Fix VPS replica clusters: match home's max_connections (recovery abort)

Postgres refuses to replay WAL past a checkpoint recorded with higher
max_connections/max_wal_senders/etc than the recovering instance's own
settings: 'recovery aborted because of insufficient parameter settings:
max_connections = 100 is a lower setting than on the primary server,
where its value was 200' - confirmed live on all 3 VPS clusters (they
had no postgresql.parameters block at all, defaulting to CNPG's 100).
Copied home's full postgresql.parameters block to remove any other
potential mismatch (max_wal_senders, max_worker_processes are subject
to the same check). Bumped memory requests/limits to match home too -
shared_buffers: 512MB needs headroom the previous 256Mi/1Gi didn't have.

apps/n8n/manifests/scheduled-backup.yaml

@@ -0,0 +1,16 @@
+---
+# Same gap/fix as infrastructure/authentik/manifests/scheduled-backup.yaml -
+# see that file for the full explanation. WAL-only barmanObjectStore
+# config has no restorable base backup without this.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-n8n-backup
+  namespace: n8n
+spec:
+  schedule: "0 1 * * *"
+  backupOwnerReference: self
+  immediate: true
+  method: barmanObjectStore
+  cluster:
+    name: pg-n8n

apps/nextcloud/manifests/scheduled-backup.yaml

@@ -0,0 +1,16 @@
+---
+# Same gap/fix as infrastructure/authentik/manifests/scheduled-backup.yaml -
+# see that file for the full explanation. WAL-only barmanObjectStore
+# config has no restorable base backup without this.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-nextcloud-backup
+  namespace: nextcloud
+spec:
+  schedule: "0 1 * * *"
+  backupOwnerReference: self
+  immediate: true
+  method: barmanObjectStore
+  cluster:
+    name: pg-nextcloud

argocd-apps/vps-standby/authentik.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vps-authentik
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"  # after vps-cnpg (wave 1) and vps-minio (wave 2)
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: vps-standby
+  sources:
+    - repoURL: https://charts.goauthentik.io
+      chart: authentik
+      targetRevision: 2026.2.1
+      helm:
+        valueFiles:
+          - $values/infrastructure/vps-standby/authentik/values.yaml
+    - repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
+      targetRevision: main
+      ref: values
+    - repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
+      targetRevision: main
+      path: infrastructure/vps-standby/authentik/manifests
+  destination:
+    name: vps-standby
+    namespace: authentik
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd-apps/vps-standby/cnpg-operator.yaml

@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vps-cnpg
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"  # before minio/vault/gitea (wave 2) and the CNPG-backed standby apps (wave 3)
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: vps-standby
+  source:
+    repoURL: https://cloudnative-pg.github.io/charts
+    chart: cloudnative-pg
+    targetRevision: "*"  # matches home's argocd-apps/infrastructure/cnpg.yaml (also unpinned)
+  destination:
+    name: vps-standby
+    namespace: cnpg-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+      - ServerSideDiff=true
+      - RespectIgnoreDifferences=true

argocd-apps/vps-standby/n8n.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vps-n8n
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: vps-standby
+  sources:
+    - repoURL: https://riatlas.github.io/chart__n8n
+      chart: n8n
+      targetRevision: "*"
+      helm:
+        valueFiles:
+          - $values/infrastructure/vps-standby/n8n/values.yaml
+    - repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
+      targetRevision: main
+      ref: values
+    - repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
+      targetRevision: main
+      path: infrastructure/vps-standby/n8n/manifests
+  destination:
+    name: vps-standby
+    namespace: n8n
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

argocd-apps/vps-standby/nextcloud.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vps-nextcloud
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: vps-standby
+  sources:
+    - repoURL: https://nextcloud.github.io/helm/
+      chart: nextcloud
+      targetRevision: "*"
+      helm:
+        valueFiles:
+          - $values/infrastructure/vps-standby/nextcloud/values.yaml
+    - repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
+      targetRevision: main
+      ref: values
+    - repoURL: https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
+      targetRevision: main
+      path: infrastructure/vps-standby/nextcloud/manifests
+  destination:
+    name: vps-standby
+    namespace: nextcloud
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

infrastructure/authentik/manifests/scheduled-backup.yaml

@@ -0,0 +1,26 @@
+---
+# Found 2026-08-18 while building the VPS Authentik replica cluster: the
+# barmanObjectStore backup: block on cnpg-cluster.yaml only configures
+# continuous WAL archiving - it does NOT itself produce a restorable base
+# backup. CNPG's bootstrap.recovery (used by
+# infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml) needs
+# at least one actual Backup object to exist before it has anything to
+# restore ("no target backup found" otherwise, confirmed live). This gap
+# was systemic - n8n, nextcloud, and gitlab all had the same WAL-only
+# setup with no ScheduledBackup anywhere in the repo.
+#
+# immediate: true also fires one backup right away on creation, not just
+# on the schedule - needed to unblock the VPS restore immediately rather
+# than waiting up to 24h for the first scheduled run.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-authentik-backup
+  namespace: authentik
+spec:
+  schedule: "0 1 * * *"  # daily 01:00 - ahead of the VPS's other restore/replay jobs
+  backupOwnerReference: self
+  immediate: true
+  method: barmanObjectStore
+  cluster:
+    name: pg-authentik

infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml

@@ -0,0 +1,100 @@
+---
+# CNPG "replica cluster" - continuously replays WAL shipped from home's
+# pg-authentik cluster (infrastructure/authentik/manifests/cnpg-cluster.yaml)
+# via VPS MinIO's cnpg-backups/pg-authentik bucket path. Unlike Vault's
+# raft-restore CronJob (Vault has no native continuous-replication-into-
+# object-store feature), CNPG's replica-cluster mode is a first-class
+# built-in mechanism - no custom restore scripting needed, matches the
+# plan's intent directly.
+#
+# While spec.replica.enabled is true, this cluster is a read-only standby
+# in continuous recovery - the -rw service exists but is NOT writable
+# (same "nothing accepts writes in normal operation" discipline as Vault/
+# Gitea). Promoting it to a real writable primary during an actual
+# incident is a deliberate manual step:
+#   kubectl -n authentik patch cluster pg-authentik --type merge \
+#     -p '{"spec":{"replica":{"enabled":false}}}'
+# then scale the authentik Deployment(s) up from 0.
+#
+# vps-minio-secret is a plain Secret copied here manually (kubectl, not
+# git) from the vps-minio-root-secret in the minio namespace - this
+# cluster has no Vault/ESO of its own:
+#   kubectl -n authentik create secret generic vps-minio-secret \
+#     --from-literal=accesskey=<vps minio root user> \
+#     --from-literal=secretkey=<vps minio root password>
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: pg-authentik
+  namespace: authentik
+spec:
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  instances: 1
+
+  # shared_buffers: 512MB above needs headroom - matches home's requests/limits.
+  resources:
+    requests:
+      memory: "512Mi"
+      cpu: "25m"
+    limits:
+      memory: "2Gi"
+      cpu: "250m"
+
+  storage:
+    size: 5Gi
+    storageClass: local-path
+
+  # Must match (or exceed) home's max_connections/max_wal_senders/etc -
+  # Postgres refuses to replay WAL past a checkpoint recorded with higher
+  # values than the recovering instance's own settings ("recovery aborted
+  # because of insufficient parameter settings: max_connections = 100 is
+  # a lower setting than on the primary server, where its value was 200",
+  # confirmed live 2026-08-18). Copied from
+  # infrastructure/authentik/manifests/cnpg-cluster.yaml.
+  postgresql:
+    parameters:
+      max_connections: "200"
+      shared_buffers: "512MB"
+      effective_cache_size: "1536MB"
+      maintenance_work_mem: "128MB"
+      checkpoint_completion_target: "0.9"
+      wal_buffers: "16MB"
+      default_statistics_target: "100"
+      random_page_cost: "1.1"
+      effective_io_concurrency: "200"
+      work_mem: "2621kB"
+      min_wal_size: "1GB"
+      max_wal_size: "4GB"
+
+  bootstrap:
+    recovery:
+      source: home-backup
+
+  externalClusters:
+    - name: home-backup
+      barmanObjectStore:
+        # serverName defaults to the externalClusters[].name ("home-backup")
+        # here, NOT the source Postgres cluster's actual name - but home's
+        # barmanObjectStore backup: block (on the pg-authentik Cluster
+        # itself) defaults serverName to its own metadata.name
+        # ("pg-authentik"). Without this override, recovery looks for
+        # backups under the wrong server-name prefix and finds none -
+        # "no target backup found" despite the backup genuinely existing
+        # (confirmed live 2026-08-18).
+        serverName: pg-authentik
+        destinationPath: s3://cnpg-backups/pg-authentik
+        endpointURL: http://vps-minio.minio.svc.cluster.local:9000
+        s3Credentials:
+          accessKeyId:
+            name: vps-minio-secret
+            key: accesskey
+          secretAccessKey:
+            name: vps-minio-secret
+            key: secretkey
+
+  replica:
+    enabled: true
+    source: home-backup
+
+  monitoring:
+    enablePodMonitor: false  # no Prometheus on the VPS cluster

infrastructure/vps-standby/authentik/manifests/presync-job.yaml

@@ -0,0 +1,118 @@
+---
+# Same idempotent secret-bootstrap pattern as home's
+# infrastructure/authentik/manifests/presync-job.yaml, scoped to a
+# dedicated ServiceAccount here (no shared argocd-hook-sa exists on the
+# vps-standby cluster the way it does at home).
+#
+# SA/Role/RoleBinding are PreSync hooks too (hook-weight "-1", before the
+# Job's default weight "0") - without that they're just regular resources
+# applied in ArgoCD's normal Sync phase, which runs AFTER PreSync hooks,
+# so the Job's pod would fail to create with "serviceaccount not found"
+# (confirmed live 2026-08-18).
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: authentik-hook
+  namespace: authentik
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-weight: "-1"
+    # No hook-delete-policy here on purpose: SA/Role/RoleBinding aren't
+    # Jobs, so ArgoCD treats them as immediately "succeeded" on creation -
+    # a HookSucceeded delete policy would remove the SA right away,
+    # possibly racing with (or before) the weight "0" Job below that
+    # actually needs it to still exist while it runs.
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: authentik-hook
+  namespace: authentik
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-weight: "-1"
+    # No hook-delete-policy here on purpose: SA/Role/RoleBinding aren't
+    # Jobs, so ArgoCD treats them as immediately "succeeded" on creation -
+    # a HookSucceeded delete policy would remove the SA right away,
+    # possibly racing with (or before) the weight "0" Job below that
+    # actually needs it to still exist while it runs.
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create"]
+  - apiGroups: ["postgresql.cnpg.io"]
+    resources: ["clusters"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: authentik-hook
+  namespace: authentik
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-weight: "-1"
+    # No hook-delete-policy here on purpose: SA/Role/RoleBinding aren't
+    # Jobs, so ArgoCD treats them as immediately "succeeded" on creation -
+    # a HookSucceeded delete policy would remove the SA right away,
+    # possibly racing with (or before) the weight "0" Job below that
+    # actually needs it to still exist while it runs.
+subjects:
+  - kind: ServiceAccount
+    name: authentik-hook
+    namespace: authentik
+roleRef:
+  kind: Role
+  name: authentik-hook
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: authentik-presync
+  namespace: authentik
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-weight: "0"
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: authentik-hook
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: presync
+          image: alpine/k8s:1.32.13
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== Authentik (VPS) PreSync ==="
+
+              # NOTE: does NOT wait for pg-authentik to be "Healthy" the way
+              # home's presync-job does - a replica cluster in continuous
+              # recovery never reports Healthy in that sense (it's
+              # perpetually catching up / read-only), and server/worker are
+              # at replicas: 0 anyway so nothing actually needs the DB yet.
+
+              if ! kubectl -n authentik get secret authentik >/dev/null 2>&1; then
+                echo "Creating authentik secret (literal env:// placeholder -"
+                echo "matches home's values.yaml exactly, see values.yaml comment)..."
+                kubectl -n authentik create secret generic authentik \
+                  --from-literal=AUTHENTIK_SECRET_KEY="env://AUTHENTIK_SECRET_KEY"
+              else
+                echo "authentik secret already exists"
+              fi
+
+              echo "=== Done ==="

