From e18d953ff96d74e4dd7818ac9b8090fd57af73a9 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sun, 26 Apr 2026 02:33:26 -0500
Subject: [PATCH] Wire marketplace Postgres datasource for neuron-mcp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add MARKETPLACE_DB_URL/USER to ConfigMap and MARKETPLACE_DB_PASSWORD
ExternalSecret (sourced from secret/legion-db in Vault). Remove the
SQLite subPath volume mount and fix-data-ownership initContainer from
the blue deployment — marketplace storage is now in Postgres.
---
 .../k8s/neuron-technologies/prod/configmap.yaml   |  3 ++-
 .../neuron-technologies/prod/externalsecret.yaml  |  4 ++++
 .../neuron-technologies/prod/mcp-deployment.yaml  | 15 +--------------
 3 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/servers/legion/k8s/neuron-technologies/prod/configmap.yaml b/servers/legion/k8s/neuron-technologies/prod/configmap.yaml
index 3336cdc..5263216 100644
--- a/servers/legion/k8s/neuron-technologies/prod/configmap.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/configmap.yaml
@@ -7,8 +7,9 @@ data:
   SPRING_PROFILES_ACTIVE: "prod"
   NEURON_DATA_DIR: "/data"
   NEURON_DB_PATH: "/data/neuron.db"
-  NEURON_MARKETPLACE_DB_PATH: "/data/neuron-marketplace.db"
   NEURON_STORAGE_PATH: "/data"
+  MARKETPLACE_DB_URL: "jdbc:postgresql://postgres-postgresql.platform.svc.cluster.local:5432/neuron_marketplace"
+  MARKETPLACE_DB_USER: "postgres"
   SERVER_TOMCAT_ACCESSLOG_ENABLED: "true"
   # Prod: minimal surface — never expose internals
   MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE: "health,info"
diff --git a/servers/legion/k8s/neuron-technologies/prod/externalsecret.yaml b/servers/legion/k8s/neuron-technologies/prod/externalsecret.yaml
index f49dabf..3cb141d 100644
--- a/servers/legion/k8s/neuron-technologies/prod/externalsecret.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/externalsecret.yaml
@@ -56,3 +56,7 @@ spec:
       remoteRef:
         key: secret/data/neuron-technologies/marketing
         property: stripe_marketplace_webhook_secret
+    - secretKey: MARKETPLACE_DB_PASSWORD
+      remoteRef:
+        key: secret/data/legion-db
+        property: postgres_password
diff --git a/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml b/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
index fd06044..9007925 100644
--- a/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
+++ b/servers/legion/k8s/neuron-technologies/prod/mcp-deployment.yaml
@@ -22,7 +22,7 @@ spec:
         slot: blue
         env: prod
       annotations:
-        config-hash: "marketplace-db-subpath-v3"
+        config-hash: "marketplace-postgres-v1"
     spec:
       terminationGracePeriodSeconds: 30
       securityContext:
@@ -30,16 +30,6 @@ spec:
         runAsUser: 1000
         seccompProfile:
           type: RuntimeDefault
-      initContainers:
-        - name: fix-data-ownership
-          image: busybox:1.36
-          command: ["sh", "-c", "touch /data/neuron-marketplace.db && chown -R 1000:1000 /data"]
-          securityContext:
-            runAsUser: 0
-            runAsNonRoot: false
-          volumeMounts:
-            - name: data
-              mountPath: /data
       containers:
         - name: neuron-mcp
           image: registry.neuralplatform.ai/neuron-technologies/neuron-mcp:v0.15.3
@@ -67,9 +57,6 @@ spec:
           volumeMounts:
             - name: data
               mountPath: /data
-            - name: data
-              mountPath: /app/neuron-marketplace.db
-              subPath: neuron-marketplace.db
           resources:
             requests:
               cpu: 250m