From 31363d2631fafe8925f067f2f16b6ff9ff426597 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sun, 29 Mar 2026 19:59:34 -0500
Subject: [PATCH] Configure LuckPerms with PostgreSQL backend for persistent
 permissions

- LuckPerms stores all permissions/groups in Postgres (not ephemeral ops.json)
- Mount luckperms config.yml from ConfigMap with DB connection details
- LP_PASSWORD injected from same secret as DB_PASSWORD
- OPS env var kept as bootstrap until LuckPerms admin group is configured
---
 .../k8s/mudcraft/configmap-luckperms.yaml     | 37 +++++++++++++++++++
 servers/legion/k8s/mudcraft/statefulset.yaml  | 11 ++++++
 2 files changed, 48 insertions(+)
 create mode 100644 servers/legion/k8s/mudcraft/configmap-luckperms.yaml

diff --git a/servers/legion/k8s/mudcraft/configmap-luckperms.yaml b/servers/legion/k8s/mudcraft/configmap-luckperms.yaml
new file mode 100644
index 0000000..445525c
--- /dev/null
+++ b/servers/legion/k8s/mudcraft/configmap-luckperms.yaml
@@ -0,0 +1,37 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mudcraft-luckperms
+  namespace: mudcraft
+data:
+  config.yml: |
+    # LuckPerms configuration for MUDCraft
+    # Storage backend: PostgreSQL (shared cluster Postgres)
+
+    server: mudcraft
+
+    storage-method: postgresql
+
+    data:
+      address: postgres-postgresql.platform.svc.cluster.local:5432
+      database: mudcraft
+      username: mudcraft
+      # Password injected at runtime via LP_PASSWORD env var (see statefulset)
+      password: ${LP_PASSWORD}
+      pool-settings:
+        maximum-pool-size: 10
+        minimum-idle: 10
+        maximum-lifetime: 1800000
+        connection-timeout: 5000
+
+    # Use UUID cache so player lookups don't hit Mojang API on every join
+    use-server-uuid-cache: true
+
+    # Sync permissions across any future additional server instances
+    messaging-service: none
+
+    # Auto-save player data when they disconnect
+    auto-save: true
+
+    log-notify: true
diff --git a/servers/legion/k8s/mudcraft/statefulset.yaml b/servers/legion/k8s/mudcraft/statefulset.yaml
index 967f3d2..87ba954 100644
--- a/servers/legion/k8s/mudcraft/statefulset.yaml
+++ b/servers/legion/k8s/mudcraft/statefulset.yaml
@@ -61,6 +61,11 @@ spec:
                 secretKeyRef:
                   name: mudcraft-secrets
                   key: db-password
+            - name: LP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mudcraft-secrets
+                  key: db-password
           volumeMounts:
             - name: worlds
               mountPath: /data/worlds
@@ -71,6 +76,9 @@ spec:
             - name: purpurextras-config
               mountPath: /data/plugins/PurpurExtras/config.yml
               subPath: config.yml
+            - name: luckperms-config
+              mountPath: /data/plugins/LuckPerms/config.yml
+              subPath: config.yml
           resources:
             requests:
               memory: 5Gi
@@ -107,3 +115,6 @@ spec:
         - name: purpurextras-config
           configMap:
             name: mudcraft-purpurextras
+        - name: luckperms-config
+          configMap:
+            name: mudcraft-luckperms