apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: pg-n8n
  namespace: n8n
spec:
  imageName: ghcr.io/cloudnative-pg/postgresql:16
  instances: 2

  # Resource limits to prevent OOM
  resources:
    requests:
      memory: "512Mi"
      cpu: "25m"
    limits:
      memory: "2Gi"
      cpu: "250m"

  # Spread replicas across different nodes
  affinity:
    topologyKey: kubernetes.io/hostname

  storage:
    size: 10Gi
    storageClass: rook-ceph-block

  primaryUpdateStrategy: unsupervised
  
  # PostgreSQL configuration for better performance
  postgresql:
    parameters:
      max_connections: "200"
      shared_buffers: "512MB"
      effective_cache_size: "1536MB"
      maintenance_work_mem: "128MB"
      checkpoint_completion_target: "0.9"
      wal_buffers: "16MB"
      default_statistics_target: "100"
      random_page_cost: "1.1"
      effective_io_concurrency: "200"
      work_mem: "2621kB"
      min_wal_size: "1GB"
      max_wal_size: "4GB"

  bootstrap:
    initdb:
      database: n8n
      owner: n8n

  # Backup to VPS MinIO - DISABLED 2026-08-17. No node in the cluster has
  # any route into the Netbird mesh for pod-originated (egress) traffic;
  # the per-namespace netbird "router" pods are inbound-only infrastructure.
  # continuousArchiving kept failing to connect to vps-minio.netbird.internal,
  # which held Ready=False permanently (real condition, not cosmetic - this
  # is what drove n8n's CNPG health flapping in ArgoCD). Re-enable once real
  # pod-egress routing to the VPS exists (tracked as a separate task) - no
  # other change needed, this block is otherwise complete/correct.
  # backup:
  #   barmanObjectStore:
  #     destinationPath: s3://cnpg-backups/pg-n8n
  #     endpointURL: http://vps-minio.netbird.internal:30900
  #     s3Credentials:
  #       accessKeyId:
  #         name: vps-minio-secret
  #         key: accesskey
  #       secretAccessKey:
  #         name: vps-minio-secret
  #         key: secretkey
  #     wal:
  #       compression: gzip
  #       maxParallel: 2
  #   retentionPolicy: "30d"

  monitoring:
    enablePodMonitor: true