Phase D1 of ADR-0002 — the first step that creates real sandbox resources (Phase B was inert plumbing). erp gains envs = ["prod", "sandbox"] in postgres/iac/terraform.tfvars, so the elision flatten materialises a second instance.
What the apply adds (additive only)
instance
database
owner role
erp (unchanged)
erp
erp_role
erp-sandbox (new)
erp-sandbox
erp_sandbox_role
So the plan is ~6 resources to add for erp-sandbox (postgresql_role, postgresql_database, postgresql_grant_role, postgresql_function pgbouncer lookup, + 2 grants) and 0 changed / 0 destroyed on every existing app including prod erp. Verified the flatten output with a standalone tofu apply before pushing.
Merge gate
The CI tofu apply (postgres.yaml) must show the erp-sandbox additions and zero changes/destroys elsewhere. I'll dispatch it on this branch and confirm before merging.
Phase D sequence
D1 (this PR) — Postgres DB + role
D2 (tools) — Vault runtime policy + widened CI ops for erp-sandbox
## Summary
**Phase D1** of [ADR-0002](https://gitea.arcodange.lab/arcodange-org/factory/src/branch/main/vibe/ADR/0002-per-application-environments.md) — the first step that **creates real sandbox resources** (Phase B was inert plumbing). `erp` gains `envs = ["prod", "sandbox"]` in `postgres/iac/terraform.tfvars`, so the elision flatten materialises a second instance.
### What the apply adds (additive only)
| instance | database | owner role |
|---|---|---|
| `erp` (unchanged) | `erp` | `erp_role` |
| **`erp-sandbox` (new)** | `erp-sandbox` | `erp_sandbox_role` |
So the plan is **~6 resources to add** for erp-sandbox (`postgresql_role`, `postgresql_database`, `postgresql_grant_role`, `postgresql_function` pgbouncer lookup, + 2 grants) and **0 changed / 0 destroyed** on every existing app including prod `erp`. Verified the flatten output with a standalone `tofu apply` before pushing.
### Merge gate
The CI `tofu apply` (postgres.yaml) must show the erp-sandbox additions and **zero changes/destroys elsewhere**. I'll dispatch it on this branch and confirm before merging.
### Phase D sequence
- **D1 (this PR)** — Postgres DB + role
- D2 (tools) — Vault runtime policy + widened CI ops for erp-sandbox
- D3 (erp) — Vault k8s auth role + `postgres/creds/erp-sandbox` + `kvv2/erp-sandbox/config`
- D4 (factory) — ArgoCD `erp-sandbox` Application (GitOps)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Activates the sandbox environment for the ERP on the Postgres side
(ADR-0002 Phase D). `erp` gains `envs = ["prod", "sandbox"]`, so the
elision flatten now materialises a second instance `erp-sandbox`:
- database `erp-sandbox`
- owner role `erp_sandbox_role` (snake-case per the convention)
- pgbouncer user_lookup function + grants for the new DB
The prod `erp` instance is unchanged (db `erp`, role `erp_role`) — the
apply is purely additive (~6 resources for erp-sandbox, 0 changed,
0 destroyed on everything else). Verified the flatten output with a
standalone tofu apply before pushing.
This is D1 of the Phase D activation. D2 (tools Vault policies),
D3 (erp iac creds + KV), D4 (ArgoCD Application) follow in order.
Refs ADR-0002 (factory#15), Phase B (factory#16).
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Phase D1 of ADR-0002 — the first step that creates real sandbox resources (Phase B was inert plumbing).
erpgainsenvs = ["prod", "sandbox"]inpostgres/iac/terraform.tfvars, so the elision flatten materialises a second instance.What the apply adds (additive only)
erp(unchanged)erperp_roleerp-sandbox(new)erp-sandboxerp_sandbox_roleSo the plan is ~6 resources to add for erp-sandbox (
postgresql_role,postgresql_database,postgresql_grant_role,postgresql_functionpgbouncer lookup, + 2 grants) and 0 changed / 0 destroyed on every existing app including proderp. Verified the flatten output with a standalonetofu applybefore pushing.Merge gate
The CI
tofu apply(postgres.yaml) must show the erp-sandbox additions and zero changes/destroys elsewhere. I'll dispatch it on this branch and confirm before merging.Phase D sequence
postgres/creds/erp-sandbox+kvv2/erp-sandbox/configerp-sandboxApplication (GitOps)🤖 Generated with Claude Code