arrstack: run sonarr/radarr/prowlarr active-active on shared Postgres (#arrstack)

Convert the three *arr apps from single-replica upstream LinuxServer/SQLite to
our -unkin2 forks running active-active (replicas 3) on a shared CNPG Postgres
cluster.

- new apps/base/arrstack/postgres/: CNPG Cluster arrstack-postgres (3 instances,
  3 managed login roles sonarr/radarr/prowlarr, throwaway initdb owner), per-app
  Database CRDs (<app>-main), cephrgw backup bucket + nightly ScheduledBackup,
  and 3 VaultStaticSecrets syncing the <app>-db role credentials.
- per app: image -> docker-internal/<app>:v<base>-unkin2; replicas 3 +
  RollingUpdate; drop the apikey-init initContainer + PUID/PGID/TZ; run the
  binary directly with -nosingleinstancecheck; env from a new ConfigMap plus
  Postgres user/password and the API key from Secrets; /config PVC -> RWX
  cephfs-raid5-retain (shared).

apps/base/arrstack/postgres/cnpg_backup.yaml

@@ -0,0 +1,45 @@
+---
+# Ceph RGW (S3) backup target for the shared arrstack CNPG cluster, provisioned
+# by the in-estate cephrgw-operator: one dedicated bucket + owner user. CNPG
+# reads the S3 credential Secret (cnpg-arrstack-backup-s3) from this namespace.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: ObjectStoreUser
+metadata:
+  name: cnpg-arrstack-backup
+  namespace: arrstack
+spec:
+  displayName: "CNPG backup owner (arrstack)"
+  uid: cnpg-arrstack-backup
+  maxBuckets: 5
+  secretName: cnpg-arrstack-backup-s3
+  retainOnDelete: true
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-arrstack
+  namespace: arrstack
+spec:
+  placementTarget: ec
+  bucketName: cnpg-arrstack
+  ownerRef: cnpg-arrstack-backup
+  versioning: false
+  tags:
+    app: arrstack
+    purpose: cnpg-backup
+  retainOnDelete: true
+---
+# Nightly base backup on top of always-on WAL archiving. Staggered from the
+# other CNPG clusters (6-field cron, seconds first).
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: cnpg-arrstack-nightly
+  namespace: arrstack
+spec:
+  schedule: "0 45 3 * * *"
+  immediate: false
+  backupOwnerReference: self
+  method: barmanObjectStore
+  cluster:
+    name: arrstack-postgres

apps/base/arrstack/postgres/cnpg_cluster.yaml

@@ -0,0 +1,166 @@
+---
+# Shared PostgreSQL backend for the -unkin2 fork sonarr/radarr/prowlarr, whose
+# Npgsql/EF Core provider moves each *arr off SQLite into Postgres and makes the
+# shared-nothing, active-active multi-replica deployment possible. One cluster,
+# one throwaway initdb owner ("app"), and three managed login roles — one per
+# app — each with its own per-app database (see database-*.yaml). Role passwords
+# come from the VSO-synced <app>-db Secrets (vaultstaticsecret.yaml), so no
+# credential is rendered into git.
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: arrstack-postgres
+  namespace: arrstack
+  annotations:
+    # Wave 1: the per-app <app>-db Secrets (wave 0) must exist first — CNPG reads
+    # them as the managed roles' passwordSecret. ArgoCD gates dependents on the
+    # Cluster's health status.
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  inheritedMetadata:
+    annotations:
+      k8up.io/backup: "false"
+  affinity:
+    podAntiAffinityType: preferred
+  backup:
+    retentionPolicy: 30d
+    barmanObjectStore:
+      destinationPath: s3://cnpg-arrstack
+      endpointURL: https://s3.ceph.unkin.net
+      endpointCA:
+        name: vault-ca-cert
+        key: ca.crt
+      s3Credentials:
+        accessKeyId:
+          name: cnpg-arrstack-backup-s3
+          key: AWS_ACCESS_KEY_ID
+        secretAccessKey:
+          name: cnpg-arrstack-backup-s3
+          key: AWS_SECRET_ACCESS_KEY
+      serverName: arrstack
+      data:
+        compression: bzip2
+        jobs: 2
+      wal:
+        compression: zstd
+        maxParallel: 2
+  bootstrap:
+    initdb:
+      # Throwaway owner + database: the real per-app databases are provisioned by
+      # the CNPG Database CRDs, owned by the managed roles below.
+      database: app
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: app
+  managed:
+    roles:
+      - name: sonarr
+        ensure: present
+        comment: Sonarr application role (owns sonarr-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: sonarr-db
+      - name: radarr
+        ensure: present
+        comment: Radarr application role (owns radarr-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: radarr-db
+      - name: prowlarr
+        ensure: present
+        comment: Prowlarr application role (owns prowlarr-main)
+        login: true
+        superuser: false
+        createdb: false
+        createrole: false
+        inherit: true
+        replication: false
+        connectionLimit: -1
+        passwordSecret:
+          name: prowlarr-db
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:17-system-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: "1"
+      memory: 1Gi
+    requests:
+      cpu: 50m
+      memory: 512Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600

apps/base/arrstack/postgres/database-prowlarr.yaml

@@ -0,0 +1,17 @@
+---
+# Per-app database owned by the prowlarr managed role. The fork's provider runs
+# its own schema migrations on first start (advisory-locked, so only one replica
+# migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: prowlarr-main
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: prowlarr-main
+  owner: prowlarr
+  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-radarr.yaml

@@ -0,0 +1,17 @@
+---
+# Per-app database owned by the radarr managed role. The fork's provider runs its
+# own schema migrations on first start (advisory-locked, so only one replica
+# migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: radarr-main
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: radarr-main
+  owner: radarr
+  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/database-sonarr.yaml

@@ -0,0 +1,17 @@
+---
+# Per-app database owned by the sonarr managed role. The fork's provider runs its
+# own schema migrations on first start (advisory-locked, so only one replica
+# migrates). retain: the database survives a Database CRD delete.
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: sonarr-main
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  cluster:
+    name: arrstack-postgres
+  name: sonarr-main
+  owner: sonarr
+  databaseReclaimPolicy: retain

apps/base/arrstack/postgres/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - vaultstaticsecret.yaml
+  - cnpg_cluster.yaml
+  - cnpg_backup.yaml
+  - database-sonarr.yaml
+  - database-radarr.yaml
+  - database-prowlarr.yaml

apps/base/arrstack/postgres/vaultstaticsecret.yaml

@@ -0,0 +1,66 @@
+---
+# Per-app Postgres role credentials. Each is seeded out-of-band at
+# kv/kubernetes/namespace/arrstack/default/<app>-db (keys: username, password);
+# the default k8s role's templated policy already grants read on
+# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
+# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
+# syncs each into the <app>-db Secret, which is both the CNPG managed role's
+# passwordSecret (cnpg_cluster.yaml) and the source of the app Deployment's
+# <App>__Postgres__User/__Password env. Wave 0: must exist before the Cluster
+# (wave 1) reconciles the roles.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: sonarr-db
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: sonarr-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/sonarr-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: radarr-db
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: radarr-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/radarr-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: prowlarr-db
+  namespace: arrstack
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  destination:
+    create: true
+    name: prowlarr-db
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/arrstack/default/prowlarr-db
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default