mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby Husky
1a657ad0a4
CNPG operator on the VPS (argocd-apps/vps-standby/cnpg-operator.yaml), plus a CNPG 'replica cluster' for pg-authentik (infrastructure/ vps-standby/authentik/manifests/cnpg-cluster.yaml) that continuously replays WAL shipped from home's pg-authentik via VPS MinIO's cnpg-backups/pg-authentik bucket path - CNPG's native replica-cluster mode, not a custom restore script like Vault needed (Vault has no equivalent built-in continuous-replication-into-object-store feature). The Authentik app itself runs at replicas: 0 in normal operation - the replica DB is read-only until a deliberate manual promotion (spec.replica.enabled: false), and a pod trying to write against a read-only DB would just crashloop uselessly. values.yaml's authentik: block is copied byte-identical from home's on purpose: the chart deterministically derives its generated Secret's AUTHENTIK_SECRET_KEY from these literal values.yaml strings, so both clusters land on the same key without manually copying it - required since that key decrypts things stored encrypted in the replicated DB.
28 lines
775 B
YAML
28 lines
775 B
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: vps-cnpg
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "1" # before minio/vault/gitea (wave 2) and the CNPG-backed standby apps (wave 3)
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
project: vps-standby
|
|
source:
|
|
repoURL: https://cloudnative-pg.github.io/charts
|
|
chart: cloudnative-pg
|
|
targetRevision: "*" # matches home's argocd-apps/infrastructure/cnpg.yaml (also unpinned)
|
|
destination:
|
|
name: vps-standby
|
|
namespace: cnpg-system
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
- ServerSideApply=true
|
|
- ServerSideDiff=true
|
|
- RespectIgnoreDifferences=true
|