_nc01_production_app
+      encoding: UTF8
+      locale: C.UTF-8
+      extensions: []
 
 managedOperations:
   monitorReset:
@@ -463,6 +496,36 @@ exports:
         - scope: hwlab-v03
           secret: hwlab-tasktree-db
           key: DATABASE_URL
+    - name: hwlab-nc01-production-cloud-api-database-url
+      sourceSecretRef: platform-db/hwlab-nc01-production-db.env
+      render:
+        envKey: DATABASE_URL
+        format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require
+        variables:
+          PGHOST: 10.42.0.1
+      writeToSecretSource:
+        sourceRef: hwlab/nc01-production-cloud-api-db.env
+        key: DATABASE_URL
+        mode: update-or-insert
+      consumers:
+        - scope: hwlab-production
+          secret: hwlab-cloud-api-production-db
+          key: DATABASE_URL
+    - name: hwlab-nc01-production-openfga-datastore-uri
+      sourceSecretRef: platform-db/hwlab-nc01-production-db.env
+      render:
+        envKey: DATASTORE_URI
+        format: postgres://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require
+        variables:
+          PGHOST: 10.42.0.1
+      writeToSecretSource:
+        sourceRef: hwlab/nc01-production-openfga-db.env
+        key: DATASTORE_URI
+        mode: update-or-insert
+      consumers:
+        - scope: hwlab-production
+          secret: hwlab-production-openfga
+          key: DATASTORE_URI
 
 backup:
   logicalDumps: