homelab/k8s/bootstrap-local/03-ddb-bootstrap.yaml

# PostgreSQL cluster + Forgejo dependencies (bootstrap only, not GitOps-managed).
# These resources MUST exist before Forgejo can start, and Forgejo MUST exist
# before ArgoCD can sync from the git repo it hosts → circular dependency.
# Apply once via bootstrap.sh, never touched by ArgoCD afterward.
---
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: ddb-cluster
  namespace: ddb
  labels:
    app: postgresql
    layer: data
    bootstrap-phase: "0"
spec:
  instances: 3  # HA across 3 control-plane nodes
  imageName: ghcr.io/cloudnative-pg/postgresql:16.2

  bootstrap:
    initdb:
      database: app
      owner: app
      encoding: UTF8
      localeCollate: C
      localeCType: C
      postInitApplicationSQL:
        - CREATE EXTENSION IF NOT EXISTS vector;
        - CREATE EXTENSION IF NOT EXISTS pgcrypto;
        - CREATE EXTENSION IF NOT EXISTS pg_trgm;

  # Role management: passwords from secrets, databases from separate Database CRs
  managed:
    roles:
      - name: authentik
        ensure: present
        login: true
        passwordSecret:
          name: authentik-db-role
      - name: temporal
        ensure: present
        login: true
        passwordSecret:
          name: temporal-db-role

  enableSuperuserAccess: false

  postgresql:
    parameters:
      shared_buffers: "256MB"
      max_parallel_workers: "4"
      max_parallel_workers_per_gather: "4"
      archive_mode: "on"
      archive_timeout: "5min"
      log_destination: "csvlog"
      log_directory: "/controller/log"
      log_filename: "postgres"
      log_rotation_age: "0"
      dynamic_shared_memory_type: "posix"

  storage:
    size: 10Gi
    storageClass: longhorn

  monitoring:
    enablePodMonitor: false
    disableDefaultQueries: false
    customQueriesConfigMap:
      - name: cnpg-default-monitoring
        key: queries

  affinity:
    podAntiAffinityType: preferred
---
# Forgejo database (depends on ddb-cluster being ready)
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
  name: forgejo
  namespace: ddb
  labels:
    bootstrap-phase: "0"
spec:
  name: forgejo
  owner: app
  cluster:
    name: ddb-cluster
---
# Forgejo Redis (cache, session, queue)
apiVersion: v1
kind: Service
metadata:
  name: forgejo-redis
  namespace: cicd
  labels:
    app: forgejo-redis
    bootstrap-phase: "0"
spec:
  ports:
    - port: 6379
      targetPort: 6379
      protocol: TCP
      name: redis
  selector:
    app: forgejo-redis
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: forgejo-redis
  namespace: cicd
  labels:
    app: forgejo-redis
    bootstrap-phase: "0"
spec:
  replicas: 1
  selector:
    matchLabels:
      app: forgejo-redis
  template:
    metadata:
      labels:
        app: forgejo-redis
    spec:
      containers:
        - name: redis
          image: redis:7-alpine
          ports:
            - containerPort: 6379
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 256Mi
          livenessProbe:
            tcpSocket:
              port: 6379
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            exec:
              command:
                - redis-cli
                - ping
            initialDelaySeconds: 5
            periodSeconds: 5
      tolerations:
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule