---
# GitLab cross-site replication Phase 1c (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - was a fully
# independent standalone cluster (own initdb, own root/Scooby test data,
# never meant to survive this). Now a real replica of home's pg-gitlab
# (apps/gitlab/manifests/cnpg-cluster.yaml), matching the pattern already
# proven for pg-authentik.
#
# Deployed in two stages, same as the original authentik/n8n/nextcloud
# VPS replicas were: first as a plain bootstrap.recovery replica (this
# commit - no externalClusters/replica streaming config yet, since that
# needs THIS cluster's own CNPG-generated certs to exist first, which
# only happens once the cluster itself exists), then a second commit adds
# the streaming replication config once those certs have been copied
# cross-cluster.
#
# postgresql.parameters MUST match-or-exceed home's - copied verbatim
# from apps/gitlab/manifests/cnpg-cluster.yaml. A replica can't replay
# WAL past a checkpoint recorded with higher settings than its own
# ("recovery aborted because of insufficient parameter settings",
# confirmed live for pg-authentik).
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: pg-gitlab
  namespace: gitlab
spec:
  imageName: ghcr.io/cloudnative-pg/postgresql:16
  instances: 1

  # shared_buffers 1GB below needs headroom - matches home's requests/limits.
  resources:
    requests:
      memory: "1Gi"
      cpu: "50m"
    limits:
      memory: "4Gi"
      cpu: "500m"

  storage:
    size: 50Gi  # matches home's size
    storageClass: local-path

  primaryUpdateStrategy: unsupervised

  postgresql:
    parameters:
      max_connections: "400"
      shared_buffers: "1GB"
      effective_cache_size: "3GB"
      maintenance_work_mem: "256MB"
      checkpoint_completion_target: "0.9"
      wal_buffers: "16MB"
      default_statistics_target: "100"
      random_page_cost: "1.1"
      effective_io_concurrency: "200"
      work_mem: "16MB"
      min_wal_size: "1GB"
      max_wal_size: "4GB"
      max_worker_processes: "4"
      max_parallel_workers_per_gather: "2"
      max_parallel_workers: "4"

  bootstrap:
    recovery:
      source: home

  # Stage 2 (see /home/scooby/.claude/plans/jiggly-snacking-iverson.md):
  # connectionParameters added alongside the existing barmanObjectStore
  # on the SAME "home" entry - the recovery-mode initial seed stays
  # exactly as-is, ongoing replication now streams instead of relying on
  # WAL-archive polling (the source of the crash-looping/probe-tuning
  # fights documented for the pg-authentik precedent). Also needs a
  # self-referencing "vps" entry - replica.self must match an
  # externalClusters name too, even though it's this very cluster
  # (confirmed live: "External cluster vps not found" until one was
  # added).
  #
  # Reachable via home.kube.huskypup.net:61442 - a UniFi WAN port-forward
  # to talos-cp-01's real LAN IP, source-IP-restricted to the VPS/witness
  # public IPs (see apps/gitlab/manifests/ha-postgres-nodeport.yaml). NOT
  # the Netbird mesh directly - UniFi has no route to that CIDR
  # (confirmed live for the pg-authentik precedent).
  externalClusters:
    - name: home
      barmanObjectStore:
        # serverName defaults to the externalClusters[].name, NOT the
        # source Postgres cluster's actual metadata.name - home's own
        # backup: block defaults serverName to "pg-gitlab" (its own
        # name). Without this override, recovery looks under the wrong
        # server-name prefix and finds nothing (confirmed live for the
        # pg-authentik precedent).
        serverName: pg-gitlab
        destinationPath: s3://cnpg-backups/pg-gitlab
        endpointURL: http://vps-minio.minio.svc.cluster.local:9000
        s3Credentials:
          accessKeyId:
            name: vps-minio-secret
            key: accesskey
          secretAccessKey:
            name: vps-minio-secret
            key: secretkey
      connectionParameters:
        host: home.kube.huskypup.net
        port: "61442"
        dbname: gitlabhq_production
        user: streaming_replica
        sslmode: verify-ca
      sslCert:
        name: pg-gitlab-home-replication
        key: tls.crt
      sslKey:
        name: pg-gitlab-home-replication
        key: tls.key
      sslRootCert:
        name: pg-gitlab-home-ca
        key: ca.crt
    - name: vps
      connectionParameters:
        host: pg-gitlab-rw
        port: "5432"
        dbname: gitlabhq_production
        user: streaming_replica
        sslmode: verify-ca
      sslCert:
        name: pg-gitlab-replication
        key: tls.crt
      sslKey:
        name: pg-gitlab-replication
        key: tls.key
      sslRootCert:
        name: pg-gitlab-ca
        key: ca.crt

  # Distributed topology: both sides agree home is primary today. No
  # replica.enabled - mutually exclusive with primary/self (confirmed
  # live for the pg-authentik precedent).
  replica:
    self: vps
    primary: home
    source: home

  monitoring:
    enablePodMonitor: false  # no Prometheus on the VPS cluster