infrastructure/vps-standby/authentik/values.yaml

@@ -0,0 +1,101 @@
+# Authentik warm standby on the VPS - Phase 2. The CNPG replica cluster
+# (manifests/cnpg-cluster.yaml) continuously replays WAL from home in the
+# background; the app itself is NOT run in normal operation (replicas: 0)
+# since the replica DB is read-only until a deliberate manual promotion -
+# an Authentik pod trying to write against a read-only DB would just
+# crashloop uselessly. Promotion runbook: flip the CNPG cluster's
+# spec.replica.enabled to false (see cnpg-cluster.yaml), then scale
+# server/worker up from 0.
+#
+# The `authentik:` block below (secret_key/postgresql "env://" indirection)
+# is copied VERBATIM from infrastructure/authentik/values.yaml on purpose -
+# the authentik chart deterministically renders its own generated Secret
+# from these literal values.yaml strings (not randomly), so keeping this
+# block byte-identical between home and VPS means both clusters
+# independently arrive at the same AUTHENTIK_SECRET_KEY without needing to
+# manually copy it - required for promotion to work, since that key
+# decrypts things (stored provider secrets, cert private keys) that live
+# encrypted in the DB being replicated.
+authentik:
+  secret_key: env://AUTHENTIK_SECRET_KEY
+  postgresql:
+    host: env://AUTHENTIK_POSTGRESQL__HOST
+    port: 5432
+    name: env://AUTHENTIK_POSTGRESQL__NAME
+    user: env://AUTHENTIK_POSTGRESQL__USER
+    password: env://AUTHENTIK_POSTGRESQL__PASSWORD
+
+global:
+  envFrom:
+    - secretRef:
+        name: authentik
+    - secretRef:
+        name: pg-authentik-app
+      prefix: AUTHENTIK_POSTGRESQL__
+  env:
+    - name: AUTHENTIK_URL
+      value: "https://auth.kube.huskypup.net"
+    - name: AUTHENTIK_POSTGRESQL__HOST
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: host
+    - name: AUTHENTIK_POSTGRESQL__NAME
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: dbname
+    - name: AUTHENTIK_POSTGRESQL__USER
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: username
+    - name: AUTHENTIK_POSTGRESQL__PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: pg-authentik-app
+          key: password
+    - name: AUTHENTIK_POSTGRESQL__PORT
+      value: "5432"
+
+server:
+  replicas: 0
+  containerSecurityContext:
+    runAsNonRoot: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+  resources:
+    requests:
+      cpu: 50m
+      memory: 512Mi
+    limits:
+      memory: 1Gi
+  metrics:
+    enabled: false
+
+worker:
+  replicas: 0
+  containerSecurityContext:
+    runAsNonRoot: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+  resources:
+    requests:
+      cpu: 50m
+      memory: 512Mi
+    limits:
+      memory: 1Gi
+  metrics:
+    enabled: false
+
+# Disable bundled Postgres - using the CNPG replica cluster instead
+postgresql:
+  enabled: false

infrastructure/vps-standby/n8n/manifests/cnpg-cluster.yaml

@@ -0,0 +1,79 @@
+---
+# CNPG replica cluster continuously replaying WAL from home's pg-n8n
+# (apps/n8n/manifests/cnpg-cluster.yaml) via VPS MinIO's
+# cnpg-backups/pg-n8n bucket path. Same pattern as
+# infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml - see
+# that file's comments for the full rationale (replica-cluster mode vs.
+# custom restore scripting, read-only until manual promotion).
+#
+# vps-minio-secret is a plain Secret copied here manually (kubectl, not
+# git), same as the authentik one:
+#   kubectl -n n8n create secret generic vps-minio-secret \
+#     --from-literal=accesskey=<vps minio root user> \
+#     --from-literal=secretkey=<vps minio root password>
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: pg-n8n
+  namespace: n8n
+spec:
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  instances: 1
+
+  # shared_buffers: 512MB above needs headroom - matches home's requests/limits.
+  resources:
+    requests:
+      memory: "512Mi"
+      cpu: "25m"
+    limits:
+      memory: "2Gi"
+      cpu: "250m"
+
+  storage:
+    size: 10Gi
+    storageClass: local-path
+
+  # See infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml
+  # for why this must match home's settings (recovery aborts otherwise).
+  postgresql:
+    parameters:
+      max_connections: "200"
+      shared_buffers: "512MB"
+      effective_cache_size: "1536MB"
+      maintenance_work_mem: "128MB"
+      checkpoint_completion_target: "0.9"
+      wal_buffers: "16MB"
+      default_statistics_target: "100"
+      random_page_cost: "1.1"
+      effective_io_concurrency: "200"
+      work_mem: "2621kB"
+      min_wal_size: "1GB"
+      max_wal_size: "4GB"
+
+  bootstrap:
+    recovery:
+      source: home-backup
+
+  externalClusters:
+    - name: home-backup
+      barmanObjectStore:
+        # See infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml
+        # for why this override is required (serverName defaults to the
+        # externalClusters[].name, not the source cluster's real name).
+        serverName: pg-n8n
+        destinationPath: s3://cnpg-backups/pg-n8n
+        endpointURL: http://vps-minio.minio.svc.cluster.local:9000
+        s3Credentials:
+          accessKeyId:
+            name: vps-minio-secret
+            key: accesskey
+          secretAccessKey:
+            name: vps-minio-secret
+            key: secretkey
+
+  replica:
+    enabled: true
+    source: home-backup
+
+  monitoring:
+    enablePodMonitor: false

