apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: pg-authentik
  namespace: authentik
spec:
  imageName: ghcr.io/cloudnative-pg/postgresql:16
  instances: 2

  # Resource limits to prevent OOM
  resources:
    requests:
      memory: "512Mi"
      cpu: "25m"
    limits:
      memory: "2Gi"
      cpu: "250m"

  # Spread replicas across different nodes  
  affinity:
    topologyKey: kubernetes.io/hostname

  storage:
    size: 5Gi
    storageClass: rook-ceph-block

  primaryUpdateStrategy: unsupervised
  
  # PostgreSQL configuration for better performance
  postgresql:
    parameters:
      max_connections: "200"
      shared_buffers: "512MB"
      effective_cache_size: "1536MB"
      maintenance_work_mem: "128MB"
      checkpoint_completion_target: "0.9"
      wal_buffers: "16MB"
      default_statistics_target: "100"
      random_page_cost: "1.1"
      effective_io_concurrency: "200"
      work_mem: "2621kB"
      min_wal_size: "1GB"
      max_wal_size: "4GB"

  bootstrap:
    initdb:
      database: app
      owner: app

  # Backup to VPS MinIO - RE-ENABLED 2026-08-18. Real pod-egress routing to
  # the VPS now exists (netbird-egress DaemonSet, hostNetwork + per-node
  # route into 100.108.0.0/16 - see infrastructure/netbird/manifests/
  # egress-daemonset.yaml). Endpoint changed from the NodePort
  # (vps-minio.netbird.internal:30900 - never resolvable anyway, Netbird has
  # no DNS configured, and separately blocked by Netbird's own ACL model,
  # which only permits *established* forwarded connections through a peer,
  # never new ones) to a locally-terminated socat forward on the VPS host
  # itself (100.108.113.41:9000 - see minio-forward.service on the VPS),
  # mirroring the pattern that already worked for the CrowdSec CAPI proxy.
  backup:
    barmanObjectStore:
      destinationPath: s3://cnpg-backups/pg-authentik
      endpointURL: http://100.108.113.41:9000
      s3Credentials:
        accessKeyId:
          name: vps-minio-secret
          key: accesskey
        secretAccessKey:
          name: vps-minio-secret
          key: secretkey
      wal:
        compression: gzip
        maxParallel: 2
    retentionPolicy: "30d"

  monitoring:
    enablePodMonitor: true

  # Multi-site active failover pilot (see
  # /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - streaming
  # replication to/from the VPS's pg-authentik cluster, alongside (not
  # replacing) the barmanObjectStore backup above.
  #
  # Auth: reuses CNPG's own generated streaming_replica client cert
  # (CN=streaming_replica, issued by the VPS's own pg-authentik CA) -
  # copied here manually as pg-authentik-vps-{ca,replication} (kubectl,
  # not git - same pattern as every other cross-cluster secret tonight).
  # This is the exact credential CNPG's own pg_hba.conf already trusts
  # for streaming replication, nothing new to provision.
  #
  # sslmode: verify-ca (not verify-full) - the VPS's server cert was
  # issued for its in-cluster DNS names, not for the NodePort IP address
  # (100.108.113.41) home actually dials; verify-ca still validates the
  # cert chain/CA trust and encrypts the connection, just skips hostname
  # matching.
  #
  # Reachable via 100.108.113.41 (VPS's Netbird IP) - home reaching OUT
  # to the VPS already works today via the netbird-egress DaemonSet's
  # route (same path used for MinIO/CrowdSec backups all session) - no
  # UniFi port-forward needed for this direction, only the reverse
  # (VPS/witness reaching INTO home) needed that.
  externalClusters:
    - name: vps
      connectionParameters:
        host: 100.108.113.41
        port: "32433"
        dbname: app
        user: streaming_replica
        sslmode: verify-ca
      sslCert:
        name: pg-authentik-vps-replication
        key: tls.crt
      sslKey:
        name: pg-authentik-vps-replication
        key: tls.key
      sslRootCert:
        name: pg-authentik-vps-ca
        key: ca.crt

  # Distributed topology: both sides agree home is primary today. Failover
  # flips the VPS's replica.primary to "vps" (+ promotion token) - see the
  # plan doc's failover-watcher section. Failback is the same in reverse,
  # deliberately manual.
  replica:
    self: home
    primary: home
    source: vps  # where home would replicate FROM if it were ever a replica (not active now - primary: home)