From 58eea3b6861ee6b193e2c46f3a5f8530f25ded64 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sat, 4 Apr 2026 18:57:36 -0500
Subject: [PATCH] fix: remove destructive initContainer, use one-time Argo CD
 hook Job for schema install

---
 servers/legion/k8s/listmonk/deployment.yaml   | 34 --------------
 .../legion/k8s/listmonk/schema-init-job.yaml  | 46 +++++++++++++++++++
 2 files changed, 46 insertions(+), 34 deletions(-)
 create mode 100644 servers/legion/k8s/listmonk/schema-init-job.yaml

diff --git a/servers/legion/k8s/listmonk/deployment.yaml b/servers/legion/k8s/listmonk/deployment.yaml
index 24cfff8..db1166a 100644
--- a/servers/legion/k8s/listmonk/deployment.yaml
+++ b/servers/legion/k8s/listmonk/deployment.yaml
@@ -14,40 +14,6 @@ spec:
       labels:
         app: listmonk
     spec:
-      initContainers:
-        # Run `--install` on first boot to create the schema; exits 0 if already installed
-        - name: listmonk-install
-          image: listmonk/listmonk:v4.1.0
-          command: ["/bin/sh", "-c", "./listmonk --install --yes 2>&1 | tail -5; exit 0"]
-          env:
-            - name: LISTMONK_db__host
-              value: "postgres-postgresql.platform.svc.cluster.local"
-            - name: LISTMONK_db__port
-              value: "5432"
-            - name: LISTMONK_db__name
-              valueFrom:
-                secretKeyRef:
-                  name: listmonk-secrets
-                  key: db_name
-            - name: LISTMONK_db__user
-              valueFrom:
-                secretKeyRef:
-                  name: listmonk-secrets
-                  key: db_user
-            - name: LISTMONK_db__password
-              valueFrom:
-                secretKeyRef:
-                  name: listmonk-secrets
-                  key: db_password
-            - name: LISTMONK_db__ssl_mode
-              value: "disable"
-            - name: LISTMONK_app__admin_username
-              value: "admin"
-            - name: LISTMONK_app__admin_password
-              valueFrom:
-                secretKeyRef:
-                  name: listmonk-secrets
-                  key: admin_password
       containers:
         - name: listmonk
           image: listmonk/listmonk:v4.1.0
diff --git a/servers/legion/k8s/listmonk/schema-init-job.yaml b/servers/legion/k8s/listmonk/schema-init-job.yaml
new file mode 100644
index 0000000..1a24745
--- /dev/null
+++ b/servers/legion/k8s/listmonk/schema-init-job.yaml
@@ -0,0 +1,46 @@
+---
+# One-time job to install the listmonk database schema.
+# WARNING: --install wipes and recreates tables. Only run on fresh DB.
+# This job has a unique name with a timestamp suffix to prevent re-running.
+# After first successful run it completes and TTL cleans it up.
+# To re-install schema (destructive): delete this job and re-apply.
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: listmonk-schema-init-v1
+  namespace: listmonk
+  annotations:
+    # Prevent Argo CD from pruning a completed job
+    argocd.argoproj.io/hook: Sync
+    argocd.argoproj.io/hook-delete-policy: HookSucceeded
+spec:
+  ttlSecondsAfterFinished: 600
+  template:
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: listmonk-install
+          image: listmonk/listmonk:v4.1.0
+          command: ["/bin/sh", "-c", "cd /listmonk && ./listmonk --install --yes"]
+          env:
+            - name: LISTMONK_db__host
+              value: "postgres-postgresql.platform.svc.cluster.local"
+            - name: LISTMONK_db__port
+              value: "5432"
+            - name: LISTMONK_db__name
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: db_name
+            - name: LISTMONK_db__user
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: db_user
+            - name: LISTMONK_db__password
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: db_password
+            - name: LISTMONK_db__ssl_mode
+              value: "disable"