Phase 2: deploy Authentik warm standby on the VPS

CNPG operator on the VPS (argocd-apps/vps-standby/cnpg-operator.yaml), plus a CNPG 'replica cluster' for pg-authentik (infrastructure/ vps-standby/authentik/manifests/cnpg-cluster.yaml) that continuously replays WAL shipped from home's pg-authentik via VPS MinIO's cnpg-backups/pg-authentik bucket path - CNPG's native replica-cluster mode, not a custom restore script like Vault needed (Vault has no equivalent built-in continuous-replication-into-object-store feature). The Authentik app itself runs at replicas: 0 in normal operation - the replica DB is read-only until a deliberate manual promotion (spec.replica.enabled: false), and a pod trying to write against a read-only DB would just crashloop uselessly. values.yaml's authentik: block is copied byte-identical from home's on purpose: the chart deterministically derives its generated Secret's AUTHENTIK_SECRET_KEY from these literal values.yaml strings, so both clusters land on the same key without manually copying it - required since that key decrypts things stored encrypted in the replicated DB.
2026-08-21 05:26:49 +00:00 · 2026-08-17 22:28:10 -05:00
parent f2213b56b4
commit 1a657ad0a4
5 changed files with 316 additions and 0 deletions
@@ -0,0 +1,101 @@
+# Authentik warm standby on the VPS - Phase 2. The CNPG replica cluster
+# (manifests/cnpg-cluster.yaml) continuously replays WAL from home in the
+# background; the app itself is NOT run in normal operation (replicas: 0)
+# since the replica DB is read-only until a deliberate manual promotion -
+# an Authentik pod trying to write against a read-only DB would just
+# crashloop uselessly. Promotion runbook: flip the CNPG cluster's
+# spec.replica.enabled to false (see cnpg-cluster.yaml), then scale
+# server/worker up from 0.
+#
+# The `authentik:` block below (secret_key/postgresql "env://" indirection)
+# is copied VERBATIM from infrastructure/authentik/values.yaml on purpose -
+# the authentik chart deterministically renders its own generated Secret
+# from these literal values.yaml strings (not randomly), so keeping this
+# block byte-identical between home and VPS means both clusters
+# independently arrive at the same AUTHENTIK_SECRET_KEY without needing to
+# manually copy it - required for promotion to work, since that key
+# decrypts things (stored provider secrets, cert private keys) that live
+# encrypted in the DB being replicated.
+authentik:
+  secret_key: env://AUTHENTIK_SECRET_KEY
+  postgresql:
+    host: env://AUTHENTIK_POSTGRESQL__HOST
+    port: 5432
+    name: env://AUTHENTIK_POSTGRESQL__NAME
+    user: env://AUTHENTIK_POSTGRESQL__USER
+    password: env://AUTHENTIK_POSTGRESQL__PASSWORD
+
+global:
+  envFrom:
+    - secretRef:
+        name: authentik
+    - secretRef:
+        name: pg-authentik-app
+      prefix: AUTHENTIK_POSTGRESQL__
+  env:
+    - name: AUTHENTIK_URL
+      value: "https://auth.kube.huskypup.net"
+    - name: AUTHENTIK_POSTGRESQL__HOST
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: host
+    - name: AUTHENTIK_POSTGRESQL__NAME
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: dbname
+    - name: AUTHENTIK_POSTGRESQL__USER
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: username
+    - name: AUTHENTIK_POSTGRESQL__PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: password
+    - name: AUTHENTIK_POSTGRESQL__PORT
+      value: "5432"
+
+server:
+  replicas: 0
+  containerSecurityContext:
+    runAsNonRoot: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+  resources:
+    requests:
+      cpu: 50m
+      memory: 512Mi
+    limits:
+      memory: 1Gi
+  metrics:
+    enabled: false
+
+worker:
+  replicas: 0
+  containerSecurityContext:
+    runAsNonRoot: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+  resources:
+    requests:
+      cpu: 50m
+      memory: 512Mi
+    limits:
+      memory: 1Gi
+  metrics:
+    enabled: false
+
+# Disable bundled Postgres - using the CNPG replica cluster instead
+postgresql:
+  enabled: false