k8s/iam: add cloudnativepg postgres and vault + authentik

- PostgreSQL 3-replica HA with pgvector
- Vault S3 storage backend (MinIO)
- Authentik federated OIDC provider
- Vault auto-unseal via postStart hook

k8s/ddb/cnpg-values.yaml

@@ -0,0 +1,51 @@
+# CloudNativePG Operator Configuration
+# Handles PostgreSQL cluster management with HA replication
+#
+# Timeout settings tuned for clusters with 5+ second network latency spikes
+
+# Operator deployment
+replicaCount: 1
+
+# Operator Pod configuration
+podAnnotations:
+  prometheus.io/scrape: "true"
+  prometheus.io/port: "8080"
+
+# Resource limits
+resources:
+  limits:
+    memory: 512Mi
+  requests:
+    memory: 256Mi
+
+# Monitoring
+monitoring:
+  enabled: true
+  serviceMonitor:
+    enabled: false  # disable until we have prometheus-operator CRDs
+
+# ── Configuration for operator behavior ────────────────────────────────────────
+# Applied to the cnpg-controller-manager-config ConfigMap
+config:
+  # HTTP client timeout for communicating with Postgres instances
+  # Default: 30s. Increased to 120s to tolerate 5+ second network latency spikes
+  instanceManagerHTTPClientTimeout: 120s
+
+  # TLS verification for instance manager
+  instanceManagerTLSInsecureSkipVerify: false
+
+  # Allow debug logging to diagnose HTTP communication issues
+  enableDebugLogging: true
+
+  # Pod debugging (disabled; security risk in production)
+  enablePodDebugging: false
+
+  # In-place updates for instance manager (disabled; safer for HA)
+  enableInstanceManagerInplaceUpdates: false
+
+  # Azure PVC updates (not applicable for Longhorn)
+  enableAzurePVCUpdates: false
+
+  # Certificate lifetime (90 days) and renewal threshold (7 days before expiry)
+  certificateDuration: 90
+  expiringCheckThreshold: 7

k8s/ddb/init-users.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Safe database initialization script
+# Applies init-users.sql with environment variable substitution
+# Exit on any error
+set -euo pipefail
+
+# Get superuser password from CNPG secret
+PG_PASSWORD=$(kubectl get secret -n ddb ddb-cluster-app -o jsonpath='{.data.password}' | base64 -d)
+export PGPASSWORD="$PG_PASSWORD"
+
+# Apply SQL with safe variable substitution (psql -v prevents injection)
+psql \
+  -h ddb-cluster-rw.ddb.svc.cluster.local \
+  -U postgres \
+  -d postgres \
+  -v authentik_password="$AUTHENTIK_PG_PASSWORD" \
+  -v story_crater_password="$STORY_CRATER_PG_PASSWORD" \
+  -f k8s/ddb/init-users.sql
+
+unset PGPASSWORD
+echo "✓ Database initialization complete"

k8s/ddb/init-users.sql

@@ -0,0 +1,11 @@
+-- Database initialization for homelab applications
+-- Idempotent: safe to re-run
+-- Required environment variables:
+--   AUTHENTIK_PG_PASSWORD
+--   STORY_CRATER_PG_PASSWORD
+
+CREATE ROLE IF NOT EXISTS authentik WITH LOGIN PASSWORD :'authentik_password';
+CREATE DATABASE IF NOT EXISTS authentik OWNER authentik;
+
+CREATE ROLE IF NOT EXISTS story_crater WITH LOGIN PASSWORD :'story_crater_password';
+CREATE DATABASE IF NOT EXISTS story_crater OWNER story_crater;