fix: let outline-dev actually restore (#1666)

kubernetes/apps/tools/outline-dev/app/database.yaml

@@ -4,6 +4,8 @@ metadata:
   name: outline-dev-db
   namespace: outline-dev
 spec:
+  # Must match the prod major version; a physical restore can't cross majors.
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.0
   storage:
     size: 10Gi
     storageClass: zfs

kubernetes/apps/tools/outline-dev/app/helmrelease.yaml

@@ -26,6 +26,9 @@ spec:
   values:
     controllers:
       outline:
+        pod:
+          securityContext:
+            fsGroup: 1001
         containers:
           app:
             image:
@@ -55,8 +58,6 @@ spec:
                   name: outline-secret-keys
               - secretRef:
                   name: outline-oauth-client
-            securityContext:
-              fsGroup: 1001
       valkey:
         containers:
           app:

kubernetes/apps/tools/outline-dev/secrets/namespace.yaml

@@ -3,3 +3,6 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: outline-dev
+  annotations:
+    # Lets the volsync restic mover chown files when restoring the prod snapshot.
+    volsync.backube/privileged-movers: "true"