diff --git a/terraform-configurations/e38fa2ee-6edf-4fa4-8fde-2a508a8cef35/configuration-e38fa2ee-6edf-4fa4-8fde-2a508a8cef35.tf b/terraform-configurations/e38fa2ee-6edf-4fa4-8fde-2a508a8cef35/configuration-e38fa2ee-6edf-4fa4-8fde-2a508a8cef35.tf
new file mode 100644
index 0000000..db9b7e7
--- /dev/null
+++ b/terraform-configurations/e38fa2ee-6edf-4fa4-8fde-2a508a8cef35/configuration-e38fa2ee-6edf-4fa4-8fde-2a508a8cef35.tf
@@ -0,0 +1,81 @@
+##############################################################################
+# Deployment Script: Managed PostgreSQL database (OVHcloud)
+#
+# Thin root calling the provisioner owned "dbaas" catalog module. The module
+# provisions an OVHcloud Managed PostgreSQL cluster with one initial database
+# and one application user. The user password is always generated server side
+# by OVHcloud (it cannot be set to an arbitrary value) and is written by the
+# module to Vault under the existing path contract, together with the
+# connection attributes; only the Vault path is returned in the provisioning
+# response. No secret material ever appears in this script or its outputs.
+#
+# No terraform/required_providers and no provider blocks are needed: the
+# catalog module carries its own provider requirements, the cloud provider
+# is configured from the runner environment and the Vault provider file is
+# generated by the provisioner.
+#
+# Placeholders (all filled by the provisioner, never typed by the user):
+#   - the module source placeholder resolves to the dbaas module of the
+#     cloudProvider sent in the request headers
+#   - e38fa2ee-6edf-4fa4-8fde-2a508a8cef35 is the scriptTriggerId of the request
+#   - development-test is the value of the cloudAccount header
+#   - 1668bb58-9136-49be-99bb-da1df83f095e is the value of the requesterUniqueId header
+##############################################################################
+
+module "dbaas" {
+  source              = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//dbaas/ovh?ref=3.2.0-F-feature-simpl-31669.676.1150352e"
+  deployment_id       = "e38fa2ee-6edf-4fa4-8fde-2a508a8cef35"
+  cloud_account       = "development-test"
+  requester_unique_id = "1668bb58-9136-49be-99bb-da1df83f095e"
+
+  # OVHcloud macro region for the database nodes (for example SBG, GRA, DE),
+  # not the datacenter suffixed region (SBG5) used for instances. The project
+  # itself is not set here: the provider resolves it from the cloud account
+  # configuration of the environment.
+  region = "SBG"
+
+  # Managed offer: PostgreSQL engine version and sizing. plan is essential,
+  # business or production; flavor for example db1-4.
+  engine_version = "16"
+  plan           = "essential"
+  flavor         = "db1-4"
+
+  # Initial application database name. The application user name defaults to
+  # simpl_app_user and becomes the last segment of the Vault credentials path.
+  database_name = "simpl_app_db"
+
+  # Optional private mode: attach the database nodes to an existing vRack
+  # network of the same project. Leave unset for a public deployment, in
+  # which case allowed_ips restricts who can reach the cluster.
+  # private_network_id = "<openstack network id>"
+  # private_subnet_id  = "<subnet id>"
+  # allowed_ips        = ["203.0.113.0/24"]
+}
+
+output "database_endpoint" {
+  value = module.dbaas.database_endpoint
+}
+
+output "database_port" {
+  value = module.dbaas.database_port
+}
+
+output "database_name" {
+  value = module.dbaas.database_name
+}
+
+output "database_username" {
+  value = module.dbaas.database_username
+}
+
+output "database_cluster_id" {
+  value = module.dbaas.database_cluster_id
+}
+
+output "database_user_id" {
+  value = module.dbaas.database_user_id
+}
+
+output "credentials_ref" {
+  value = module.dbaas.credentials_ref
+}
diff --git a/terraform-configurations/e38fa2ee-6edf-4fa4-8fde-2a508a8cef35/providers-e38fa2ee-6edf-4fa4-8fde-2a508a8cef35.tf b/terraform-configurations/e38fa2ee-6edf-4fa4-8fde-2a508a8cef35/providers-e38fa2ee-6edf-4fa4-8fde-2a508a8cef35.tf
new file mode 100644
index 0000000..9e1841c
--- /dev/null
+++ b/terraform-configurations/e38fa2ee-6edf-4fa4-8fde-2a508a8cef35/providers-e38fa2ee-6edf-4fa4-8fde-2a508a8cef35.tf
@@ -0,0 +1,17 @@
+// Generated by the provisioner. Vault provider configuration for catalog
+// modules that store generated credentials. Authentication is the Kubernetes
+// service account of the Terraform runner, exchanged for a Vault token
+// through the Kubernetes auth method, never a value from this file or the
+// user body.
+provider "vault" {
+  address          = "https://secrets.common01.dev-sandbox-ionos.simpl-europe.eu"
+  skip_child_token = true
+
+  auth_login {
+    path = "auth/kubernetes/login"
+    parameters = {
+      role = "provisioner-role"
+      jwt  = file("/var/run/secrets/kubernetes.io/serviceaccount/token")
+    }
+  }
+}