# Database Connections

Quick reference for connecting to rdev infrastructure databases.

## Prerequisites

```bash
# REQUIRED: Set kubeconfig before any kubectl command
export KUBECONFIG=~/.kube/orchard9-k3sf.yaml
```

## CockroachDB

CockroachDB is the distributed SQL database for threesix.ai project databases.

| Property | Value |
|----------|-------|
| Service | `cockroachdb-public.databases.svc:26257` |
| Version | v25.1.3 |
| Nodes | 2-3 (StatefulSet) |
| Console | https://cockroachdb.threesix.ai |

### Interactive SQL Shell

```bash
kubectl exec -it -n databases cockroachdb-0 -- \
  /cockroach/cockroach sql --insecure --host=localhost:26257
```

### Run a Query

```bash
kubectl exec -n databases cockroachdb-0 -- \
  /cockroach/cockroach sql --insecure --host=localhost:26257 \
  -e "SHOW DATABASES;"
```

### Check Cluster Status

```bash
kubectl exec -n databases cockroachdb-0 -- \
  /cockroach/cockroach node status --insecure --host=localhost:26257
```

### Check Ranges Distribution

```bash
kubectl exec -n databases cockroachdb-0 -- \
  /cockroach/cockroach sql --insecure --host=localhost:26257 \
  -e "SHOW RANGES FROM DATABASE rdev;"
```

### Internal Connection URL

For apps running inside the cluster:

```
postgresql://root@cockroachdb-public.databases.svc:26257/defaultdb?sslmode=disable
```

## Redis

Redis provides caching and session storage for threesix.ai projects.

| Property | Value |
|----------|-------|
| Service | `redis.threesix.svc:6379` |
| Version | 7-alpine |
| Replicas | 1 (StatefulSet) |
| Auth | Password required |

### Get Password

```bash
REDIS_PASS=$(kubectl get secret -n threesix redis-credentials -o jsonpath="{.data.REDIS_PASSWORD}" | base64 -d)
```

### Interactive CLI

```bash
kubectl exec -it -n threesix redis-0 -- redis-cli -a "$REDIS_PASS"
```

### Ping Test

```bash
kubectl exec -n threesix redis-0 -- redis-cli -a "$REDIS_PASS" ping
```

### Check Memory Usage

```bash
kubectl exec -n threesix redis-0 -- redis-cli -a "$REDIS_PASS" info memory
```

### List Keys for a Project

```bash
kubectl exec -n threesix redis-0 -- redis-cli -a "$REDIS_PASS" keys "project:myapp:*"
```

### Internal Connection URL

For apps running inside the cluster:

```
redis://:password@redis.threesix.svc:6379
```

## PostgreSQL (rdev metadata)

PostgreSQL stores rdev API metadata (API keys, audit logs, work queue, credentials).

| Property | Value |
|----------|-------|
| Service | `postgres.databases.svc:5432` |
| Database | `rdev` |

### Connect to rdev Database

```bash
kubectl exec -it -n databases postgres-0 -- \
  psql -U rdev -d rdev
```

### Check Recent API Keys

```sql
SELECT id, name, created_at FROM api_keys ORDER BY created_at DESC LIMIT 10;
```

### Check Work Queue

```sql
SELECT id, project_id, status, created_at FROM work_items ORDER BY created_at DESC LIMIT 10;
```

## Credentials Storage

Infrastructure credentials (Cloudflare, Gitea, Woodpecker tokens) are stored in PostgreSQL with encryption.

**Source file:** `.secrets` at repo root (gitignored)

**Load credentials:**
```bash
./scripts/load-credentials.sh $RDEV_API_URL
```

**Verify credentials loaded:**
```bash
curl -H "X-API-Key: $RDEV_API_KEY" $RDEV_API_URL/credentials | jq
```

See [Credentials Management](../../.claude/guides/ops/credentials.md) for full documentation.

## Troubleshooting

### CockroachDB: "Connection Refused"

1. Check pods are running:
   ```bash
   kubectl get pods -n databases -l app=cockroachdb
   ```

2. Check service exists:
   ```bash
   kubectl get svc -n databases cockroachdb-public
   ```

### Redis: "NOAUTH Authentication Required"

Get the password first:
```bash
REDIS_PASS=$(kubectl get secret -n threesix redis-credentials -o jsonpath="{.data.REDIS_PASSWORD}" | base64 -d)
```

### PostgreSQL: "Role does not exist"

Check the correct user/database:
```bash
kubectl exec -n databases postgres-0 -- psql -U postgres -c "\l"
kubectl exec -n databases postgres-0 -- psql -U postgres -c "\du"
```