diff --git a/terraform-configurations/5a7905f1-d1ee-46dd-8dec-b276dc67dd31/configuration-5a7905f1-d1ee-46dd-8dec-b276dc67dd31.tf b/terraform-configurations/5a7905f1-d1ee-46dd-8dec-b276dc67dd31/configuration-5a7905f1-d1ee-46dd-8dec-b276dc67dd31.tf
new file mode 100644
index 0000000..5991bc6
--- /dev/null
+++ b/terraform-configurations/5a7905f1-d1ee-46dd-8dec-b276dc67dd31/configuration-5a7905f1-d1ee-46dd-8dec-b276dc67dd31.tf
@@ -0,0 +1,84 @@
+##############################################################################
+# Deployment Script: Managed PostgreSQL database (OVHcloud)
+#
+# Thin root calling the provisioner owned "dbaas" catalog module. The module
+# provisions an OVHcloud Managed PostgreSQL cluster with one initial database
+# and one application user. The user password is always generated server side
+# by OVHcloud (it cannot be set to an arbitrary value) and is written by the
+# module to Vault under the existing path contract, together with the
+# connection attributes; only the Vault path is returned in the provisioning
+# response. No secret material ever appears in this script or its outputs.
+#
+# No terraform/required_providers and no provider blocks are needed: the
+# catalog module carries its own provider requirements, the cloud provider
+# is configured from the runner environment and the Vault provider file is
+# generated by the provisioner.
+#
+# Placeholders (all filled by the provisioner, never typed by the user):
+#   - the module source placeholder resolves to the dbaas module of the
+#     cloudProvider sent in the request headers
+#   - 5a7905f1-d1ee-46dd-8dec-b276dc67dd31 is the scriptTriggerId of the request
+#   - development-test is the value of the cloudAccount header
+#   - 067d45e3-7bb3-4a6d-ac9c-6b8dc12eaba5 is the value of the requesterUniqueId header
+##############################################################################
+
+module "dbaas" {
+  source              = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//dbaas/ovh?ref=3.2.0-F-feature-simpl-31672.683.51d1d4ae"
+  deployment_id       = "5a7905f1-d1ee-46dd-8dec-b276dc67dd31"
+  cloud_account       = "development-test"
+  requester_unique_id = "067d45e3-7bb3-4a6d-ac9c-6b8dc12eaba5"
+
+  # OVHcloud macro region for the database nodes (for example SBG, GRA, DE),
+  # not the datacenter suffixed region (SBG5) used for instances. The project
+  # itself is not set here: the provider resolves it from the cloud account
+  # configuration of the environment.
+  region = "SBG"
+
+  # Managed offer: PostgreSQL engine version and sizing. plan is essential,
+  # business or production; flavor for example db1-4.
+  engine_version = "16"
+  plan           = "essential"
+  flavor         = "db1-4"
+
+  # Initial application database name. The application user name defaults to
+  # simpl_app_user and becomes the last segment of the Vault credentials path.
+  database_name = "simpl_app_db"
+
+  # CIDR blocks allowed to reach the cluster on a public deployment. Without
+  # this OVHcloud blocks all access. Open to the internet by default here,
+  # restrict it to your own networks for anything beyond testing.
+  allowed_ips = ["0.0.0.0/0"]
+
+  # Optional private mode: attach the database nodes to an existing vRack
+  # network of the same project and remove allowed_ips.
+  # private_network_id = "<openstack network id>"
+  # private_subnet_id  = "<subnet id>"
+}
+
+output "database_endpoint" {
+  value = module.dbaas.database_endpoint
+}
+
+output "database_port" {
+  value = module.dbaas.database_port
+}
+
+output "database_name" {
+  value = module.dbaas.database_name
+}
+
+output "database_username" {
+  value = module.dbaas.database_username
+}
+
+output "database_cluster_id" {
+  value = module.dbaas.database_cluster_id
+}
+
+output "database_user_id" {
+  value = module.dbaas.database_user_id
+}
+
+output "credentials_ref" {
+  value = module.dbaas.credentials_ref
+}
diff --git a/terraform-configurations/5a7905f1-d1ee-46dd-8dec-b276dc67dd31/credentials-5a7905f1-d1ee-46dd-8dec-b276dc67dd31_override.tf b/terraform-configurations/5a7905f1-d1ee-46dd-8dec-b276dc67dd31/credentials-5a7905f1-d1ee-46dd-8dec-b276dc67dd31_override.tf
new file mode 100644
index 0000000..c4fbbd7
--- /dev/null
+++ b/terraform-configurations/5a7905f1-d1ee-46dd-8dec-b276dc67dd31/credentials-5a7905f1-d1ee-46dd-8dec-b276dc67dd31_override.tf
@@ -0,0 +1,8 @@
+// Generated by the provisioner. Credential rotation marker for the catalog
+// modules of this deployment: the credential renewal workflow rewrites the
+// version value to rotate the generated credentials. Terraform merges these
+// blocks into the module blocks of the deployment script through the
+// override file mechanism, so the deployment script never declares them.
+module "dbaas" {
+  credentials_version = "1"
+}
diff --git a/terraform-configurations/5a7905f1-d1ee-46dd-8dec-b276dc67dd31/providers-5a7905f1-d1ee-46dd-8dec-b276dc67dd31.tf b/terraform-configurations/5a7905f1-d1ee-46dd-8dec-b276dc67dd31/providers-5a7905f1-d1ee-46dd-8dec-b276dc67dd31.tf
new file mode 100644
index 0000000..9e1841c
--- /dev/null
+++ b/terraform-configurations/5a7905f1-d1ee-46dd-8dec-b276dc67dd31/providers-5a7905f1-d1ee-46dd-8dec-b276dc67dd31.tf
@@ -0,0 +1,17 @@
+// Generated by the provisioner. Vault provider configuration for catalog
+// modules that store generated credentials. Authentication is the Kubernetes
+// service account of the Terraform runner, exchanged for a Vault token
+// through the Kubernetes auth method, never a value from this file or the
+// user body.
+provider "vault" {
+  address          = "https://secrets.common01.dev-sandbox-ionos.simpl-europe.eu"
+  skip_child_token = true
+
+  auth_login {
+    path = "auth/kubernetes/login"
+    parameters = {
+      role = "provisioner-role"
+      jwt  = file("/var/run/secrets/kubernetes.io/serviceaccount/token")
+    }
+  }
+}