apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: pg-praefect
  namespace: gitlab
spec:
  imageName: ghcr.io/cloudnative-pg/postgresql:16
  instances: 2

  # Resources: keep memory, keep CPU requests low for scheduling.
  # CPU limits omitted so Postgres can burst when available.
  resources:
    requests:
      memory: "512Mi"
      cpu: "100m"
    limits:
      memory: "2Gi"

  # Spread replicas across different nodes
  affinity:
    topologyKey: kubernetes.io/hostname

  storage:
    size: 10Gi
    storageClass: rook-ceph-block

  primaryUpdateStrategy: unsupervised

  # Explicit params added 2026-08-22 (GitLab cross-site replication plan)
  # - this cluster ran on bare Postgres defaults before. A VPS replica
  # can't replay WAL past a checkpoint recorded with higher settings than
  # its own ("recovery aborted because of insufficient parameter
  # settings", confirmed live for pg-authentik) - giving both sides an
  # identical explicit block up front means nobody can tune one side
  # later and silently break replication.
  postgresql:
    parameters:
      max_connections: "200"
      shared_buffers: "512MB"
      effective_cache_size: "1536MB"
      maintenance_work_mem: "128MB"
      checkpoint_completion_target: "0.9"
      wal_buffers: "16MB"
      default_statistics_target: "100"
      random_page_cost: "1.1"
      effective_io_concurrency: "200"
      work_mem: "4MB"
      min_wal_size: "1GB"
      max_wal_size: "4GB"
      max_worker_processes: "4"

  bootstrap:
    initdb:
      database: praefect_production
      owner: app

  # Backup to VPS MinIO, also the initial-seed source for the VPS's own
  # pg-praefect replica (bootstrap.recovery, Phase 1c) - this cluster had
  # no backup block at all before. See the matching comment on
  # cnpg-cluster.yaml (pg-gitlab) in this same directory.
  backup:
    barmanObjectStore:
      destinationPath: s3://cnpg-backups/pg-praefect
      endpointURL: http://100.108.113.41:9000
      s3Credentials:
        accessKeyId:
          name: vps-minio-secret
          key: accesskey
        secretAccessKey:
          name: vps-minio-secret
          key: secretkey
      wal:
        compression: gzip
        maxParallel: 2
    retentionPolicy: "30d"

  monitoring:
    enablePodMonitor: true

  # GitLab cross-site replication Phase 1c stage 2 - same pattern as
  # cnpg-cluster.yaml (pg-gitlab) in this same directory.
  externalClusters:
    - name: home
      connectionParameters:
        host: pg-praefect-rw
        port: "5432"
        dbname: praefect_production
        user: streaming_replica
        sslmode: verify-ca
      sslCert:
        name: pg-praefect-replication
        key: tls.crt
      sslKey:
        name: pg-praefect-replication
        key: tls.key
      sslRootCert:
        name: pg-praefect-ca
        key: ca.crt
    - name: vps
      connectionParameters:
        host: 100.108.113.41
        port: "32445"
        dbname: praefect_production
        user: streaming_replica
        sslmode: verify-ca
      sslCert:
        name: pg-praefect-vps-replication
        key: tls.crt
      sslKey:
        name: pg-praefect-vps-replication
        key: tls.key
      sslRootCert:
        name: pg-praefect-vps-ca
        key: ca.crt

  replica:
    self: home
    primary: home
    source: home