mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
4a0de188df
Adds externalClusters connectionParameters + replica.self/primary/source to all four Cluster CRs (home pg-gitlab/pg-praefect, VPS pg-gitlab/pg-praefect), turning last commit's recovery-only replicas into real CNPG streaming replicas - exact pattern already proven for pg-authentik. TLS certs copied cross-cluster manually (kubectl, not git, same as every other cross-cluster secret in this plan). Also adds pg-gitlab-app/pg-praefect-app password sync (PushSecret home -> Vault -> ExternalSecret VPS, Merge policy) - CNPG-generated passwords stay in sync via WAL replication but the K8s Secret OBJECTS never resync on their own, same gap already closed for pg-authentik-app. VPS's standalone clusters were already destroyed and recreated as recovery-mode replicas in the prior commit (with the user's explicit help running the classifier-blocked kubectl delete) - this commit turns on the actual streaming replication on top of that. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
138 lines
4.3 KiB
YAML
138 lines
4.3 KiB
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: pg-gitlab
|
|
namespace: gitlab
|
|
spec:
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16
|
|
instances: 3 # 3 instances for production HA
|
|
|
|
# Database resources (homelab-friendly requests, burstable CPU)
|
|
resources:
|
|
requests:
|
|
memory: "1Gi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "4Gi"
|
|
cpu: "500m"
|
|
|
|
# Spread replicas across different nodes
|
|
affinity:
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
storage:
|
|
size: 50Gi # Increased for production
|
|
storageClass: rook-ceph-block
|
|
|
|
primaryUpdateStrategy: unsupervised
|
|
|
|
bootstrap:
|
|
initdb:
|
|
database: gitlabhq_production
|
|
owner: app
|
|
postInitSQL:
|
|
- CREATE EXTENSION IF NOT EXISTS pg_trgm;
|
|
- CREATE EXTENSION IF NOT EXISTS btree_gist;
|
|
|
|
# PostgreSQL configuration tuning for GitLab
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "400"
|
|
shared_buffers: "1GB"
|
|
effective_cache_size: "3GB"
|
|
maintenance_work_mem: "256MB"
|
|
checkpoint_completion_target: "0.9"
|
|
wal_buffers: "16MB"
|
|
default_statistics_target: "100"
|
|
random_page_cost: "1.1"
|
|
effective_io_concurrency: "200"
|
|
work_mem: "16MB"
|
|
min_wal_size: "1GB"
|
|
max_wal_size: "4GB"
|
|
max_worker_processes: "4"
|
|
max_parallel_workers_per_gather: "2"
|
|
max_parallel_workers: "4"
|
|
|
|
# Backup configuration - repointed to VPS MinIO 2026-08-22 (GitLab
|
|
# cross-site replication plan, see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md's "GitLab True
|
|
# Cross-Site Replication" section). Was gitlab-minio-svc (in-cluster,
|
|
# same Ceph the backup is meant to protect against). Also doubles as
|
|
# the initial-seed source for the VPS's own pg-gitlab replica
|
|
# (bootstrap.recovery, Phase 1c) - same barmanObjectStore block serves
|
|
# both purposes, matching the Authentik precedent
|
|
# (infrastructure/authentik/manifests/cnpg-cluster.yaml).
|
|
backup:
|
|
barmanObjectStore:
|
|
destinationPath: s3://cnpg-backups/pg-gitlab
|
|
endpointURL: http://100.108.113.41:9000
|
|
s3Credentials:
|
|
accessKeyId:
|
|
name: vps-minio-secret
|
|
key: accesskey
|
|
secretAccessKey:
|
|
name: vps-minio-secret
|
|
key: secretkey
|
|
wal:
|
|
compression: gzip
|
|
maxParallel: 2
|
|
retentionPolicy: "30d"
|
|
|
|
monitoring:
|
|
enablePodMonitor: true
|
|
|
|
# GitLab cross-site replication Phase 1c stage 2 (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - streaming
|
|
# replication to/from the VPS's pg-gitlab cluster, alongside (not
|
|
# replacing) the barmanObjectStore backup above. Exact pattern proven
|
|
# for pg-authentik (infrastructure/authentik/manifests/cnpg-cluster.yaml).
|
|
#
|
|
# Auth: reuses CNPG's own generated streaming_replica client cert,
|
|
# copied here manually as pg-gitlab-vps-{ca,replication} (kubectl, not
|
|
# git). sslmode: verify-ca (not verify-full) - the VPS's server cert is
|
|
# issued for its in-cluster DNS names, not the NodePort IP dialed here.
|
|
#
|
|
# Reachable via 100.108.113.41 (VPS's Netbird IP) - home reaching OUT
|
|
# to the VPS already works via the netbird-egress DaemonSet's route, no
|
|
# UniFi port-forward needed for this direction (only the reverse,
|
|
# VPS->home, needed that - see ha-postgres-nodeport.yaml).
|
|
externalClusters:
|
|
- name: home
|
|
connectionParameters:
|
|
host: pg-gitlab-rw
|
|
port: "5432"
|
|
dbname: gitlabhq_production
|
|
user: streaming_replica
|
|
sslmode: verify-ca
|
|
sslCert:
|
|
name: pg-gitlab-replication
|
|
key: tls.crt
|
|
sslKey:
|
|
name: pg-gitlab-replication
|
|
key: tls.key
|
|
sslRootCert:
|
|
name: pg-gitlab-ca
|
|
key: ca.crt
|
|
- name: vps
|
|
connectionParameters:
|
|
host: 100.108.113.41
|
|
port: "32444"
|
|
dbname: gitlabhq_production
|
|
user: streaming_replica
|
|
sslmode: verify-ca
|
|
sslCert:
|
|
name: pg-gitlab-vps-replication
|
|
key: tls.crt
|
|
sslKey:
|
|
name: pg-gitlab-vps-replication
|
|
key: tls.key
|
|
sslRootCert:
|
|
name: pg-gitlab-vps-ca
|
|
key: ca.crt
|
|
|
|
# Distributed topology: both sides agree home is primary today.
|
|
replica:
|
|
self: home
|
|
primary: home
|
|
source: home # required unconditionally by the admission webhook even though home isn't replicating from anyone (self == primary)
|