argocd-apps

unkin/argocd-apps

Fork 0

Commit Graph

Author	SHA1	Message	Date
unkinben	0edbf0767f	Add S3 backups to all CNPG Postgres clusters ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details None of the CNPG clusters had any backup configured, so a lost PVC or a bad migration meant permanent data loss. This adds continuous WAL archiving plus a nightly base backup to Ceph RGW for every cluster, with restore docs. - Add spec.backup.barmanObjectStore (in-tree; operator is CNPG 1.28, Barman Cloud Plugin not deployed) to each cnpg_cluster.yaml: WAL zstd, base bzip2, 30-day retention, endpointCA via the reflected vault-ca-cert. - Add cnpg_backup.yaml per app: a cephrgw ObjectStoreUser + Bucket (one dedicated s3://cnpg-<app> bucket and owner user per cluster, since cephrgw CRs and the CNPG credential Secret are namespace-scoped) and a staggered nightly ScheduledBackup. Credentials are minted by the operator; nothing is hardcoded. - Add the three ceph.unkin.net CRD schemas so kubeconform can validate the CRs. - Add docs/ (README index, cnpg-backups.md, cnpg-restore.md) covering config and full/PITR restore procedures. Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv	2026-07-27 22:12:05 +10:00
unkinben	e0e0873ccb	cnpg: reduce cluster CPU requests to 50m (#247 ) Reduce CloudNativePG cluster CPU requests to `50m` across the platform to cut reserved-but-unused CPU. Updated (memory and limits unchanged): - artifactapi, authentik, encapi, paperclip (250m → 50m) - grafana (100m → 50m) - litellm (250m → 50m) Excluded: woodpecker (already 50m), puppet (handled separately). Reviewed-on: #247 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-12 18:39:13 +10:00
unkinben	7f1444fb38	Add Authentik identity provider deployment (#211 ) ## Summary - Deploy Authentik (identity.unkin.net) via Helm chart 2026.5.3 - CNPG PostgreSQL cluster (3 instances) with separate rw/ro poolers (2 instances each) - Redis with 5Gi persistent storage - Gateway API for HTTPS (identity.unkin.net) and LDAPS (ldap.k8s.syd1.au.unkin.net, ldap.main.unkin.net) - TLSRoute for LDAPS passthrough, HTTPRoute for external-dns record creation - Vault secrets for postgres credentials, authentik secret key, and S3 storage credentials - S3 storage via RadosGW (bucket: authentik) - 3 server replicas, 2 worker replicas - Woodpecker ServiceAccount for terraform-authentik CI - Platform applicationset and project updated ## Dependencies - terraform-git #15 (merged) — repo definition - terraform-vault #78 (merged) — auth roles and Consul ACL ## Vault secrets needed before deploy Write to `kv/kubernetes/namespace/authentik/default/`: - `postgres-credentials`: username + password - `authentik-credentials`: AUTHENTIK_SECRET_KEY - `s3-credentials`: S3 access key + secret key Reviewed-on: #211 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 17:42:49 +10:00

Author

SHA1

Message

Date

unkinben

0edbf0767f

Add S3 backups to all CNPG Postgres clusters

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

None of the CNPG clusters had any backup configured, so a lost PVC or a bad
migration meant permanent data loss. This adds continuous WAL archiving plus a
nightly base backup to Ceph RGW for every cluster, with restore docs.

- Add spec.backup.barmanObjectStore (in-tree; operator is CNPG 1.28, Barman
  Cloud Plugin not deployed) to each cnpg_cluster.yaml: WAL zstd, base bzip2,
  30-day retention, endpointCA via the reflected vault-ca-cert.
- Add cnpg_backup.yaml per app: a cephrgw ObjectStoreUser + Bucket (one
  dedicated s3://cnpg-<app> bucket and owner user per cluster, since cephrgw CRs
  and the CNPG credential Secret are namespace-scoped) and a staggered nightly
  ScheduledBackup. Credentials are minted by the operator; nothing is hardcoded.
- Add the three ceph.unkin.net CRD schemas so kubeconform can validate the CRs.
- Add docs/ (README index, cnpg-backups.md, cnpg-restore.md) covering config and
  full/PITR restore procedures.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

2026-07-27 22:12:05 +10:00

unkinben

e0e0873ccb

cnpg: reduce cluster CPU requests to 50m (#247 )

Reduce CloudNativePG cluster CPU requests to `50m` across the platform to cut reserved-but-unused CPU.

Updated (memory and limits unchanged):
- artifactapi, authentik, encapi, paperclip (250m → 50m)
- grafana (100m → 50m)
- litellm (250m → 50m)

Excluded: woodpecker (already 50m), puppet (handled separately).
Reviewed-on: #247
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

2026-07-12 18:39:13 +10:00

unkinben

7f1444fb38

Add Authentik identity provider deployment (#211 )

## Summary
- Deploy Authentik (identity.unkin.net) via Helm chart 2026.5.3
- CNPG PostgreSQL cluster (3 instances) with separate rw/ro poolers (2 instances each)
- Redis with 5Gi persistent storage
- Gateway API for HTTPS (identity.unkin.net) and LDAPS (ldap.k8s.syd1.au.unkin.net, ldap.main.unkin.net)
- TLSRoute for LDAPS passthrough, HTTPRoute for external-dns record creation
- Vault secrets for postgres credentials, authentik secret key, and S3 storage credentials
- S3 storage via RadosGW (bucket: authentik)
- 3 server replicas, 2 worker replicas
- Woodpecker ServiceAccount for terraform-authentik CI
- Platform applicationset and project updated

## Dependencies
- terraform-git #15 (merged) — repo definition
- terraform-vault #78 (merged) — auth roles and Consul ACL

## Vault secrets needed before deploy
Write to `kv/kubernetes/namespace/authentik/default/`:
- `postgres-credentials`: username + password
- `authentik-credentials`: AUTHENTIK_SECRET_KEY
- `s3-credentials`: S3 access key + secret key

Reviewed-on: #211
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

2026-06-28 17:42:49 +10:00

3 Commits