diff --git a/infrastructure/vps-standby/gitlab/manifests/cnpg-cluster.yaml b/infrastructure/vps-standby/gitlab/manifests/cnpg-cluster.yaml index ec5f3d4..49332c0 100644 --- a/infrastructure/vps-standby/gitlab/manifests/cnpg-cluster.yaml +++ b/infrastructure/vps-standby/gitlab/manifests/cnpg-cluster.yaml @@ -1,8 +1,24 @@ --- -# Real GitLab on the VPS - simplified single-node equivalent of -# apps/gitlab/manifests/cnpg-cluster.yaml (home's is 3-instance HA with -# Rook-Ceph; this is 1 instance on local-path, matching the "keep it -# lighter" pattern already used for the rest of vps-standby). +# GitLab cross-site replication Phase 1c (see +# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - was a fully +# independent standalone cluster (own initdb, own root/Scooby test data, +# never meant to survive this). Now a real replica of home's pg-gitlab +# (apps/gitlab/manifests/cnpg-cluster.yaml), matching the pattern already +# proven for pg-authentik. +# +# Deployed in two stages, same as the original authentik/n8n/nextcloud +# VPS replicas were: first as a plain bootstrap.recovery replica (this +# commit - no externalClusters/replica streaming config yet, since that +# needs THIS cluster's own CNPG-generated certs to exist first, which +# only happens once the cluster itself exists), then a second commit adds +# the streaming replication config once those certs have been copied +# cross-cluster. +# +# postgresql.parameters MUST match-or-exceed home's - copied verbatim +# from apps/gitlab/manifests/cnpg-cluster.yaml. A replica can't replay +# WAL past a checkpoint recorded with higher settings than its own +# ("recovery aborted because of insufficient parameter settings", +# confirmed live for pg-authentik). apiVersion: postgresql.cnpg.io/v1 kind: Cluster metadata: @@ -12,43 +28,62 @@ spec: imageName: ghcr.io/cloudnative-pg/postgresql:16 instances: 1 + # shared_buffers 1GB below needs headroom - matches home's requests/limits. resources: requests: - memory: "512Mi" + memory: "1Gi" cpu: "50m" limits: - memory: "2Gi" + memory: "4Gi" cpu: "500m" storage: - size: 20Gi + size: 50Gi # matches home's size storageClass: local-path primaryUpdateStrategy: unsupervised - bootstrap: - initdb: - database: gitlabhq_production - owner: app - postInitSQL: - - CREATE EXTENSION IF NOT EXISTS pg_trgm; - - CREATE EXTENSION IF NOT EXISTS btree_gist; - - # Same tuning as home's, GitLab needs these regardless of scale postgresql: parameters: - max_connections: "200" - shared_buffers: "512MB" - effective_cache_size: "1536MB" - maintenance_work_mem: "128MB" + max_connections: "400" + shared_buffers: "1GB" + effective_cache_size: "3GB" + maintenance_work_mem: "256MB" checkpoint_completion_target: "0.9" wal_buffers: "16MB" default_statistics_target: "100" random_page_cost: "1.1" effective_io_concurrency: "200" - work_mem: "8MB" + work_mem: "16MB" min_wal_size: "1GB" max_wal_size: "4GB" + max_worker_processes: "4" + max_parallel_workers_per_gather: "2" + max_parallel_workers: "4" + + bootstrap: + recovery: + source: home + + externalClusters: + - name: home + barmanObjectStore: + # serverName defaults to the externalClusters[].name, NOT the + # source Postgres cluster's actual metadata.name - home's own + # backup: block defaults serverName to "pg-gitlab" (its own + # name). Without this override, recovery looks under the wrong + # server-name prefix and finds nothing (confirmed live for the + # pg-authentik precedent). + serverName: pg-gitlab + destinationPath: s3://cnpg-backups/pg-gitlab + endpointURL: http://vps-minio.minio.svc.cluster.local:9000 + s3Credentials: + accessKeyId: + name: vps-minio-secret + key: accesskey + secretAccessKey: + name: vps-minio-secret + key: secretkey monitoring: enablePodMonitor: false # no Prometheus on the VPS cluster diff --git a/infrastructure/vps-standby/gitlab/manifests/praefect-cnpg-cluster.yaml b/infrastructure/vps-standby/gitlab/manifests/praefect-cnpg-cluster.yaml new file mode 100644 index 0000000..1d14056 --- /dev/null +++ b/infrastructure/vps-standby/gitlab/manifests/praefect-cnpg-cluster.yaml @@ -0,0 +1,70 @@ +--- +# GitLab cross-site replication Phase 1c (see +# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - the VPS never +# had a pg-praefect cluster before (VPS ran Gitaly without Praefect, +# global.praefect.enabled: false). This is new, matching home's +# apps/gitlab/manifests/praefect-cnpg-cluster.yaml as a real replica. +# +# Same two-stage deployment as cnpg-cluster.yaml in this directory: this +# commit is bootstrap.recovery only, streaming config added once this +# cluster's own certs exist to copy cross-cluster. +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: pg-praefect + namespace: gitlab +spec: + imageName: ghcr.io/cloudnative-pg/postgresql:16 + instances: 1 + + resources: + requests: + memory: "512Mi" + cpu: "50m" + limits: + memory: "2Gi" + + storage: + size: 10Gi # matches home's size + storageClass: local-path + + primaryUpdateStrategy: unsupervised + + # Must match-or-exceed home's - copied verbatim from + # apps/gitlab/manifests/praefect-cnpg-cluster.yaml. + postgresql: + parameters: + max_connections: "200" + shared_buffers: "512MB" + effective_cache_size: "1536MB" + maintenance_work_mem: "128MB" + checkpoint_completion_target: "0.9" + wal_buffers: "16MB" + default_statistics_target: "100" + random_page_cost: "1.1" + effective_io_concurrency: "200" + work_mem: "4MB" + min_wal_size: "1GB" + max_wal_size: "4GB" + max_worker_processes: "4" + + bootstrap: + recovery: + source: home + + externalClusters: + - name: home + barmanObjectStore: + serverName: pg-praefect + destinationPath: s3://cnpg-backups/pg-praefect + endpointURL: http://vps-minio.minio.svc.cluster.local:9000 + s3Credentials: + accessKeyId: + name: vps-minio-secret + key: accesskey + secretAccessKey: + name: vps-minio-secret + key: secretkey + + monitoring: + enablePodMonitor: false # no Prometheus on the VPS cluster