feat(cmangos-ptr): dedicated MariaDB for PTR [DO NOT MERGE — gated]

[xunholy]

Caution

DO NOT MERGE. Gated on two external prerequisites (below). Kept as a draft so it can't merge accidentally. Merging without these breaks all PTR logins and/or PTR DB init.

What

Moves PTR's ptrmangos / ptrcharacters / ptrlogs onto a dedicated MariaDB (cmangos-ptr-database). The shared cmangos-database keeps only the auth DB (classicrealmd) + live's game DBs. This removes the world/character connection + buffer-pool contention that OOM-killed the shared instance and broke live logins on 2026-06-18.

classicrealmd (realmlist + accounts + session keys) stays shared, so single-auth / both-realms-visible / GM-flags-carry-over is unchanged. PTR's mangosd becomes the only cross-instance client (login → shared, world/char/logs → its own box).

⛔ Prerequisites (do both before un-drafting)

1. Fork image — add MANGOS_REALMD_DBHOST to the entrypoint in xunholy/cmangos-classic so the login DB can be on a different host than world/char/logs, defaulting to MANGOS_DBHOST (so live/realmd are unaffected). Build + pin the PTR image. Without it, PTR login lookups hit the new instance, find no classicrealmd, and every PTR login fails.
2. 1Password — add a DB_ROOT_PASSWORD field to the cmangos item. The new cmangos-ptr-database-creds ExternalSecret needs it for first-init root. Scoped to a dedicated secret so a missing key can't disrupt live auth.

Changes

• New cmangos-ptr-database app: HelmRelease (mariadb:12.2), PVC (10Gi), dedicated ExternalSecret, ks.yaml; registered in the ArtifactGenerator + cluster-00 overlay. No VolSync — PTR data is reconstructible via the db-init Job.
• cmangos-ptr: MANGOS_DBHOST → cmangos-ptr-database; add MANGOS_REALMD_DBHOST=cmangos-database; wait-db waits for both instances; dependsOn: cmangos-ptr-database (it owns the creds secret the Job uses).
• db-init Job → cross-instance clone: read live as the app user, create/grant/restore on the new instance as root; *_db_version rows copied via single-table dumps (cross-instance INSERT…SELECT can't work anymore).
• Shared cmangos-database-creds / externalsecret-database.yaml untouched.

Cutover (once prerequisites are met)

1. Ship + PTR-pin the image (prereq 1); confirm live still boots (default-fallback path).
2. Add DB_ROOT_PASSWORD to 1Password (prereq 2).
3. Mark ready + merge → cmangos-ptr-database comes up; db-init clones ptr* onto it; PTR mangosd rolls onto the new instance.
4. Verify a GM login + a bot spawn on PTR.
5. Reclaim: DROP DATABASE ptrmangos/ptrcharacters/ptrlogs on the shared cmangos-database — this is what actually relieves the shared instance.

Rollback before step 5: revert the cmangos-ptr env change (points back at cmangos-database, old ptr* still there). Instant, no data loss.

Validation done

• kustomize build new app dir → ExternalSecret + HelmRelease + PVC render
• kustomize build --load-restrictor LoadRestrictionsNone overlays/cluster-00 → 153 docs
• yamllint + full pre-commit suite → passed
• Coherence: realm-row-migration still writes shared classicrealmd; db-init admins new instance / reads live

https://claude.ai/code/session_01T37E9UJr2ymcGhQoV8Yq93

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	k8s-gitops	39999f1	Commit Preview URL Branch Preview URL	Jun 24 2026, 11:25 PM

[unholy-bot]

--- kubernetes/apps/overlays/cluster-00 Kustomization: flux-system/cluster ArtifactGenerator: flux-system/k8s-gitops

+++ kubernetes/apps/overlays/cluster-00 Kustomization: flux-system/cluster ArtifactGenerator: flux-system/k8s-gitops

@@ -72,12 +72,17 @@

   - copy:
     - from: '@repo/apps/base/game-servers/cmangos-ptr/app/'
       to: '@artifact/apps/base/game-servers/cmangos-ptr/app/'
     name: cmangos-ptr
     originRevision: '@repo'
   - copy:
+    - from: '@repo/apps/base/game-servers/cmangos-ptr-database/app/'
+      to: '@artifact/apps/base/game-servers/cmangos-ptr-database/app/'
+    name: cmangos-ptr-database
+    originRevision: '@repo'
+  - copy:
     - from: '@repo/apps/base/game-servers/cmangos-realmd/app/'
       to: '@artifact/apps/base/game-servers/cmangos-realmd/app/'
     name: cmangos-realmd
     originRevision: '@repo'
   - copy:
     - from: '@repo/apps/base/crossplane-system/crossplane/providers/'
--- kubernetes/apps/overlays/cluster-00 Kustomization: flux-system/cluster Kustomization: game-servers/cmangos-ptr

+++ kubernetes/apps/overlays/cluster-00 Kustomization: flux-system/cluster Kustomization: game-servers/cmangos-ptr

@@ -8,12 +8,15 @@

     kustomize.toolkit.fluxcd.io/namespace: flux-system
   name: cmangos-ptr
   namespace: game-servers
 spec:
   decryption:
     provider: sops
+  dependsOn:
+  - name: cmangos-ptr-database
+    namespace: game-servers
   interval: 30m
   path: ./apps/base/game-servers/cmangos-ptr/app
   prune: true
   retryInterval: 1m
   sourceRef:
     kind: ExternalArtifact
--- kubernetes/apps/overlays/cluster-00 Kustomization: flux-system/cluster Kustomization: game-servers/cmangos-ptr-database

+++ kubernetes/apps/overlays/cluster-00 Kustomization: flux-system/cluster Kustomization: game-servers/cmangos-ptr-database

@@ -0,0 +1,30 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    gitops.owncloud.ai/defaults: disabled
+    kustomize.toolkit.fluxcd.io/name: cluster
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: cmangos-ptr-database
+  namespace: game-servers
+spec:
+  decryption:
+    provider: sops
+  dependsOn:
+  - name: onepassword
+    namespace: external-secrets
+  - name: rook-ceph-cluster
+    namespace: rook-ceph
+  interval: 30m
+  path: ./apps/base/game-servers/cmangos-ptr-database/app
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: ExternalArtifact
+    name: cmangos-ptr-database
+    namespace: flux-system
+  targetNamespace: game-servers
+  timeout: 10m
+  wait: true
+