feat(k8s/prowlarr): migrate to PostgreSQL, increase probe timeouts

kubernetes/app/media/cronjob-backup.yaml

@@ -73,6 +73,33 @@ spec:
               volumeMounts:
                 - name: backup-tmp
                   mountPath: /backup
+            - name: pg-dump-prowlarr
+              image: postgres:14.21
+              env:
+                - name: PGHOST
+                  value: prowlarr-db
+                - name: PGUSER
+                  valueFrom:
+                    secretKeyRef:
+                      name: media-db-credentials
+                      key: PROWLARR_DB_USER
+                - name: PGPASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: media-db-credentials
+                      key: PROWLARR_DB_PASSWORD
+                - name: PGDATABASE
+                  valueFrom:
+                    secretKeyRef:
+                      name: media-db-credentials
+                      key: PROWLARR_DB_NAME
+              command:
+                - sh
+                - -c
+                - pg_dump --clean --if-exists > /backup/prowlarr.sql
+              volumeMounts:
+                - name: backup-tmp
+                  mountPath: /backup
             - name: pg-dump-seerr
               image: postgres:14.21
               env:
@@ -107,6 +134,8 @@ spec:
                 - sh
                 - -c
                 - |
+                  resticprofile -c /secrets/profiles.yaml -n prowlarr-db backup
+                  resticprofile -c /secrets/profiles.yaml -n prowlarr-db copy
                   resticprofile -c /secrets/profiles.yaml -n sonarr-db backup
                   resticprofile -c /secrets/profiles.yaml -n sonarr-db copy
                   resticprofile -c /secrets/profiles.yaml -n radarr-db backup

kubernetes/app/media/deployment-prowlarr.yaml

@@ -18,15 +18,31 @@ spec:
         app: prowlarr
     spec:
       initContainers:
-        - name: wait-for-config
+        - name: wait-for-db
           image: busybox:1.37
           command:
             - sh
             - -c
-            - until ls /config > /dev/null 2>&1; do echo "Waiting for config volume..."; sleep 5; done
+            - until nc -z prowlarr-db 5432; do echo "Waiting for database..."; sleep 2; done
-          volumeMounts:
+        - name: init-log-db
-            - name: config
+          image: postgres:14.21
-              mountPath: /config
+          env:
+            - name: PGHOST
+              value: prowlarr-db
+            - name: PGUSER
+              valueFrom:
+                secretKeyRef:
+                  name: media-db-credentials
+                  key: PROWLARR_DB_USER
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: media-db-credentials
+                  key: PROWLARR_DB_PASSWORD
+          command:
+            - sh
+            - -c
+            - psql -d postgres -c 'CREATE DATABASE "prowlarr-log"' || true
       containers:
         - name: prowlarr
           image: lscr.io/linuxserver/prowlarr:2.3.0
@@ -43,6 +59,7 @@ spec:
               path: /ping
             initialDelaySeconds: 30
             periodSeconds: 30
+            timeoutSeconds: 10
             failureThreshold: 5
           readinessProbe:
             httpGet:
@@ -50,6 +67,7 @@ spec:
               path: /ping
             initialDelaySeconds: 10
             periodSeconds: 10
+            timeoutSeconds: 10
           volumeMounts:
             - name: config
               mountPath: /config

kubernetes/app/media/networkpolicy.yaml

@@ -33,6 +33,27 @@ spec:
             matchLabels:
               kubernetes.io/metadata.name: traefik
 ---
+# prowlarr-db: only reachable from prowlarr and backup jobs
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: prowlarr-db
+  namespace: media
+spec:
+  podSelector:
+    matchLabels:
+      app: prowlarr-db
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: prowlarr
+        - podSelector:
+            matchLabels:
+              app: media-backup
+---
 # sonarr-db: only reachable from sonarr and backup jobs
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy

kubernetes/app/media/pv-config.yaml

@@ -40,6 +40,26 @@ spec:
 ---
 apiVersion: v1
 kind: PersistentVolume
+metadata:
+  name: prowlarr-db
+spec:
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ""
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - noatime
+    - timeo=30
+    - retrans=3
+  nfs:
+    server: synology.storage.lviv
+    path: /volume3/k8s-storage/prowlarr-db
+---
+apiVersion: v1
+kind: PersistentVolume
 metadata:
   name: radarr-config
 spec:

