Disable VPS MinIO backup on n8n/nextcloud/authentik CNPG clusters

Discovered while debugging pg-n8n's recurring 'Instance Status Extraction
Error': the root cause is the same missing pod-egress route to the Netbird
mesh found tonight while fixing CrowdSec - continuousArchiving kept failing
to connect to vps-minio.netbird.internal, and CNPG correctly holds
Ready=False while archiving is broken (a real condition, not cosmetic).
That's what was driving these three apps' ArgoCD health flapping.

No node in the cluster has any route into 100.108.0.0/16 for
pod-originated traffic - the per-namespace netbird 'router' pods
(gitlab, vault, argocd, etc.) are inbound-only infrastructure, not egress
gateways. gitlab's own CNPG backup is unaffected (points at a local
in-cluster MinIO, not the VPS).

Commented out rather than deleted - re-enable once real pod-egress
routing exists, tracked as a separate task. No data loss: this is WAL
archiving/backup, not the live database.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/n8n/manifests/cnpg-cluster.yaml

@@ -47,25 +47,29 @@ spec:
       database: n8n
       owner: n8n
 
-  # Backup to the VPS MinIO backup receiver (Phase 1b). Previously had no
+  # Backup to VPS MinIO - DISABLED 2026-08-17. No node in the cluster has
-  # backup block at all. VPS_MINIO_ENDPOINT placeholder matches
+  # any route into the Netbird mesh for pod-originated (egress) traffic;
-  # infrastructure/vault/manifests/raft-snapshot-cronjob.yaml - replace with
+  # the per-namespace netbird "router" pods are inbound-only infrastructure.
-  # the VPS's actual Netbird address once bootstrapped.
+  # continuousArchiving kept failing to connect to vps-minio.netbird.internal,
-  backup:
+  # which held Ready=False permanently (real condition, not cosmetic - this
-    barmanObjectStore:
+  # is what drove n8n's CNPG health flapping in ArgoCD). Re-enable once real
-      destinationPath: s3://cnpg-backups/pg-n8n
+  # pod-egress routing to the VPS exists (tracked as a separate task) - no
-      endpointURL: http://vps-minio.netbird.internal:30900
+  # other change needed, this block is otherwise complete/correct.
-      s3Credentials:
+  # backup:
-        accessKeyId:
+  #   barmanObjectStore:
-          name: vps-minio-secret
+  #     destinationPath: s3://cnpg-backups/pg-n8n
-          key: accesskey
+  #     endpointURL: http://vps-minio.netbird.internal:30900
-        secretAccessKey:
+  #     s3Credentials:
-          name: vps-minio-secret
+  #       accessKeyId:
-          key: secretkey
+  #         name: vps-minio-secret
-      wal:
+  #         key: accesskey
-        compression: gzip
+  #       secretAccessKey:
-        maxParallel: 2
+  #         name: vps-minio-secret
-    retentionPolicy: "30d"
+  #         key: secretkey
+  #     wal:
+  #       compression: gzip
+  #       maxParallel: 2
+  #   retentionPolicy: "30d"
 
   monitoring:
     enablePodMonitor: true

apps/nextcloud/manifests/cnpg-cluster.yaml

@@ -44,25 +44,30 @@ spec:
       database: nextcloud
       owner: nextcloud
 
-  # Backup to the VPS MinIO backup receiver. VPS_MINIO_ENDPOINT placeholder
+  # Backup to VPS MinIO - DISABLED 2026-08-17. No node in the cluster has
-  # matches infrastructure/vault/manifests/raft-snapshot-cronjob.yaml - replace
+  # any route into the Netbird mesh for pod-originated (egress) traffic;
-  # with the VPS's actual Netbird address once bootstrapped. This covers the
+  # the per-namespace netbird "router" pods are inbound-only infrastructure.
-  # DB only - file PVC content is separate, see nextcloud-pvc-sync-cronjob.yaml.
+  # continuousArchiving kept failing to connect to vps-minio.netbird.internal,
-  backup:
+  # which held Ready=False permanently (real condition, not cosmetic).
-    barmanObjectStore:
+  # Re-enable once real pod-egress routing to the VPS exists (tracked as a
-      destinationPath: s3://cnpg-backups/pg-nextcloud
+  # separate task) - no other change needed, this block is otherwise
-      endpointURL: http://vps-minio.netbird.internal:30900
+  # complete/correct. This covers the DB only - file PVC content is
-      s3Credentials:
+  # separate, see nextcloud-pvc-sync-cronjob.yaml (same underlying gap).
-        accessKeyId:
+  # backup:
-          name: vps-minio-secret
+  #   barmanObjectStore:
-          key: accesskey
+  #     destinationPath: s3://cnpg-backups/pg-nextcloud
-        secretAccessKey:
+  #     endpointURL: http://vps-minio.netbird.internal:30900
-          name: vps-minio-secret
+  #     s3Credentials:
-          key: secretkey
+  #       accessKeyId:
-      wal:
+  #         name: vps-minio-secret
-        compression: gzip
+  #         key: accesskey
-        maxParallel: 2
+  #       secretAccessKey:
-    retentionPolicy: "30d"
+  #         name: vps-minio-secret
+  #         key: secretkey
+  #     wal:
+  #       compression: gzip
+  #       maxParallel: 2
+  #   retentionPolicy: "30d"
 
   monitoring:
     enablePodMonitor: true

infrastructure/authentik/manifests/cnpg-cluster.yaml

@@ -47,24 +47,29 @@ spec:
       database: app
       owner: app
 
-  # Backup to the VPS MinIO backup receiver (Phase 1b). VPS_MINIO_ENDPOINT
+  # Backup to VPS MinIO - DISABLED 2026-08-17. No node in the cluster has
-  # placeholder matches infrastructure/vault/manifests/raft-snapshot-cronjob.yaml -
+  # any route into the Netbird mesh for pod-originated (egress) traffic;
-  # replace with the VPS's actual Netbird address once bootstrapped.
+  # the per-namespace netbird "router" pods are inbound-only infrastructure.
-  backup:
+  # continuousArchiving kept failing to connect to vps-minio.netbird.internal,
-    barmanObjectStore:
+  # which held Ready=False permanently (real condition, not cosmetic).
-      destinationPath: s3://cnpg-backups/pg-authentik
+  # Re-enable once real pod-egress routing to the VPS exists (tracked as a
-      endpointURL: http://vps-minio.netbird.internal:30900
+  # separate task) - no other change needed, this block is otherwise
-      s3Credentials:
+  # complete/correct.
-        accessKeyId:
+  # backup:
-          name: vps-minio-secret
+  #   barmanObjectStore:
-          key: accesskey
+  #     destinationPath: s3://cnpg-backups/pg-authentik
-        secretAccessKey:
+  #     endpointURL: http://vps-minio.netbird.internal:30900
-          name: vps-minio-secret
+  #     s3Credentials:
-          key: secretkey
+  #       accessKeyId:
-      wal:
+  #         name: vps-minio-secret
-        compression: gzip
+  #         key: accesskey
-        maxParallel: 2
+  #       secretAccessKey:
-    retentionPolicy: "30d"
+  #         name: vps-minio-secret
+  #         key: secretkey
+  #     wal:
+  #       compression: gzip
+  #       maxParallel: 2
+  #   retentionPolicy: "30d"
 
   monitoring:
     enablePodMonitor: true