---
# Postgres for the k8s Gitea (replaces the Patroni-shared DB the VM uses). Gitea
# already runs on Postgres, so cutover is a plain pg dump/restore (no engine
# conversion). App-user creds come from the postgres-credentials Vault secret.
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: gitea-postgres
  namespace: gitea
spec:
  affinity:
    podAntiAffinityType: preferred
  backup:
    # 30-day retention. Enforced by CNPG against the object store on each
    # successful base backup.
    retentionPolicy: 30d
    barmanObjectStore:
      # Dedicated per-cluster Ceph RGW bucket (cephrgw-operator provisions it).
      destinationPath: s3://cnpg-gitea
      endpointURL: https://s3.ceph.unkin.net
      # radosgw serves a Vault-PKI cert; trust the internal CA (reflected into
      # every namespace as the vault-ca-cert Secret).
      endpointCA:
        name: vault-ca-cert
        key: ca.crt
      # Keys minted by the ObjectStoreUser in cnpg_backup.yaml; never hardcoded.
      s3Credentials:
        accessKeyId:
          name: cnpg-gitea-backup-s3
          key: AWS_ACCESS_KEY_ID
        secretAccessKey:
          name: cnpg-gitea-backup-s3
          key: AWS_SECRET_ACCESS_KEY
      # Path prefix within the bucket; keep stable across restores (see docs).
      serverName: gitea
      data:
        compression: bzip2
        jobs: 2
      wal:
        compression: zstd
        maxParallel: 2
  bootstrap:
    initdb:
      database: gitea
      encoding: UTF8
      localeCType: C
      localeCollate: C
      owner: gitea
      secret:
        name: postgres-credentials
  enablePDB: true
  enableSuperuserAccess: false
  failoverDelay: 0
  imageName: ghcr.io/cloudnative-pg/postgresql:18.1-system-trixie
  instances: 2
  logLevel: info
  monitoring:
    customQueriesConfigMap:
      - key: queries
        name: cnpg-default-monitoring
    disableDefaultQueries: false
    enablePodMonitor: false
  postgresql:
    parameters:
      max_connections: "200"
      shared_buffers: 256MB
  primaryUpdateMethod: restart
  primaryUpdateStrategy: unsupervised
  replicationSlots:
    highAvailability:
      enabled: true
      slotPrefix: _cnpg_
    synchronizeReplicas:
      enabled: true
    updateInterval: 30
  resources:
    limits:
      cpu: "2"
      memory: 2Gi
    requests:
      cpu: 250m
      memory: 512Mi
  smartShutdownTimeout: 180
  startDelay: 3600
  stopDelay: 1800
  storage:
    resizeInUseVolumes: true
    size: 20Gi
    storageClass: cephrbd-fast-delete
  switchoverDelay: 3600