mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
1a657ad0a4
CNPG operator on the VPS (argocd-apps/vps-standby/cnpg-operator.yaml), plus a CNPG 'replica cluster' for pg-authentik (infrastructure/ vps-standby/authentik/manifests/cnpg-cluster.yaml) that continuously replays WAL shipped from home's pg-authentik via VPS MinIO's cnpg-backups/pg-authentik bucket path - CNPG's native replica-cluster mode, not a custom restore script like Vault needed (Vault has no equivalent built-in continuous-replication-into-object-store feature). The Authentik app itself runs at replicas: 0 in normal operation - the replica DB is read-only until a deliberate manual promotion (spec.replica.enabled: false), and a pod trying to write against a read-only DB would just crashloop uselessly. values.yaml's authentik: block is copied byte-identical from home's on purpose: the chart deterministically derives its generated Secret's AUTHENTIK_SECRET_KEY from these literal values.yaml strings, so both clusters land on the same key without manually copying it - required since that key decrypts things stored encrypted in the replicated DB.
102 lines
2.9 KiB
YAML
102 lines
2.9 KiB
YAML
# Authentik warm standby on the VPS - Phase 2. The CNPG replica cluster
|
|
# (manifests/cnpg-cluster.yaml) continuously replays WAL from home in the
|
|
# background; the app itself is NOT run in normal operation (replicas: 0)
|
|
# since the replica DB is read-only until a deliberate manual promotion -
|
|
# an Authentik pod trying to write against a read-only DB would just
|
|
# crashloop uselessly. Promotion runbook: flip the CNPG cluster's
|
|
# spec.replica.enabled to false (see cnpg-cluster.yaml), then scale
|
|
# server/worker up from 0.
|
|
#
|
|
# The `authentik:` block below (secret_key/postgresql "env://" indirection)
|
|
# is copied VERBATIM from infrastructure/authentik/values.yaml on purpose -
|
|
# the authentik chart deterministically renders its own generated Secret
|
|
# from these literal values.yaml strings (not randomly), so keeping this
|
|
# block byte-identical between home and VPS means both clusters
|
|
# independently arrive at the same AUTHENTIK_SECRET_KEY without needing to
|
|
# manually copy it - required for promotion to work, since that key
|
|
# decrypts things (stored provider secrets, cert private keys) that live
|
|
# encrypted in the DB being replicated.
|
|
authentik:
|
|
secret_key: env://AUTHENTIK_SECRET_KEY
|
|
postgresql:
|
|
host: env://AUTHENTIK_POSTGRESQL__HOST
|
|
port: 5432
|
|
name: env://AUTHENTIK_POSTGRESQL__NAME
|
|
user: env://AUTHENTIK_POSTGRESQL__USER
|
|
password: env://AUTHENTIK_POSTGRESQL__PASSWORD
|
|
|
|
global:
|
|
envFrom:
|
|
- secretRef:
|
|
name: authentik
|
|
- secretRef:
|
|
name: pg-authentik-app
|
|
prefix: AUTHENTIK_POSTGRESQL__
|
|
env:
|
|
- name: AUTHENTIK_URL
|
|
value: "https://auth.kube.huskypup.net"
|
|
- name: AUTHENTIK_POSTGRESQL__HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: host
|
|
- name: AUTHENTIK_POSTGRESQL__NAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: dbname
|
|
- name: AUTHENTIK_POSTGRESQL__USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: username
|
|
- name: AUTHENTIK_POSTGRESQL__PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: pg-authentik-app
|
|
key: password
|
|
- name: AUTHENTIK_POSTGRESQL__PORT
|
|
value: "5432"
|
|
|
|
server:
|
|
replicas: 0
|
|
containerSecurityContext:
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
metrics:
|
|
enabled: false
|
|
|
|
worker:
|
|
replicas: 0
|
|
containerSecurityContext:
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 512Mi
|
|
limits:
|
|
memory: 1Gi
|
|
metrics:
|
|
enabled: false
|
|
|
|
# Disable bundled Postgres - using the CNPG replica cluster instead
|
|
postgresql:
|
|
enabled: false
|