Phase 2: deploy Authentik warm standby on the VPS

CNPG operator on the VPS (argocd-apps/vps-standby/cnpg-operator.yaml),
plus a CNPG 'replica cluster' for pg-authentik (infrastructure/
vps-standby/authentik/manifests/cnpg-cluster.yaml) that continuously
replays WAL shipped from home's pg-authentik via VPS MinIO's
cnpg-backups/pg-authentik bucket path - CNPG's native replica-cluster
mode, not a custom restore script like Vault needed (Vault has no
equivalent built-in continuous-replication-into-object-store feature).

The Authentik app itself runs at replicas: 0 in normal operation - the
replica DB is read-only until a deliberate manual promotion
(spec.replica.enabled: false), and a pod trying to write against a
read-only DB would just crashloop uselessly. values.yaml's authentik:
block is copied byte-identical from home's on purpose: the chart
deterministically derives its generated Secret's AUTHENTIK_SECRET_KEY
from these literal values.yaml strings, so both clusters land on the
same key without manually copying it - required since that key decrypts
things stored encrypted in the replicated DB.

argocd-apps/vps-standby/authentik.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vps-authentik
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"  # after vps-cnpg (wave 1) and vps-minio (wave 2)
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: vps-standby
+  sources:
+    - repoURL: https://charts.goauthentik.io
+      chart: authentik
+      targetRevision: 2026.2.1
+      helm:
+        valueFiles:
+          - $values/infrastructure/vps-standby/authentik/values.yaml
+    - repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
+      targetRevision: main
+      ref: values
+    - repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
+      targetRevision: main
+      path: infrastructure/vps-standby/authentik/manifests
+  destination:
+    name: vps-standby
+    namespace: authentik
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd-apps/vps-standby/cnpg-operator.yaml

@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vps-cnpg
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"  # before minio/vault/gitea (wave 2) and the CNPG-backed standby apps (wave 3)
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: vps-standby
+  source:
+    repoURL: https://cloudnative-pg.github.io/charts
+    chart: cloudnative-pg
+    targetRevision: "*"  # matches home's argocd-apps/infrastructure/cnpg.yaml (also unpinned)
+  destination:
+    name: vps-standby
+    namespace: cnpg-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+      - ServerSideDiff=true
+      - RespectIgnoreDifferences=true