From 6018ee8221c30555281cb95ea98e372768596581 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 22 Aug 2026 15:16:31 +1000
Subject: [PATCH] arrstack: use waitfordb initContainer instead of inline psql
 loop

The sonarr/radarr/prowlarr deployments gated startup on Postgres with a
hand-written psql-in-a-shell loop running the postgres:17-alpine image.
Replace it with the purpose-built waitfordb image (v0.1.0), which reads the
same PG* env as a libpq fallback and exits 0 once SELECT 1 succeeds.

- swap image to docker-internal/waitfordb:v0.1.0 (pinned), drop the sh/psql
  command (waitfordb is the entrypoint)
- keep the existing PGHOST/PGPORT/PGDATABASE/PGUSER/PGPASSWORD env, name,
  and resources unchanged
- add WAITFORDB_TIMEOUT=5m so a stuck DB fails the pod fast, and
  WAITFORDB_SSLMODE=disable to match the in-cluster Postgres
---
 apps/base/arrstack/prowlarr/deployment.yaml | 16 ++++++----------
 apps/base/arrstack/radarr/deployment.yaml   | 16 ++++++----------
 apps/base/arrstack/sonarr/deployment.yaml   | 16 ++++++----------
 3 files changed, 18 insertions(+), 30 deletions(-)

diff --git a/apps/base/arrstack/prowlarr/deployment.yaml b/apps/base/arrstack/prowlarr/deployment.yaml
index 6ee4d6a..fc976cb 100644
--- a/apps/base/arrstack/prowlarr/deployment.yaml
+++ b/apps/base/arrstack/prowlarr/deployment.yaml
@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT
diff --git a/apps/base/arrstack/radarr/deployment.yaml b/apps/base/arrstack/radarr/deployment.yaml
index f52555f..a19e944 100644
--- a/apps/base/arrstack/radarr/deployment.yaml
+++ b/apps/base/arrstack/radarr/deployment.yaml
@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT
diff --git a/apps/base/arrstack/sonarr/deployment.yaml b/apps/base/arrstack/sonarr/deployment.yaml
index 9330c47..526b533 100644
--- a/apps/base/arrstack/sonarr/deployment.yaml
+++ b/apps/base/arrstack/sonarr/deployment.yaml
@@ -31,18 +31,14 @@ spec:
       initContainers:
         # Gate the app on its own Postgres database+role being reachable, instead
         # of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
-        # libpq reads PG* from env, so the password never lands in argv.
+        # waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
         - name: wait-for-db
-          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/postgres:17-alpine
-          command:
-            - sh
-            - -c
-            - |
-              until psql -tAc 'select 1' >/dev/null 2>&1; do
-                echo "waiting for $PGDATABASE on $PGHOST..."; sleep 3
-              done
-              echo "database ready"
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
           env:
+            - name: WAITFORDB_TIMEOUT
+              value: 5m
+            - name: WAITFORDB_SSLMODE
+              value: disable
             - name: PGHOST
               value: arrstack-postgres-rw.arrstack.svc.cluster.local
             - name: PGPORT
-- 
2.47.3