From 63d54d9ea0d729d6cb83f1bfc5d3be8661357144 Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Sun, 29 Mar 2026 20:41:39 -0500
Subject: [PATCH] fix(mudcraft): substitute LP_PASSWORD in LuckPerms config at
 init time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

LuckPerms reads config.yml as a literal string — ${LP_PASSWORD} was
never being substituted, causing auth failures against PostgreSQL.
initContainer now has the secret injected as an env var and uses sed
to write the real password into the config before LuckPerms reads it.

Also adds faultexception to WHITELIST so they can connect.
---
 servers/legion/k8s/mudcraft/configmap.yaml   |  1 +
 servers/legion/k8s/mudcraft/statefulset.yaml | 10 ++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/servers/legion/k8s/mudcraft/configmap.yaml b/servers/legion/k8s/mudcraft/configmap.yaml
index 002bdec..56c6e75 100644
--- a/servers/legion/k8s/mudcraft/configmap.yaml
+++ b/servers/legion/k8s/mudcraft/configmap.yaml
@@ -22,6 +22,7 @@ data:
   ENFORCE_WHITELIST: "true"
   WHITELIST_ENABLED: "true"
   OPS: "faultexception"
+  WHITELIST: "faultexception"
   ENABLE_RCON: "true"
   RCON_PORT: "25575"
   MOTD: "MUDCraft — Private Beta"
diff --git a/servers/legion/k8s/mudcraft/statefulset.yaml b/servers/legion/k8s/mudcraft/statefulset.yaml
index e71bfe4..bbdade6 100644
--- a/servers/legion/k8s/mudcraft/statefulset.yaml
+++ b/servers/legion/k8s/mudcraft/statefulset.yaml
@@ -17,7 +17,7 @@ spec:
       labels:
         app: mudcraft
       annotations:
-        kubectl.kubernetes.io/restartedAt: "2026-03-30T02:30:00Z"
+        kubectl.kubernetes.io/restartedAt: "2026-03-30T02:45:00Z"
     spec:
       terminationGracePeriodSeconds: 120
       securityContext:
@@ -32,6 +32,12 @@ spec:
           securityContext:
             runAsUser: 1000
             runAsGroup: 1000
+          env:
+            - name: LP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mudcraft-secrets
+                  key: db-password
           command:
             - sh
             - -c
@@ -39,7 +45,7 @@ spec:
               rm -rf /target/*.jar
               cp -r /plugins/* /target/
               mkdir -p /target/LuckPerms
-              cp /luckperms-config/config.yml /target/LuckPerms/config.yml
+              sed "s|\${LP_PASSWORD}|${LP_PASSWORD}|g" /luckperms-config/config.yml > /target/LuckPerms/config.yml
               mkdir -p /target/PurpurExtras
               cp /purpurextras-config/config.yml /target/PurpurExtras/config.yml
               echo 'Plugins installed'