tegwick
0055e8f3f7
Add workload KV lane for Nextcloud WebDAV token, URL, and age recovery escrow at platform/workloads/railiance/backup/offsite-lane. Apply read policy and OIDC role railiance-backup-workload-kv-read; wire forgejo-backup to load credentials from OpenBao when env is unset.
32 lines
No EOL
962 B
YAML
32 lines
No EOL
962 B
YAML
---
|
|
# CNPG cluster for Forgejo (railiance01 production forge).
|
|
# Managed by railiance-platform (S3). Operator: cnpg-system.
|
|
#
|
|
# Apply: KUBECONFIG=~/.kube/config-hosteurope make forgejo-db-deploy
|
|
# Status: make forgejo-db-status
|
|
# Backup: make forgejo-backup (pg_dump + forgejo dump → Nextcloud; docs/forgejo-backup.md)
|
|
#
|
|
# Pre-condition: forgejo-db-credentials Secret in databases namespace.
|
|
# See helm/forgejo-db-secret.sops.yaml.template
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: forgejo-db
|
|
namespace: databases
|
|
labels:
|
|
app.kubernetes.io/name: forgejo-db
|
|
app.kubernetes.io/component: database
|
|
app.kubernetes.io/managed-by: manual
|
|
railiance.io/layer: s3-platform
|
|
railiance.io/consumer: forgejo
|
|
spec:
|
|
instances: 1
|
|
imageName: ghcr.io/cloudnative-pg/postgresql:16
|
|
storage:
|
|
size: 10Gi
|
|
bootstrap:
|
|
initdb:
|
|
database: forgejo
|
|
owner: forgejo
|
|
secret:
|
|
name: forgejo-db-credentials |