infrastructure/vps-standby/n8n/values.yaml

@@ -0,0 +1,105 @@
+# n8n warm standby on the VPS - Phase 2. Same discipline as
+# infrastructure/vps-standby/authentik/values.yaml: the CNPG replica
+# cluster keeps the DB continuously warm in the background, but the app
+# itself stays at replicaCount: 0 until a deliberate manual promotion
+# (flip pg-n8n's spec.replica.enabled to false, then scale this up).
+#
+# N8N_ENCRYPTION_KEY must be byte-identical to home's - it decrypts
+# stored credentials (API keys, OAuth tokens, etc.) that live encrypted
+# in the DB being replicated. Unlike Authentik's chart-deterministic
+# secret_key, n8n's isn't derived from anything reproducible - it's
+# copied for real (kubectl, not git, same as Vault's unseal key /
+# root token):
+#   kubectl -n n8n create secret generic n8n-config-secret \
+#     --from-literal=encryption-key=<home's N8N_ENCRYPTION_KEY>
+image:
+  repository: n8nio/n8n
+  tag: "2.0.3"
+
+config:
+  database:
+    type: postgresdb
+    postgresdb:
+      host: pg-n8n-rw
+      port: 5432
+      database: n8n
+      user: n8n
+      schema: public
+  generic:
+    timezone: America/New_York
+  path: /
+  host: n8n.kube.huskypup.net
+  port: 5678
+  protocol: https
+  executions:
+    mode: regular
+    saveDataOnError: all
+    saveDataOnSuccess: all
+    saveDataManualExecutions: true
+    pruneData: true
+    pruneDataMaxAge: 3760
+
+secret: {}
+
+# Not run in normal operation - see file header.
+replicaCount: 0
+
+service:
+  type: ClusterIP
+  port: 80
+
+securityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault
+
+ingress:
+  enabled: false
+
+persistence:
+  enabled: true
+  type: existing
+  existingClaim: n8n-main-persistence
+  storageClass: local-path
+  accessModes:
+    - ReadWriteOnce
+  size: 10Gi
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 256Mi
+  limits:
+    cpu: "500m"
+    memory: 512Mi
+
+extraEnvSecrets:
+  DB_POSTGRESDB_PASSWORD:
+    name: pg-n8n-app
+    key: password
+  N8N_ENCRYPTION_KEY:
+    name: n8n-config-secret
+    key: encryption-key
+
+extraEnv:
+  WEBHOOK_URL: https://n8n.kube.huskypup.net/
+  N8N_EDITOR_BASE_URL: https://n8n.kube.huskypup.net
+  N8N_LOG_LEVEL: error
+
+postgresql:
+  enabled: false
+
+redis:
+  enabled: false
+
+scaling:
+  enabled: false
+
+extraVolumes: []
+extraVolumeMounts: []
+nodeSelector: {}
+tolerations: []
+affinity: {}

