From fe7093162783cd3c01316fcbc1dcf3c454cbdce5 Mon Sep 17 00:00:00 2001
From: Bryan Rawlins <bryan.rawlins@wyyerd.com>
Date: Thu, 2 Jul 2026 08:44:30 -0700
Subject: [PATCH 1/2] Fix postgres StatefulSet crash under
 readOnlyRootFilesystem

The postgres container sets readOnlyRootFilesystem: true but never
mounted a writable volume at /var/run/postgresql, so the official
postgres image's entrypoint fails to create its Unix socket lock file
on every start:

  FATAL: could not create lock file
  "/var/run/postgresql/.s.PGSQL.5432.lock": Read-only file system

Add an emptyDir volume mounted at /var/run/postgresql, matching the
existing dshm pattern.
---
 charts/patchmon/Chart.yaml                          | 2 +-
 charts/patchmon/templates/postgres-statefulset.yaml | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/charts/patchmon/Chart.yaml b/charts/patchmon/Chart.yaml
index 934fc33..1c4cf1c 100644
--- a/charts/patchmon/Chart.yaml
+++ b/charts/patchmon/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: patchmon
 description: PatchMon v2 – Linux patch management platform with optional Gateway API, Postgres, Valkey, and Guacd
 type: application
-version: 0.3.2
+version: 0.3.3
 appVersion: "2.0.2"
 
 maintainers:
diff --git a/charts/patchmon/templates/postgres-statefulset.yaml b/charts/patchmon/templates/postgres-statefulset.yaml
index cb627d7..1278aee 100644
--- a/charts/patchmon/templates/postgres-statefulset.yaml
+++ b/charts/patchmon/templates/postgres-statefulset.yaml
@@ -62,10 +62,14 @@ spec:
               mountPath: /var/lib/postgresql/data
             - name: dshm
               mountPath: /dev/shm
+            - name: run
+              mountPath: /var/run/postgresql
       volumes:
         - name: dshm
           emptyDir:
             medium: Memory
+        - name: run
+          emptyDir: {}
       {{- with .Values.postgres.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

From 76e4167851bb437756a5f5c42bcde61597dd4d84 Mon Sep 17 00:00:00 2001
From: Bryan Rawlins <bryan.rawlins@wyyerd.com>
Date: Thu, 2 Jul 2026 15:47:15 -0700
Subject: [PATCH 2/2] Allow pinning SESSION_SECRET and AI_ENCRYPTION_KEY via
 values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

lookup-based persistence only works against a live cluster (helm
upgrade/install). GitOps controllers that render via `helm template`
(ArgoCD, Flux) always get an empty lookup result, so these two secrets
were regenerating on every render and forcing a server pod restart via
the checksum/secret annotation on every sync — same class of issue as
the existing postgres.auth.existingSecret / patchmon.jwt.secret escape
hatches, just missing for these two fields.
---
 charts/patchmon/Chart.yaml            |  2 +-
 charts/patchmon/templates/secret.yaml |  4 ++--
 charts/patchmon/values.yaml           | 12 ++++++++++++
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/charts/patchmon/Chart.yaml b/charts/patchmon/Chart.yaml
index 1c4cf1c..0483ae8 100644
--- a/charts/patchmon/Chart.yaml
+++ b/charts/patchmon/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: patchmon
 description: PatchMon v2 – Linux patch management platform with optional Gateway API, Postgres, Valkey, and Guacd
 type: application
-version: 0.3.3
+version: 0.3.4
 appVersion: "2.0.2"
 
 maintainers:
diff --git a/charts/patchmon/templates/secret.yaml b/charts/patchmon/templates/secret.yaml
index 91b44d3..0bdf592 100644
--- a/charts/patchmon/templates/secret.yaml
+++ b/charts/patchmon/templates/secret.yaml
@@ -42,8 +42,8 @@ stringData:
   POSTGRES_PASSWORD: {{ default (randAlphaNum 32) $oldPg | quote }}
 {{- end }}
   JWT_SECRET: {{ default (randAlphaNum 64) (default $oldJwt .Values.patchmon.jwt.secret) | quote }}
-  SESSION_SECRET: {{ default (randAlphaNum 64) $oldSession | quote }}
-  AI_ENCRYPTION_KEY: {{ default (randAlphaNum 64) $oldAiKey | quote }}
+  SESSION_SECRET: {{ default (randAlphaNum 64) (default $oldSession .Values.patchmon.session.secret) | quote }}
+  AI_ENCRYPTION_KEY: {{ default (randAlphaNum 64) (default $oldAiKey .Values.patchmon.encryption.aiKey) | quote }}
 {{- if .Values.valkey.auth.enabled }}
   REDIS_PASSWORD: {{ default (randAlphaNum 32) $oldRedis | quote }}
 {{- end }}
diff --git a/charts/patchmon/values.yaml b/charts/patchmon/values.yaml
index 2341afe..0bfcca4 100644
--- a/charts/patchmon/values.yaml
+++ b/charts/patchmon/values.yaml
@@ -94,6 +94,18 @@ patchmon:
     secret: ""
     expiresIn: "1h"
 
+  session:
+    # If empty, a random value is generated and persisted in the Secret via lookup.
+    # Note: the lookup fallback only works with `helm upgrade`/`install` against a live
+    # cluster — GitOps controllers that render via `helm template` (e.g. ArgoCD) always
+    # see an empty lookup result, so leaving this blank there means a new random value
+    # (and pod restart via the checksum/secret annotation) on every render.
+    secret: ""
+
+  encryption:
+    # Same lookup caveat as patchmon.session.secret above.
+    aiKey: ""
+
   auth:
     maxLoginAttempts: 5
     lockoutDurationMinutes: 15