mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
b77f0865d0
Adds connectionParameters (real streaming, not just barmanObjectStore WAL-archive polling) to both sides' existing externalClusters entry, plus replica.self/primary fields declaring the distributed topology (both currently agree home is primary). Auth reuses CNPG's own auto-generated streaming_replica client certs, cross-copied between clusters manually (kubectl, not git - same pattern as every other cross-cluster secret tonight) since they're the exact credential each side's pg_hba.conf already trusts. Also adds the VPS-side NodePort exposing its own pg-authentik primary back to home (home->VPS already works via the existing netbird-egress route, no UniFi port-forward needed for that direction - only the reverse, VPS/witness reaching into home, needed the WAN workaround).
129 lines
4.2 KiB
YAML
129 lines
4.2 KiB
YAML
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: pg-authentik
|
|
namespace: authentik
|
|
spec:
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16
|
|
instances: 2
|
|
|
|
# Resource limits to prevent OOM
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "25m"
|
|
limits:
|
|
memory: "2Gi"
|
|
cpu: "250m"
|
|
|
|
# Spread replicas across different nodes
|
|
affinity:
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
storage:
|
|
size: 5Gi
|
|
storageClass: rook-ceph-block
|
|
|
|
primaryUpdateStrategy: unsupervised
|
|
|
|
# PostgreSQL configuration for better performance
|
|
postgresql:
|
|
parameters:
|
|
max_connections: "200"
|
|
shared_buffers: "512MB"
|
|
effective_cache_size: "1536MB"
|
|
maintenance_work_mem: "128MB"
|
|
checkpoint_completion_target: "0.9"
|
|
wal_buffers: "16MB"
|
|
default_statistics_target: "100"
|
|
random_page_cost: "1.1"
|
|
effective_io_concurrency: "200"
|
|
work_mem: "2621kB"
|
|
min_wal_size: "1GB"
|
|
max_wal_size: "4GB"
|
|
|
|
bootstrap:
|
|
initdb:
|
|
database: app
|
|
owner: app
|
|
|
|
# Backup to VPS MinIO - RE-ENABLED 2026-08-18. Real pod-egress routing to
|
|
# the VPS now exists (netbird-egress DaemonSet, hostNetwork + per-node
|
|
# route into 100.108.0.0/16 - see infrastructure/netbird/manifests/
|
|
# egress-daemonset.yaml). Endpoint changed from the NodePort
|
|
# (vps-minio.netbird.internal:30900 - never resolvable anyway, Netbird has
|
|
# no DNS configured, and separately blocked by Netbird's own ACL model,
|
|
# which only permits *established* forwarded connections through a peer,
|
|
# never new ones) to a locally-terminated socat forward on the VPS host
|
|
# itself (100.108.113.41:9000 - see minio-forward.service on the VPS),
|
|
# mirroring the pattern that already worked for the CrowdSec CAPI proxy.
|
|
backup:
|
|
barmanObjectStore:
|
|
destinationPath: s3://cnpg-backups/pg-authentik
|
|
endpointURL: http://100.108.113.41:9000
|
|
s3Credentials:
|
|
accessKeyId:
|
|
name: vps-minio-secret
|
|
key: accesskey
|
|
secretAccessKey:
|
|
name: vps-minio-secret
|
|
key: secretkey
|
|
wal:
|
|
compression: gzip
|
|
maxParallel: 2
|
|
retentionPolicy: "30d"
|
|
|
|
monitoring:
|
|
enablePodMonitor: true
|
|
|
|
# Multi-site active failover pilot (see
|
|
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - streaming
|
|
# replication to/from the VPS's pg-authentik cluster, alongside (not
|
|
# replacing) the barmanObjectStore backup above.
|
|
#
|
|
# Auth: reuses CNPG's own generated streaming_replica client cert
|
|
# (CN=streaming_replica, issued by the VPS's own pg-authentik CA) -
|
|
# copied here manually as pg-authentik-vps-{ca,replication} (kubectl,
|
|
# not git - same pattern as every other cross-cluster secret tonight).
|
|
# This is the exact credential CNPG's own pg_hba.conf already trusts
|
|
# for streaming replication, nothing new to provision.
|
|
#
|
|
# sslmode: verify-ca (not verify-full) - the VPS's server cert was
|
|
# issued for its in-cluster DNS names, not for the NodePort IP address
|
|
# (100.108.113.41) home actually dials; verify-ca still validates the
|
|
# cert chain/CA trust and encrypts the connection, just skips hostname
|
|
# matching.
|
|
#
|
|
# Reachable via 100.108.113.41 (VPS's Netbird IP) - home reaching OUT
|
|
# to the VPS already works today via the netbird-egress DaemonSet's
|
|
# route (same path used for MinIO/CrowdSec backups all session) - no
|
|
# UniFi port-forward needed for this direction, only the reverse
|
|
# (VPS/witness reaching INTO home) needed that.
|
|
externalClusters:
|
|
- name: vps
|
|
connectionParameters:
|
|
host: 100.108.113.41
|
|
port: "32433"
|
|
dbname: app
|
|
user: streaming_replica
|
|
sslmode: verify-ca
|
|
sslCert:
|
|
name: pg-authentik-vps-replication
|
|
key: tls.crt
|
|
sslKey:
|
|
name: pg-authentik-vps-replication
|
|
key: tls.key
|
|
sslRootCert:
|
|
name: pg-authentik-vps-ca
|
|
key: ca.crt
|
|
|
|
# Distributed topology: both sides agree home is primary today. Failover
|
|
# flips the VPS's replica.primary to "vps" (+ promotion token) - see the
|
|
# plan doc's failover-watcher section. Failback is the same in reverse,
|
|
# deliberately manual.
|
|
replica:
|
|
self: home
|
|
primary: home
|
|
source: vps # where home would replicate FROM if it were ever a replica (not active now - primary: home)
|
|
|