---
# CNPG replica cluster continuously replaying WAL from home's pg-n8n
# (apps/n8n/manifests/cnpg-cluster.yaml) via VPS MinIO's
# cnpg-backups/pg-n8n bucket path. Same pattern as
# infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml - see
# that file's comments for the full rationale (replica-cluster mode vs.
# custom restore scripting, read-only until manual promotion).
#
# vps-minio-secret is a plain Secret copied here manually (kubectl, not
# git), same as the authentik one:
#   kubectl -n n8n create secret generic vps-minio-secret \
#     --from-literal=accesskey=<vps minio root user> \
#     --from-literal=secretkey=<vps minio root password>
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: pg-n8n
  namespace: n8n
spec:
  imageName: ghcr.io/cloudnative-pg/postgresql:16
  instances: 1

  # shared_buffers: 512MB above needs headroom - matches home's requests/limits.
  resources:
    requests:
      memory: "512Mi"
      cpu: "25m"
    limits:
      memory: "2Gi"
      cpu: "250m"

  storage:
    size: 10Gi
    storageClass: local-path

  # See infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml
  # for why this must match home's settings (recovery aborts otherwise).
  postgresql:
    parameters:
      max_connections: "200"
      shared_buffers: "512MB"
      effective_cache_size: "1536MB"
      maintenance_work_mem: "128MB"
      checkpoint_completion_target: "0.9"
      wal_buffers: "16MB"
      default_statistics_target: "100"
      random_page_cost: "1.1"
      effective_io_concurrency: "200"
      work_mem: "2621kB"
      min_wal_size: "1GB"
      max_wal_size: "4GB"

  bootstrap:
    recovery:
      source: home-backup

  externalClusters:
    - name: home-backup
      barmanObjectStore:
        # See infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml
        # for why this override is required (serverName defaults to the
        # externalClusters[].name, not the source cluster's real name).
        serverName: pg-n8n
        destinationPath: s3://cnpg-backups/pg-n8n
        endpointURL: http://vps-minio.minio.svc.cluster.local:9000
        s3Credentials:
          accessKeyId:
            name: vps-minio-secret
            key: accesskey
          secretAccessKey:
            name: vps-minio-secret
            key: secretkey

  replica:
    enabled: true
    source: home-backup

  monitoring:
    enablePodMonitor: false