mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-23 12:56:46 +00:00
Scooby HuskyandClaude Sonnet 5
4a0de188df
Adds externalClusters connectionParameters + replica.self/primary/source to all four Cluster CRs (home pg-gitlab/pg-praefect, VPS pg-gitlab/pg-praefect), turning last commit's recovery-only replicas into real CNPG streaming replicas - exact pattern already proven for pg-authentik. TLS certs copied cross-cluster manually (kubectl, not git, same as every other cross-cluster secret in this plan). Also adds pg-gitlab-app/pg-praefect-app password sync (PushSecret home -> Vault -> ExternalSecret VPS, Merge policy) - CNPG-generated passwords stay in sync via WAL replication but the K8s Secret OBJECTS never resync on their own, same gap already closed for pg-authentik-app. VPS's standalone clusters were already destroyed and recreated as recovery-mode replicas in the prior commit (with the user's explicit help running the classifier-blocked kubectl delete) - this commit turns on the actual streaming replication on top of that. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
145 lines
4.9 KiB
YAML
145 lines
4.9 KiB
YAML
---
|
|
# GitLab cross-site replication Phase 1c (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - was a fully
|
|
# independent standalone cluster (own initdb, own root/Scooby test data,
|
|
# never meant to survive this). Now a real replica of home's pg-gitlab
|
|
# (apps/gitlab/manifests/cnpg-cluster.yaml), matching the pattern already
|
|
# proven for pg-authentik.
|
|
#
|
|
# Deployed in two stages, same as the original authentik/n8n/nextcloud
|
|
# VPS replicas were: first as a plain bootstrap.recovery replica (this
|
|
# commit - no externalClusters/replica streaming config yet, since that
|
|
# needs THIS cluster's own CNPG-generated certs to exist first, which
|
|
# only happens once the cluster itself exists), then a second commit adds
|
|
# the streaming replication config once those certs have been copied
|
|
# cross-cluster.
|
|
#
|
|
# postgresql.parameters MUST match-or-exceed home's - copied verbatim
|
|
# from apps/gitlab/manifests/cnpg-cluster.yaml. A replica can't replay
|
|
# WAL past a checkpoint recorded with higher settings than its own
|
|
# ("recovery aborted because of insufficient parameter settings",
|
|
# confirmed live for pg-authentik).
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: pg-gitlab
|
|
namespace: gitlab
|
|
spec:
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16
|
|
instances: 1
|
|
|
|
# shared_buffers 1GB below needs headroom - matches home's requests/limits.
|
|
resources:
|
|
requests:
|
|
memory: "1Gi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "4Gi"
|
|
cpu: "500m"
|
|
|
|
storage:
|
|
size: 50Gi # matches home's size
|
|
storageClass: local-path
|
|
|
|
primaryUpdateStrategy: unsupervised
|
|
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "400"
|
|
shared_buffers: "1GB"
|
|
effective_cache_size: "3GB"
|
|
maintenance_work_mem: "256MB"
|
|
checkpoint_completion_target: "0.9"
|
|
wal_buffers: "16MB"
|
|
default_statistics_target: "100"
|
|
random_page_cost: "1.1"
|
|
effective_io_concurrency: "200"
|
|
work_mem: "16MB"
|
|
min_wal_size: "1GB"
|
|
max_wal_size: "4GB"
|
|
max_worker_processes: "4"
|
|
max_parallel_workers_per_gather: "2"
|
|
max_parallel_workers: "4"
|
|
|
|
bootstrap:
|
|
recovery:
|
|
source: home
|
|
|
|
# Stage 2 (see /home/scooby/.claude/plans/jiggly-snacking-iverson.md):
|
|
# connectionParameters added alongside the existing barmanObjectStore
|
|
# on the SAME "home" entry - the recovery-mode initial seed stays
|
|
# exactly as-is, ongoing replication now streams instead of relying on
|
|
# WAL-archive polling (the source of the crash-looping/probe-tuning
|
|
# fights documented for the pg-authentik precedent). Also needs a
|
|
# self-referencing "vps" entry - replica.self must match an
|
|
# externalClusters name too, even though it's this very cluster
|
|
# (confirmed live: "External cluster vps not found" until one was
|
|
# added).
|
|
#
|
|
# Reachable via home.kube.huskypup.net:61442 - a UniFi WAN port-forward
|
|
# to talos-cp-01's real LAN IP, source-IP-restricted to the VPS/witness
|
|
# public IPs (see apps/gitlab/manifests/ha-postgres-nodeport.yaml). NOT
|
|
# the Netbird mesh directly - UniFi has no route to that CIDR
|
|
# (confirmed live for the pg-authentik precedent).
|
|
externalClusters:
|
|
- name: home
|
|
barmanObjectStore:
|
|
# serverName defaults to the externalClusters[].name, NOT the
|
|
# source Postgres cluster's actual metadata.name - home's own
|
|
# backup: block defaults serverName to "pg-gitlab" (its own
|
|
# name). Without this override, recovery looks under the wrong
|
|
# server-name prefix and finds nothing (confirmed live for the
|
|
# pg-authentik precedent).
|
|
serverName: pg-gitlab
|
|
destinationPath: s3://cnpg-backups/pg-gitlab
|
|
endpointURL: http://vps-minio.minio.svc.cluster.local:9000
|
|
s3Credentials:
|
|
accessKeyId:
|
|
name: vps-minio-secret
|
|
key: accesskey
|
|
secretAccessKey:
|
|
name: vps-minio-secret
|
|
key: secretkey
|
|
connectionParameters:
|
|
host: home.kube.huskypup.net
|
|
port: "61442"
|
|
dbname: gitlabhq_production
|
|
user: streaming_replica
|
|
sslmode: verify-ca
|
|
sslCert:
|
|
name: pg-gitlab-home-replication
|
|
key: tls.crt
|
|
sslKey:
|
|
name: pg-gitlab-home-replication
|
|
key: tls.key
|
|
sslRootCert:
|
|
name: pg-gitlab-home-ca
|
|
key: ca.crt
|
|
- name: vps
|
|
connectionParameters:
|
|
host: pg-gitlab-rw
|
|
port: "5432"
|
|
dbname: gitlabhq_production
|
|
user: streaming_replica
|
|
sslmode: verify-ca
|
|
sslCert:
|
|
name: pg-gitlab-replication
|
|
key: tls.crt
|
|
sslKey:
|
|
name: pg-gitlab-replication
|
|
key: tls.key
|
|
sslRootCert:
|
|
name: pg-gitlab-ca
|
|
key: ca.crt
|
|
|
|
# Distributed topology: both sides agree home is primary today. No
|
|
# replica.enabled - mutually exclusive with primary/self (confirmed
|
|
# live for the pg-authentik precedent).
|
|
replica:
|
|
self: vps
|
|
primary: home
|
|
source: home
|
|
|
|
monitoring:
|
|
enablePodMonitor: false # no Prometheus on the VPS cluster
|