vad: provision premises

Namespace entry (regcred only, the namespace itself comes from flux),
database premises with uuid-ossp, bucket premises, postgres creds in
apps/premises/postgres, kafka creds for the shared proc user, S3 creds like
the other vad apps, and the premises vault role bound to premises-vault.

infrastructure-secrets.yaml

@@ -3726,6 +3726,24 @@ environments:
                     token_ttl: 24h
                     read_paths:
                         - vault/apps/cde
+                premises:
+                    enabled: true
+                    policy_name: premises
+                    role_name: premises
+                    service_account_names:
+                        - premises-vault
+                    service_account_namespaces:
+                        - premises
+                    token_ttl: 24h
+                    read_paths:
+                        - apps/premises/postgres
+                        - kafka/apps/premises
+                        - minio/apps/premises
+                        - apps/issues/postgres
+                        - apps/inspections/postgres
+                        - apps/checklists/postgres
+                        - apps/eav/postgres
+                        - apps/django/postgres
             data:
                 common:
                     regcred:
@@ -3883,6 +3901,14 @@ environments:
                                     - name: ENC[AES256_GCM,data:fuqBU0KdWN0Df7Y=,iv:qw0HhNN29Cn4ocawzrb+klNeirU53kd+QMCpBuq3GyI=,tag:X568WL6HjiBEot+Mf6mo7w==,type:str]
                                 client:
                                     endpoint: ENC[AES256_GCM,data:RSIYRckvdd/M+nJIGheCdQ8gO5Kev0OaOg2mM93IouSLtMOXWj+CFj8s,iv:xBd0IosN2NwkaVdF02v3D0ecyhc0FD++kHEPZMNMtFM=,tag:RpGCfKFMu3jWBPxQEnl35A==,type:str]
+                            premises:
+                                enabled: ENC[AES256_GCM,data:n6Lynw==,iv:tgAgA6UosF3VN+a7TPpR9GCypb54mhWeYHqhz35EETE=,tag:Hg6nxas7jc17PIe0AEjVdg==,type:bool]
+                                access_key: ENC[AES256_GCM,data:wGk4kNkUxVWIkw==,iv:LUo64CuuWI/bWxJf6rBDoS/ILHzwTFrJZevcRI9a9nU=,tag:ZhYFHp6U2F5ZuV9YebRDhg==,type:str]
+                                secret_key: ENC[AES256_GCM,data:1NgHgGAvqi55KZ9bAEqfuI+ob/O8f0qfoMsqxB5h264=,iv:LNUrXyC1Bq3kHQtehDUzbzb1WDt3/vi6AirHnH3Sxr4=,tag:pqe+tQd4JE+0SgRPCVtEDg==,type:str]
+                                buckets:
+                                    - name: ENC[AES256_GCM,data:HNAe/HYYNp4=,iv:a48YjSZGCCHhjzP/A2ibyIHSGbWu50r3UzhgEQcEo/o=,tag:w+gwVoMx+Oagjab/75PXww==,type:str]
+                                client:
+                                    endpoint: ENC[AES256_GCM,data:Fz7JsTEVHEjkAx/As1Subo/ydPEXvO3jZjpU6A4vMgycuXWU6Gu7OzI9,iv:Ah30DV9T26kXUVsCmeEyfxapblWWHBcVCY3mlXI/Lrs=,tag:Ic5tceir4ntqhuHdsCzHFQ==,type:str]
                     kafka:
                         bootstrap:
                             enabled: ENC[AES256_GCM,data:M1a7YQ==,iv:BUtWotQMOgnAw94/oL7thClJVgumLZccpBDT8E5DBBo=,tag:wCGjmG9n843uolqR6hCbZg==,type:bool]
@@ -3924,6 +3950,15 @@ environments:
                                 generate: ENC[AES256_GCM,data:PRVN9sw=,iv:Mu+Zu0JpGczmrebkqvhxiTg5qGxKPhAoAKgI/8o7dW8=,tag:n4Q+qqmDHS4EMgHOyvVhcQ==,type:bool]
                                 username: ENC[AES256_GCM,data:u68=,iv:W513flw5QNpZZhVPLsrxF8goYq/ebaNSeO2O+Fb49Es=,tag:FbxAoKoCFeUY9mwAPQTSBQ==,type:str]
                                 password: ENC[AES256_GCM,data:gnRYW2zPTZtcvf+SYOzPCorAvWgufMEaRISwDPORhFk=,iv:uQHm6JBV+1dUHmp3QKDobC1oq48p653os5aISp1L+pY=,tag:K0DTkSzGVN/twugDq4Yy1g==,type:str]
+                            premises:
+                                enabled: ENC[AES256_GCM,data:wZQ3MA==,iv:VotL0OreHG/KxvFegObz/a1hmcwzJszxF36sG2dUq+8=,tag:R26d7JyQZbQaPxBIIbSIwA==,type:bool]