kubernetes/app/media/pvc.yaml

@@ -70,6 +70,20 @@ spec:
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
+metadata:
+  name: prowlarr-db
+  namespace: media
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ""
+  volumeName: prowlarr-db
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
 metadata:
   name: sonarr-db
   namespace: media

kubernetes/app/media/secret-backup.sops.yaml

@@ -4,7 +4,7 @@ metadata:
     name: media-backup-config
     namespace: media
 stringData:
-    profiles.yaml: ENC[AES256_GCM,data:FvqC4eyDKTqy+rCcuq5XiAcOF6oVFGVrsPKY0ElwMVqhsxTxdbGmfoeB6tjvOaz4IS0MyM7hekU4ydGCQN+O9O97eazNj2QIrmjw354Ckt+k/5R+i61jua96ErVnJef9RzrhfW1L+4gV3nYTx4oy6YVGoGk0FDpCuD98SR0TGWxbk+HOJ7BN7QZ91GPNre8G4SrizAoTIkYUmfQK/h8XvKhgScLdAZf4f9UDfW2bra9oekQc1EzzA33XeeOxuWr7lTeTG7/EIJCijtFmu+XdAvxWHgQ6S7breHGcAbyRtXF/ZSdPxtU/4y9RCxDmcd4tNhmP9b0QOaBeo6AAqq7epu7SC/dXHriOROJJ0orF88OVX+ptrP+3OwFE3WyuDCTcoOFoznXdGii+CHX7DJRnnsY3Q4HAL3jxOSGmtqauvoB6hMVO3l45gMG/DRJofHTJbIXZY08fw27cukeJlh0cWKyA+/KTPYI/V18OdMNfKrTuQ6rrpD29j6xbmI0m4Ho9FbeInatDtix21JJ2EpFEtBi3RrCeDXk0uqPU1eC7buUHdVQ3VO+01KLGrMIaVx5taP+4tclzdzbatEZ3hjI8u0g84jMJUryG0yjFpqAuZLqwFRuYzCALyWXtfj8aQt3+7ljEXaf8Ho2Pq3xDJAz1u7NArci7CYOXHHtJXINhgVEyFI+LTtkphdMP39k6rZ63KG7HISjzH1Fchqqzl8FJj6wyTIGLK2PoSizjBNoKO1bc3mMtbM+/x4MV5tYGOVzbQ9z9xqutEXoUZaBat7fWdKIMK4TsdOcrQt0x65Sa5/AewyGcHJh2yq2QgvaCPKzT6pY+88NGoWGUeqB62GO/nDybWFUPk1rdv2hdCwKIuLjbxxP5P123VOeOdfodKRqIjGZq97lZLiccCObrW9WvOuAKnDTL3s0fWa5zmYM19xJaq/Iwg9GyjUJMRhRaTdrttaOMYle2Yt+E0VW4ETGEG/3PwH7M/FzjEyGn4FTjYxbxcmkJha75JX3L3Q6bb5x9bIV6s0uDvptX3pKlw2431TUaWDkuJ+ZzpcLJwFZvNJ40maF3bI+LC9abHYQHtIxtPDF6EI70G3paO0UVItpd33+J92X/qiCFCTasdjzAr+HqGQ1SepkV74Puj/sIKs+6f1Sot+i22USXASGdaD0F/IqpwbgJXufbiYSrRdVw/EgZ7WuzGme0gL1AW7lchw0jBcNA7T2dKbVeuhmN3hUHe6rCCAS+mmBg+KxybXH9UJabfe9N7XYzjCeZ5afmSn663UxCq5V3wC0qh8edLih41XYTAMOw2ytlBWxZsVQE8mwTJRQrXDZrj3aB3Xc10vmj+mlma38lfz4ghGb3AqAFtdALJyqYeBxx1Wan6KA2tpWR39hCj1Jj3dPlAZc/ZXcs/zQJTsf3ohVqjBJD7s/42jp5wTO9lEvPESyekYsvaS82gSSuAJ57K0Yvbx278jciHyjX6vhi1uzdXFep0TPjQ3/rBf8PgngOyEjWV216C7dBLry0ou8B3HJElqItFuchtBVOHXvFY4B55OzzEaDJJ2eWFW7LZKS2UO12j/xFzfSdx2UdGkGUuJ9DjpvRdLB58HtbSDjclECvmyLQ7iRN7Q0W+7ei/aSWj/3t3ZC01IoCrj4arg4JlrjtC4VYxpKI4hyhX1M5ibdw8J3rOX/KqBtFBwoEiQgvSP5YxD1sfjwPRelaMgUHO8n6eXrfNTA0X2LJB++5B6nDaxTmNEq9eVu9L/kUo/WuE59UulRtkYs/ClP5zTclqUKdTVkPnNRQV9dcZOCjuiSpyDTIOlxwUR3I/7xRVP7B33CCgkXOWUISZb98RmQOJFkBPsXqiyRYVgHfn/SbarrvqvWF3XXNcQ+at2taYGF/WJB1Y2B+oFTppC+mNHfxmklJKwcIcwk39Q==,iv:hP5emno4sxU0g+hcCpfXtf8lhxhk7NDCjwcq5lSjmQ8=,tag:K3bNiO9BnGnMRqvM7E9TfQ==,type:str]
+    profiles.yaml: ENC[AES256_GCM,data:Q3flQeNPtES30JjaLabRIh5xgbDMJA1W9ip0BJBkc9Xz1IynhpmYt9ohY3AkeBI8D1Bj81aO7oYPiTbgZZEZOtrvkAoUgQC7Ti/yyamYqFGTN+DuxGoS3RgRQyYaokCSlG2duQci4eq9zZl54LLvzL5e1Nxk5kOg4ng0DpPePfNN6T66vUAU20uiFPOQkZLznjwYW+eFjwDDjXO0D81gXX8oLIlBLkWK5FDVXf/gkrBlw2OMn4S9H1HBenp0V3y6wkX2J1ZPBShFB8knABCCc7cJVevblGs9dl8/ukuJNW1ChuGhh+QdRrGt1qjC5Ey1+wIlaA76xy5tgEiwHqa6eZZyAFk4vTYt06E7sLFqQBaDe0qjsUUPDxYT3HcVJxVrIBqzbLn9WgVyPmjkqv6GFVnlNshI9PTn8M+QTUsmmRuYQloivldt7JPUEA5SPI0rpU6LpVWtPLEWJb6NocRdWn952yBofXEV+gPTr5hDKvoUxVtFb9gXLYtG1NFugAP3x3Je9g24ywg0xtO/lqEREPkhf3JlOJQVlMuJZVbg0tuy6H16b1FWvOCrTaIM2jfelLX5mv0x5z6p8CBoFuDlAFguwSmILUrA5o494HmqKQkjp9VrH6IddLX/ekYabDdIl5UtJL6mW71f0u7qed0drme+KescLk+FlswdR19lGkx++0B0ZAZgRaJIeI0X3JQT00WJF/z8+JKq+8K0vl4z9rw0+EC17VjjO56GcbQVlMgtK2bfAeIFPkYgaAkm/7p43tP+hGfZciWhrcKGxQ0JTWlTPUYm75VU8ikkxkw7/qgq0QWlxsuIeJXriKZnRwmZ5AoOUokWvDYwdjsNRL9M2wrw/tpa5lqD9+Y/9M9+XqH7NQxcj9i1EufThyrMdQBUPLTWswFQ/+rYencVG/9iwzmugp1+P4lyVfRYyaRtrX+W7685Q3pRQlf5e+DhvMgTNdn8s+IdsthKxRv0lyPcCaz4GUFhzuHIZDeuWrMuItOSftzekj8mXyDJybLznpJ/ijMWW6qcjMC3Yi4Yo+jRnZchI770b9M+RxtZexPynmMuvEoo7MxsdnUZRY6s2un7a1h9UeTgomLEWj0ChAJpLDvHVrUZ0ZP/BWjIhjXHB0BsWNHaeKzXJdwqop+AFt9ZNCvSnu21uXsnNGjJRY8WAzox7qDIWAYw93z4dMJllQymysgMI0NT6MqijyERm0bgyR61S9m9ThnWVw6p0zDNnr3/+Wmm3qryvqORS9PVG4aUkkPQlzo6CZY/o8HbIvHmMuvFrWCFiaeIh87gMxd9PLarAOeYmVDJK2PxsphmB9LCUoCUNNEaoUZi7YBiE9NvMhpndakZ/e5uCbuEz59XUYnldrEfzY0aG7Yt5AMod+xpo0s6Ec6m6WoINX0iVzLROYbdRXGw0s8NU/NT3LGnHvVI1vagfz/IF6KjfcNtWh4KROWEz2IK1PkeXOLbPyrxhHpc5DhT8npGOXAgBKmftQn1WRretcil9O9PnR1CVmBBsK6sGUCjzMET45zyGLkJBlgeOipFvEfjh82BsNaBAlHJGgzIuCZajBWldSic6+VcaFdBWvqs2PFRxkCFALdZA80aDeSQlcLBuUo/nQU+zZap6tKwv1O7DdMCYJe5EvLqG4YNZhpM+wjXn7NgV6WiKPAkOxNSgwuTGuqay2R8PkfR9evho9ZJhgB7+ijfqz9HVkBID6NYyWjfIcPAgNQyVcMMZevR/8MOn1KGtiZTeEFWgpvDwLRGyGSwjh6BkEAb6TkJ6JIicqATwQT/LhHlzjw5lona8XGibihaszuE41hlmwtHlRJEOcSd7UIKKnbrAJoUPlxvLwcpHaa0GMwgV5iIim/GIQEqV6EmpPwf552fxpPRsgAV2UZ6Wmz+Y4QeXgCIhOWTSRgKF1++2s3fIVeABR8LHyLRMXglCzKqY96k9+ow0z0T1/58iRcsic7UJqvw3dODtiXxU2JLilOIJnXVObVwyBCcFpb6/iO1AXE4x0t6gtSs8G8O+pp0uBsaN4AK15q59RzKKhNB9gT9KAfa7PIBE5PMHSopgayTbK96iKQgH5j9umFsXLq5jQQnSRxm3SNEHLxcAzs2pVhHKeO5vWJvnY42dg9EDrKpf0FEHe2IYho0fuA56f6knEYljW/4CZJIjBkxCXwEC0gFIgDL9312+4o4wYOLHqiA9pb+psv1BpCvpVWwvG7CRDqGPi+vowsSU2R028HwNSuP6D/AjYkLlA0E09vVEU2AiGOgFmZcaxR1q/ZFPVg6TcFmzpwEZ+KT+4ow5OZTR9HFvdWzDIGNGphkTTRxanIwpQbhMDDeW+no7tE0JE+ZAXWogXqYtmxiTajRh8RSXUFuw3A2jXJvKSR63vGTriTlFpZqRMtI+ZCeDvolwnQXCi88rSavUxmwy0duPN+QdNdnfpMgVH6KT7KwF8442MUuAI2JWxP7Pv9nVVAeknuFoKInHYi8H8xW0CMcgjHscOaP7bFYKJ2LBOrE8geukD4F56wYE7C/F0Ndc2iCjcMfAi596ZJh8pDOROxXk4Nx1pv83spslCtOS5RvaFY=,iv:5hepsaEo+8VmgL6bdKwIGHbtil1EM3FpcAwtQnHG8Fk=,tag:D6kw8LY/LHbxlYFt+KXJRw==,type:str]
