# Operator-ready CNPG backup wiring template for railiance01 production DB clusters.
# Do not apply until platform supplies object-store credentials and destinationPath.
# Secrets referenced below are placeholders — create them via OpenBao/operator paths.
#
# Clusters covered: apps-pg, forgejo-db, net-kingdom-pg, state-hub-db
# Check posture: make cnpg-backup-status
#
# Apply sequence (after credentials exist):
#   1. Create Secret cnpg-backup-s3 in namespace databases
#   2. Uncomment and patch ObjectStore + cluster backup patches per cluster
#   3. Apply ScheduledBackup resources
#   4. Run restore drill in isolated namespace; record non-secret evidence
---
# apiVersion: barmancloud.cnpg.io/v1
# kind: ObjectStore
# metadata:
#   name: railiance-cnpg-backups
#   namespace: databases
#   labels:
#     app.kubernetes.io/part-of: railiance-apps
# spec:
#   configuration:
#     destinationPath: s3://REPLACE_ME/railiance-cnpg/
#     endpointURL: https://REPLACE_ME
#     s3Credentials:
#       accessKeyId:
#         name: cnpg-backup-s3
#         key: ACCESS_KEY_ID
#       secretAccessKey:
#         name: cnpg-backup-s3
#         key: SECRET_ACCESS_KEY
#     wal:
#       compression: gzip
#     data:
#       compression: gzip
#       immediateCheckpoint: true
#   retentionPolicy: 14d
---
# Example ScheduledBackup for apps-pg (repeat per cluster with spec.cluster.name)
# apiVersion: postgresql.cnpg.io/v1
# kind: ScheduledBackup
# metadata:
#   name: apps-pg-daily
#   namespace: databases
#   labels:
#     app.kubernetes.io/part-of: railiance-apps
# spec:
#   schedule: "0 0 2 * * *"
#   backupOwnerReference: self
#   cluster:
#     name: apps-pg
#   immediate: true