---
# Shared PostgreSQL backend for the -unkin2 fork sonarr/radarr/prowlarr, whose
# Npgsql/EF Core provider moves each *arr off SQLite into Postgres and makes the
# shared-nothing, active-active multi-replica deployment possible. One cluster,
# one throwaway initdb owner ("app"), and three managed login roles — one per
# app — each with its own per-app database (see database-*.yaml). Role passwords
# come from the VSO-synced <app>-db Secrets (vaultstaticsecret.yaml), so no
# credential is rendered into git.
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: arrstack-postgres
  namespace: arrstack
spec:
  inheritedMetadata:
    annotations:
      k8up.io/backup: "false"
  affinity:
    podAntiAffinityType: preferred
  backup:
    retentionPolicy: 30d
    barmanObjectStore:
      destinationPath: s3://cnpg-arrstack
      endpointURL: https://s3.ceph.unkin.net
      endpointCA:
        name: vault-ca-cert
        key: ca.crt
      s3Credentials:
        accessKeyId:
          name: cnpg-arrstack-backup-s3
          key: AWS_ACCESS_KEY_ID
        secretAccessKey:
          name: cnpg-arrstack-backup-s3
          key: AWS_SECRET_ACCESS_KEY
      serverName: arrstack
      data:
        compression: bzip2
        jobs: 2
      wal:
        compression: zstd
        maxParallel: 2
  bootstrap:
    initdb:
      # Throwaway owner + database: the real per-app databases are provisioned by
      # the CNPG Database CRDs, owned by the managed roles below.
      database: app
      encoding: UTF8
      localeCType: C
      localeCollate: C
      owner: app
  managed:
    roles:
      - name: sonarr
        ensure: present
        comment: Sonarr application role (owns sonarr-main)
        login: true
        superuser: false
        createdb: false
        createrole: false
        inherit: true
        replication: false
        connectionLimit: -1
        passwordSecret:
          name: sonarr-db
      - name: radarr
        ensure: present
        comment: Radarr application role (owns radarr-main)
        login: true
        superuser: false
        createdb: false
        createrole: false
        inherit: true
        replication: false
        connectionLimit: -1
        passwordSecret:
          name: radarr-db
      - name: prowlarr
        ensure: present
        comment: Prowlarr application role (owns prowlarr-main)
        login: true
        superuser: false
        createdb: false
        createrole: false
        inherit: true
        replication: false
        connectionLimit: -1
        passwordSecret:
          name: prowlarr-db
  enablePDB: true
  enableSuperuserAccess: false
  failoverDelay: 0
  imageName: ghcr.io/cloudnative-pg/postgresql:17-system-trixie
  instances: 3
  logLevel: info
  maxSyncReplicas: 0
  minSyncReplicas: 0
  monitoring:
    customQueriesConfigMap:
      - key: queries
        name: cnpg-default-monitoring
    disableDefaultQueries: false
    enablePodMonitor: false
  postgresql:
    parameters:
      archive_mode: "on"
      archive_timeout: 5min
      dynamic_shared_memory_type: posix
      effective_cache_size: 256MB
      full_page_writes: "on"
      log_destination: csvlog
      log_directory: /controller/log
      log_filename: postgres
      log_rotation_age: "0"
      log_rotation_size: "0"
      log_truncate_on_rotation: "false"
      logging_collector: "on"
      max_connections: "200"
      max_parallel_workers: "16"
      max_replication_slots: "16"
      max_worker_processes: "16"
      shared_buffers: 128MB
      shared_memory_type: mmap
      ssl_max_protocol_version: TLSv1.3
      ssl_min_protocol_version: TLSv1.3
      wal_keep_size: 256MB
      wal_level: logical
      wal_log_hints: "on"
      wal_receiver_timeout: 5s
      wal_sender_timeout: 5s
    syncReplicaElectionConstraint:
      enabled: false
  primaryUpdateMethod: restart
  primaryUpdateStrategy: unsupervised
  probes:
    liveness:
      isolationCheck:
        connectionTimeout: 1000
        enabled: true
        requestTimeout: 1000
  replicationSlots:
    highAvailability:
      enabled: true
      slotPrefix: _cnpg_
    synchronizeReplicas:
      enabled: true
    updateInterval: 30
  resources:
    limits:
      cpu: "1"
      memory: 2Gi
    requests:
      cpu: 250m
      memory: 1Gi
  smartShutdownTimeout: 180
  startDelay: 3600
  stopDelay: 1800
  storage:
    resizeInUseVolumes: true
    size: 10Gi
    storageClass: cephrbd-fast-delete
  switchoverDelay: 3600