apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: pg-n8n
  namespace: n8n
spec:
  imageName: ghcr.io/cloudnative-pg/postgresql:16
  instances: 2

  # Resource limits to prevent OOM
  resources:
    requests:
      memory: "512Mi"
      cpu: "25m"
    limits:
      memory: "2Gi"
      cpu: "250m"

  # Spread replicas across different nodes
  affinity:
    topologyKey: kubernetes.io/hostname

  storage:
    size: 10Gi
    storageClass: rook-ceph-block

  primaryUpdateStrategy: unsupervised
  
  # PostgreSQL configuration for better performance
  postgresql:
    parameters:
      max_connections: "200"
      shared_buffers: "512MB"
      effective_cache_size: "1536MB"
      maintenance_work_mem: "128MB"
      checkpoint_completion_target: "0.9"
      wal_buffers: "16MB"
      default_statistics_target: "100"
      random_page_cost: "1.1"
      effective_io_concurrency: "200"
      work_mem: "2621kB"
      min_wal_size: "1GB"
      max_wal_size: "4GB"

  bootstrap:
    initdb:
      database: n8n
      owner: n8n

  # Backup to VPS MinIO - RE-ENABLED 2026-08-18. Real pod-egress routing to
  # the VPS now exists (netbird-egress DaemonSet, hostNetwork + per-node
  # route into 100.108.0.0/16 - see infrastructure/netbird/manifests/
  # egress-daemonset.yaml). Endpoint changed from the NodePort
  # (vps-minio.netbird.internal:30900 - never resolvable anyway, Netbird has
  # no DNS configured, and separately blocked by Netbird's own ACL model,
  # which only permits *established* forwarded connections through a peer,
  # never new ones) to a locally-terminated socat forward on the VPS host
  # itself (100.108.113.41:9000 - see minio-forward.service on the VPS),
  # mirroring the pattern that already worked for the CrowdSec CAPI proxy.
  backup:
    barmanObjectStore:
      destinationPath: s3://cnpg-backups/pg-n8n
      endpointURL: http://100.108.113.41:9000
      s3Credentials:
        accessKeyId:
          name: vps-minio-secret
          key: accesskey
        secretAccessKey:
          name: vps-minio-secret
          key: secretkey
      wal:
        compression: gzip
        maxParallel: 2
    retentionPolicy: "30d"

  monitoring:
    enablePodMonitor: true