     restic-password-nas: ENC[AES256_GCM,data:OfCOmmU85bnWWFAAir90+Vj3d0Vh0bUqNICQg+2aCksd5aiVl3M+OUXZaVhQQtukVd2Mw22y4Die3zO7wlzXAQ==,iv:M7SuVZfm541Rvm7m3Gh8EkDgQ3kU2gKIMJZ+u1s+xf8=,tag:5EwXbugyG+idxt12sJXNhQ==,type:str]
     restic-password-b2: ENC[AES256_GCM,data:dSt6fWJknKPslHKrjfaCLRI+r4K2lhz9hYYE4CKcEaTutxFNBfAoj70abwtIj1hoLv0SzyZUWtxrIrZCILR/yw==,iv:5tRzv0KQMqbw5zAx9eBGGxngiowOxLYSMf3vsvoRcVA=,tag:2utz3OFpup4/NK/sWKzKVg==,type:str]
     B2_ACCOUNT_ID: ENC[AES256_GCM,data:os8HLCWv9ujoZWLFEuhondgCVvRwMNBlHQ==,iv:bQNshEL7pFF/+1hjStaRo8Aa2uzVmai3L+5wFLoC8BE=,tag:7JGG/ocByA83E1ncNoZEXw==,type:str]
@@ -20,7 +20,7 @@ sops:
             cER0MEpOb1J2Y1ZYQWlwT3A3dkdkZ1kK0PhrZsURFuA8c4rMVRE/jLiHBkxQ65ds
             iVqJJHjuiOuOed5Wcr4FbAaghKIsc5AiZO06Zsj+pfpt5aQGdcettw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-22T09:08:31Z"
+    lastmodified: "2026-03-31T19:20:12Z"
-    mac: ENC[AES256_GCM,data:veSRpp9RZatCrGkS5w/OPrPz1Av2SZQ+M5d/MlNYFraoMFluhejAQIt3vh+mO3Bd1hxPm3PPZzxHvLwpVH10lczxD9Uvc+LhA7FWrhr0BWrjbN5WKwhP3T3v/VFfkJctPi9ITOd/aGkusWfZ9ghVWnW4oe7RXxtCZhsh141QBHs=,iv:JPvqfB6T9DGFFsNrSGbrlaHv0UhQJB005Uj5tJgBVJQ=,tag:ih/gh7+FORz+CfP/nKahmA==,type:str]
+    mac: ENC[AES256_GCM,data:3XfOQ7nGuKGc9Sftpq+vGu0QLO6Ka6FH3JVldB9sZEZ8qUwt/cXIURsYk+8C0xmXjV7iOGAjtYwGyyQiWywTwRmyLKvI5hmtOvnfMB1NzfO/k6Qr06ry8niZeKiBe1XU1+w+R0bG+Mj/qxG4/NLiYj8Aa2KlyMLH8K+v2wGQ6n4=,iv:jI3Zw8vkHBPGMHKLa5Ty6XRlTDfMMkIvPkO13yf6yPg=,tag:ouFWY8NqWlLfON/HdbuTDg==,type:str]
     encrypted_regex: ^(data|stringData|email)$
     version: 3.12.2