infrastructure/vps-standby/nextcloud/manifests/cnpg-cluster.yaml

@@ -0,0 +1,78 @@
+---
+# CNPG replica cluster continuously replaying WAL from home's pg-nextcloud
+# (apps/nextcloud/manifests/cnpg-cluster.yaml) via VPS MinIO's
+# cnpg-backups/pg-nextcloud bucket path. Same pattern as the authentik/n8n
+# VPS replica clusters - see infrastructure/vps-standby/authentik/
+# manifests/cnpg-cluster.yaml for the full rationale.
+#
+# vps-minio-secret is a plain Secret copied here manually (kubectl, not
+# git):
+#   kubectl -n nextcloud create secret generic vps-minio-secret \
+#     --from-literal=accesskey=<vps minio root user> \
+#     --from-literal=secretkey=<vps minio root password>
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: pg-nextcloud
+  namespace: nextcloud
+spec:
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  instances: 1
+
+  # shared_buffers: 512MB above needs headroom - matches home's requests/limits.
+  resources:
+    requests:
+      memory: "512Mi"
+      cpu: "25m"
+    limits:
+      memory: "2Gi"
+      cpu: "250m"
+
+  storage:
+    size: 20Gi
+    storageClass: local-path
+
+  # See infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml
+  # for why this must match home's settings (recovery aborts otherwise).
+  postgresql:
+    parameters:
+      max_connections: "200"
+      shared_buffers: "512MB"
+      effective_cache_size: "1536MB"
+      maintenance_work_mem: "128MB"
+      checkpoint_completion_target: "0.9"
+      wal_buffers: "16MB"
+      default_statistics_target: "100"
+      random_page_cost: "1.1"
+      effective_io_concurrency: "200"
+      work_mem: "2621kB"
+      min_wal_size: "1GB"
+      max_wal_size: "4GB"
+
+  bootstrap:
+    recovery:
+      source: home-backup
+
+  externalClusters:
+    - name: home-backup
+      barmanObjectStore:
+        # See infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml
+        # for why this override is required (serverName defaults to the
+        # externalClusters[].name, not the source cluster's real name).
+        serverName: pg-nextcloud
+        destinationPath: s3://cnpg-backups/pg-nextcloud
+        endpointURL: http://vps-minio.minio.svc.cluster.local:9000
+        s3Credentials:
+          accessKeyId:
+            name: vps-minio-secret
+            key: accesskey
+          secretAccessKey:
+            name: vps-minio-secret
+            key: secretkey
+
+  replica:
+    enabled: true
+    source: home-backup
+
+  monitoring:
+    enablePodMonitor: false

infrastructure/vps-standby/nextcloud/manifests/pvc-restore-cronjob.yaml

@@ -0,0 +1,101 @@
+---
+# Restores the latest restic snapshot from home's nextcloud-pvc-sync
+# CronJob (apps/nextcloud/manifests/pvc-sync-cronjob.yaml, which backs up
+# to VPS MinIO's nextcloud-files/restic-repo daily at 02:00) into this
+# standby's own Nextcloud PVC. Runs daily at 04:00 - enough margin after
+# home's job to be sure that day's snapshot has landed.
+#
+# `restic restore latest --target /` restores into /data/... because
+# home's backup stored an absolute /data path (`restic backup /data ...`)
+# - mounting the destination PVC at /data here mirrors that exactly.
+#
+# nextcloud-restic-password must be the SAME password used to init the
+# repo at home (it's the decryption key for the whole restic repository,
+# not something that can differ per-consumer) - copied here manually
+# (kubectl, not git):
+#   kubectl -n nextcloud create secret generic nextcloud-restic-password \
+#     --from-literal=password=<home's nextcloud-restic-password>
+#
+# Nextcloud itself isn't running (replicas: 0, see values.yaml) so there's
+# no live-write conflict risk overwriting the PVC on every run.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: nextcloud-pvc-restore
+  namespace: nextcloud
+spec:
+  schedule: "0 4 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      template:
+        spec:
+          restartPolicy: Never
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65534
+            fsGroup: 33  # matches the real nextcloud Deployment's fsGroup, same reasoning as home's pvc-sync-cronjob
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: restic-restore
+              image: restic/restic:0.16.4
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  set -eu
+                  export RESTIC_REPOSITORY="s3:http://vps-minio.minio.svc.cluster.local:9000/nextcloud-files/restic-repo"
+                  export RESTIC_PASSWORD_FILE=/restic-secret/password
+                  export AWS_ACCESS_KEY_ID="${MINIO_ACCESS_KEY}"
+                  export AWS_SECRET_ACCESS_KEY="${MINIO_SECRET_KEY}"
+                  export RESTIC_CACHE_DIR=/tmp/restic-cache
+
+                  if ! restic snapshots >/dev/null 2>&1; then
+                    echo "No repo/snapshots reachable yet - nothing to restore."
+                    exit 0
+                  fi
+
+                  echo "==> Restoring latest snapshot into /data..."
+                  restic restore latest --tag nextcloud --host nextcloud-k8s --target /
+
+                  echo "==> Done."
+              env:
+                - name: MINIO_ACCESS_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: vps-minio-secret
+                      key: accesskey
+                - name: MINIO_SECRET_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: vps-minio-secret
+                      key: secretkey
+              volumeMounts:
+                - name: nextcloud-data
+                  mountPath: /data
+                - name: restic-secret
+                  mountPath: /restic-secret
+                  readOnly: true
+          volumes:
+            - name: nextcloud-data
+              persistentVolumeClaim:
+                # Chart-generated PVC name, follows the Helm release name
+                # (Application metadata.name: vps-nextcloud) - same
+                # release-name-based naming gotcha hit with vault-0/
+                # vps-vault-0 and gitea-http/vps-gitea-http. Verify against
+                # `kubectl -n nextcloud get pvc` after first deploy.
+                claimName: vps-nextcloud-nextcloud
+            - name: restic-secret
+              secret:
+                secretName: nextcloud-restic-password
+                items:
+                  - key: password
+                    path: password

infrastructure/vps-standby/nextcloud/values.yaml

@@ -0,0 +1,94 @@
+# Nextcloud warm standby on the VPS - Phase 2. Same discipline as the
+# other vps-standby apps: CNPG replica cluster (manifests/cnpg-cluster.yaml)
+# keeps the DB warm, manifests/pvc-restore-cronjob.yaml keeps file content
+# warm, but the app itself stays at replicaCount: 0 until a deliberate
+# manual promotion.
+#
+# No Redis here - the home instance uses the redis-operator
+# (infrastructure/vps-standby has no redis-operator deployed, out of
+# scope for a standby that isn't actually serving traffic). Nextcloud
+# runs fine without Redis (falls back to DB-based locking, just slower) -
+# acceptable for an emergency-promotion scenario; add a real Redis at
+# promotion time if desired.
+replicaCount: 0
+
+nextcloud:
+   host: nextcloud.kube.huskypup.net
+   username: ""
+   password: ""
+
+   phpConfigs:
+      upload.ini: |
+        upload_tmp_dir = /var/www/tmp
+        sys_temp_dir = /var/www/tmp
+
+   extraEnv:
+     - name: TMPDIR
+       value: /var/www/tmp
+     - name: PHP_MEMORY_LIMIT
+       value: "2G"
+     - name: PHP_UPLOAD_LIMIT
+       value: "10G"
+
+   configs:
+      proxy.config.php: |-
+        <?php
+        $CONFIG = array (
+          'trusted_proxies' => array(
+            0 => '10.0.0.0/8',
+            1 => '172.16.0.0/12',
+          ),
+          'overwriteprotocol' => 'https',
+          'overwrite.cli.url' => 'https://nextcloud.kube.huskypup.net',
+          'allow_local_remote_servers' => true,
+        );
+      temp.config.php: |-
+        <?php
+        $CONFIG = array (
+          'tempdirectory' => '/var/www/tmp',
+        );
+
+   existingSecret:
+      enabled: true
+      secretName: nextcloud-admin-secret
+      usernameKey: username
+      passwordKey: password
+
+   ingress:
+     enabled: false
+
+externalDatabase:
+   enabled: true
+   type: postgresql
+   host: pg-nextcloud-rw
+   port: 5432
+   user: nextcloud
+   database: nextcloud
+   existingSecret:
+      enabled: true
+      secretName: pg-nextcloud-app
+      passwordKey: password
+      usernameKey: username
+
+persistence:
+   enabled: true
+   storageClass: local-path
+   accessMode: ReadWriteOnce
+   size: 30Gi
+
+resources:
+   requests:
+     cpu: 50m
+     memory: 256Mi
+   limits:
+     cpu: 500m
+     memory: 1Gi
+
+redis:
+   enabled: false
+
+externalRedis:
+   enabled: false
+
+metrics:
+   enabled: false