+                                generate: ENC[AES256_GCM,data:SHL0Llo=,iv:uEGygLh6AsVnqwoyYgoMhjfcAo/Qj+RBtlpBBl0OKbU=,tag:5/mvQDzNfvs9yUdq8EcB9w==,type:bool]
+                                username: ENC[AES256_GCM,data:mLAgGQ==,iv:DVfXlK250/QiA4nlfFT2Ps0ZuDXrB5YcAfKT+1ivocE=,tag:MH01fSJSuogQj27RZfW8CQ==,type:str]
+                                password: ENC[AES256_GCM,data:d3ln2gtQfgfQJuPyGIOWcNEzZ9m0sE3wKFBzmSgZ8AE=,iv:/O1ASChCZ9Q+aHE+/kkssFx0UgKlTs3LpYFxPmE7n38=,tag:4G62mYIXVshP8g2xp1NMng==,type:str]
+                                auth:
+                                    bootstrap_servers: ENC[AES256_GCM,data:F5Ln9jmnDS5RVuMM4/h1epGbSwtse5f7MhFdepTqzmilVQV/grr5m7GXpRTnGFpi,iv:BH0D8vznc02LKGyYl+Txo12ZYu+GwuR4NMy+kNN5q/U=,tag:4KLiz3wTsVgC6X3bSsnUmQ==,type:str]
+                                    security_protocol: ENC[AES256_GCM,data:bGxSCIVaiqg=,iv:cxlfjdBzJrt6RatHoRAK9BNJwml0dVhw8p3VFm02d94=,tag:vnFm4+4HyBAmGwMdIaoe+A==,type:str]
+                                    sasl_mechanism: ENC[AES256_GCM,data:0A9UNZT/b0NhCVv9yw==,iv:rw9zj0qwLXzOBLv9vwXOjar6w6LK7aKz3Vj4dndidWc=,tag:p2O8nTWWnjW2l8RDXJudHw==,type:str]
                     zitadel:
                         postgresql:
                             enabled: ENC[AES256_GCM,data:Y6vtaiY=,iv:6KOQQte9gY0roUrgUb2+cfxLgAuo4C2Y5NLtAAEEsCU=,tag:a7Plmcy8SXiy7cfixaeQtw==,type:bool]
@@ -4360,6 +4395,15 @@ environments:
                     source:
                         kind: secret_ref
                         ref: vault://rabbitmq/apps/cde#vhost
+            - name: premises-postgres
+              namespace: premises
+              type: database
+              sink: vault
+              vault_path: apps/premises/postgres
+              depends_on:
+                cluster: main
+                db: premises
+                user: premises
     sarex-contour:
         vault:
             enabled: true
@@ -6132,7 +6176,7 @@ sops:
             dkhZMjdzdUh4bEQ5dDN2NnZabjBtUTQKeV6OU8Ob1P9j9E2G8ydznEX+vjHQhlEP
             fXp6UP1kQrRRAOEuhH4cyXT2YgPq5HMcDemyFHUH0JPxiew370fMzA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-10-08T09:12:10Z"
+    lastmodified: "2026-10-10T08:22:32Z"
-    mac: ENC[AES256_GCM,data:7muUpNA8ZNEK9O/cH0IIzIwY3+SHGOTqK8mWkZ7O9CwkuDPHJ18CC2OQX7c2MzMpMbDQieT8ym1Kk2DOu3LcIaK3BVhXxk52nVGagBK8HrEmxdsEOTK+gZ/tjeR5QK2Na0RG290xQBMOng4nT8WhJ7c/m09zKwGkBHzrtc7+Ggo=,iv:5ZGVTQptsJ1Lyf5pUJS4JrVKd6SVTnumN9OgOGOI7rs=,tag:fuCVCvWpcpcpiLTJtcvmEQ==,type:str]
+    mac: ENC[AES256_GCM,data:vz08AKyfHvldS7HYZIKP/BiBuK7hD8ymKxOWGAU6ZxEE/FENp2q+diz4AzlBpsoCtIpbOn+6Cn/r+yancAge7dU49sgjtNFfTjMYOkCuU22HpBeh2jpi25B/9yy+1RFE5XRl11uK3G+pzqnMQPOMn2IQuKq18mbmvoIV3fAQkxc=,iv:iWw43Wn83ZkhNECI6rJNVkuyUdg+kH9FTuPYG/Yi3Vc=,tag:rmbr2or6a86LjNqVh1yt0g==,type:str]
     encrypted_regex: ^(data)$
     version: 3.12.2

infrastructure.yaml

@@ -757,6 +757,9 @@ environments:
       - name: cde
         manage: false
         image_pull_secret: false
+      - name: premises
+        manage: false
+        image_pull_secret: true
 
     postgresql:
       default_host: 192.168.8.131
@@ -1055,6 +1058,17 @@ environments:
           password_special: false
           conn_limit: 20
 
+      - cluster_id: main
+        database:
+          name: premises
+          extensions:
+            - uuid-ossp
+        user:
+          name: premises
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
     minio:
       endpoint: http://192.168.8.121:9000
 
@@ -1101,6 +1115,9 @@ environments:
       - name: iam
         acl: private
 
+      - name: premises
+        acl: private
+
     kafka:
       create_acls: false
       kafka_cluster_refs: