---
# Shared CNPG Cluster for S5 application databases (RAILIANCE-WP-0003).
# Owned by railiance-platform (S3). Operator lives in cnpg-system.
#
# Apply: kubectl apply -f helm/apps-pg-cluster.yaml
# Status: kubectl cnpg status apps-pg -n databases   (requires cnpg kubectl plugin)
#         or: kubectl get cluster apps-pg -n databases -o wide
#
# Pre-condition: apps-pg-credentials Secret must exist in databases ns.
#   See helm/apps-pg-secret.sops.yaml.template for the bootstrap recipe.
#
# Consumer onboarding: see docs/apps-pg.md. The bootstrap role apps_admin
# and meta DB apps_meta exist only to anchor the cluster; per-app roles
# and databases are added through the documented onboarding contract.
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: apps-pg
  namespace: databases
  labels:
    app.kubernetes.io/name: apps-pg
    app.kubernetes.io/component: database
    app.kubernetes.io/managed-by: manual
    railiance.io/layer: s3-platform
    railiance.io/role: shared-apps-database
spec:
  instances: 1   # bump to 3 when node RAM > 8GB
  imageName: ghcr.io/cloudnative-pg/postgresql:16
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      cpu: "1"
      memory: 1Gi
  storage:
    size: 10Gi
  bootstrap:
    initdb:
      database: apps_meta
      owner: apps_admin
      secret:
        name: apps-pg-credentials
  # Per-app PostgreSQL roles are added here (CNPG 1.28 role lifecycle is
  # cluster-scoped — no standalone Role CR). The credential Secret for
  # each role lives in the databases namespace and is mirrored into the
  # consumer namespace by the consuming repo. See docs/apps-pg.md.
  managed:
    roles:
      - name: vergabe                    # RAILIANCE-WP-0002 T04 (vergabe-teilnahme)
        ensure: present
        login: true
        connectionLimit: 20
        passwordSecret:
          name: vergabe-app-credentials
      - name: coulomb_social             # CSOC-WP-0002 (coulomb-social)
        ensure: present
        login: true
        connectionLimit: 20
        passwordSecret:
          name: coulomb-social-app-credentials
  postgresql:
    parameters:
      max_connections: "100"
      log_connections: "on"
      log_disconnections: "on"
      log_lock_waits: "on"
      log_min_duration_statement: "1000"
      track_io_timing: "on"
  backup:
    retentionPolicy: "30d"
    barmanObjectStore:
      # The bucket policy grants this runtime identity only platform-pg/*.
      # Keep apps-pg distinct beneath that governed top-level prefix.
      destinationPath: s3://railiance-platform-pg-backup/platform-pg/apps-pg/
      endpointURL: https://s3.nl-ams.scw.cloud
      s3Credentials:
        accessKeyId:
          name: platform-pg-backup-s3
          key: ACCESS_KEY_ID
        secretAccessKey:
          name: platform-pg-backup-s3
          key: ACCESS_SECRET_KEY
      wal:
        compression: gzip
        maxParallel: 2
      data:
        compression: gzip
        jobs: 2
  # HA replica + connection pooler are deferred (RAILIANCE-WP-0003 Notes):
  #   services:
  #     additional:
  #       - selectorType: rw
  #         serviceTemplate:
  #           metadata:
  #             name: apps-pg-pooler-rw