kubernetes/app/media/secret.sops.yaml

@@ -10,6 +10,9 @@ stringData:
     RADARR_DB_USER: ENC[AES256_GCM,data:q8IuzrfO,iv:MVretLwHLhd5fsYYRa9jyq59ebcYdZB1flYWoBwrTII=,tag:+LV02NiQyd+T6mwqLzET5A==,type:str]
     RADARR_DB_NAME: ENC[AES256_GCM,data:VxtGKMV+LO/exOo=,iv:6RUjbk+/tw1GQYK4nqElhELo5lqgvYhR7gYZIaLDOlM=,tag:FGexxymrlwncNcVMOLZ8/Q==,type:str]
     RADARR_DB_PASSWORD: ENC[AES256_GCM,data:SB2AGVPdlhGGreSKUQ9fxJn1O6wyPMucy+knwWhQrxqyijzMgCJIYFRv8Gr3gpns3Zo1EvX1faxc/EfN19XSxw==,iv:SeqSpGuCTmN4V3V9AGWSD664Z2mMdZU9tWM2uTZYusM=,tag:xm9J4s5F8x8ulMualpJVtQ==,type:str]
+    PROWLARR_DB_USER: ENC[AES256_GCM,data:dmBKcJZIwz0=,iv:NyNDm+gHnV2Su6X8RY+UaB+XlMBZr4xXGHLQ4olvWdA=,tag:DJadB86B/nKlYANy94VFoQ==,type:str]
+    PROWLARR_DB_NAME: ENC[AES256_GCM,data:T8VDs9xevQva9W7xLQ==,iv:j9jjHjKISTgw/0yxyo6uDQxy69xJ+OwqTWRCNjQZEdk=,tag:4g0utJBDxIr6+oowv41Q2Q==,type:str]
+    PROWLARR_DB_PASSWORD: ENC[AES256_GCM,data:nS2QPK5o3YEPROxyAmNjeKxkUFzbJ4bDqfYarbOLrQrtwaVtc2j2mt0Zfs4n3I7t8jncLECeLCFB8XVoWZjsgQ==,iv:xqdDgt7uv+2W6UT7cCrcL/hcFAZG4vUbwfRaTW/4E5M=,tag:Y2o5Ok4UJuulfvxSr26p9w==,type:str]
 sops:
     age:
         - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
@@ -21,7 +24,7 @@ sops:
             ZVZmNzRlOVRnK1FBdTc1ZmU1bzNidU0KBP4sIZzuVn7PU17e09p6Td0sMG7K+NsQ
             AcvdVNFr6mOfivGn86Ao1R4xPE4ANqZfrNQCgIoKxsOQPcc13vOJbA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-22T10:20:21Z"
+    lastmodified: "2026-03-31T18:40:09Z"
-    mac: ENC[AES256_GCM,data:36OEPmj2rFjEAWU9RG8DvvwYJGuMmLKZ9e2fW48N8SBajaGiSGLBfRkRKHy5ncTtNaGmlfBuRtM5CoA9/qaxNQJ/q7DefSx0E0KuS9zTamfRcf7oTZEqmaK3v8r8AXmCTi4od5eiISPT5d9oN48V+aNLd3iFLwt9fSUQ8dPOQ3A=,iv:yP145UUDKBU9NSPlIZ+wAeKB/TDBv4OUMlCvayzKTmU=,tag:Qt383JbWxzB3/GxF32NezA==,type:str]
+    mac: ENC[AES256_GCM,data:LLkETSpyM+mq9mevqOD3uguZWRYZuMrs3xQsypZATOR3qDIB+K4z+azjBb23mbnSefQe2+LIm2pbel6fbMSrKO+CdfCrNfBypYb0jK99XIgBgfwQMKz/iuNiAAngCS9+UIcyQqim0FxDRwkdjpOcAL0LbCiNpfIsoUXNiNSRh7w=,iv:0Wln1COrZlR3mWRB0GMdhUsvzjZbBK2eJZR8RiMPwvs=,tag:crfppHbHiQtGiLS4A/f69w==,type:str]
     encrypted_regex: ^(data|stringData|email)$
-    version: 3.11.0
+    version: 3.12.2

kubernetes/app/media/service.yaml

@@ -125,6 +125,23 @@ spec:
 ---
 apiVersion: v1
 kind: Service
+metadata:
+  name: prowlarr-db
+  namespace: media
+  labels:
+    app: prowlarr-db
+spec:
+  type: ClusterIP
+  ports:
+    - name: 5432-5432
+      port: 5432
+      targetPort: 5432
+      protocol: TCP
+  selector:
+    app: prowlarr-db
+---
+apiVersion: v1
+kind: Service
 metadata:
   name: seerr-db
   namespace: media

kubernetes/app/media/statefulset-prowlarr-db.yaml

@@ -0,0 +1,65 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: prowlarr-db
+  namespace: media
+  labels:
+    app: prowlarr-db
+spec:
+  replicas: 1
+  serviceName: prowlarr-db
+  selector:
+    matchLabels:
+      app: prowlarr-db
+  template:
+    metadata:
+      labels:
+        app: prowlarr-db
+    spec:
+      securityContext:
+        runAsUser: 1027
+        runAsGroup: 100
+        fsGroup: 100
+      containers:
+        - name: postgres
+          image: postgres:14.21
+          env:
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: media-db-credentials
+                  key: PROWLARR_DB_NAME
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: media-db-credentials
+                  key: PROWLARR_DB_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: media-db-credentials
+                  key: PROWLARR_DB_PASSWORD
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          ports:
+            - containerPort: 5432
+              name: postgres
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: 5432
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            failureThreshold: 5
+          readinessProbe:
+            tcpSocket:
+              port: 5432
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: prowlarr-db