apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: ddb-cluster
  namespace: ddb
  labels:
    app: postgresql
    layer: data
spec:
  # Single instance — cp-1 is the only schedulable node in the 3-CP topology
  # (.163/.166 are dedicated control planes with no workload scheduling/storage).
  # Postgres standby HA is traded away; control-plane/etcd HA is unaffected.
  instances: 1

  # PostgreSQL 16.2
  imageName: ghcr.io/cloudnative-pg/postgresql:16.2

  # Bootstrap: create app database + extensions
  bootstrap:
    initdb:
      database: app
      owner: app
      encoding: UTF8
      localeCollate: C
      localeCType: C
      postInitApplicationSQL:
        - CREATE EXTENSION IF NOT EXISTS vector;
        - CREATE EXTENSION IF NOT EXISTS pgcrypto;
        - CREATE EXTENSION IF NOT EXISTS pg_trgm;

  # Per-app login roles, passwords sourced from secrets (CNPG reconciles the
  # role password to match the secret). Their databases are separate Database
  # CRs (see authentik-database.yaml / temporal-database.yaml) owned by these
  # roles. Replaces the old helmfile post-sync user-creation hook.
  managed:
    roles:
      - name: authentik
        ensure: present
        login: true
        passwordSecret:
          name: authentik-db-role
      - name: temporal
        ensure: present
        login: true
        passwordSecret:
          name: temporal-db-role

  # Disable superuser (security)
  enableSuperuserAccess: false

  # PostgreSQL configuration
  postgresql:
    parameters:
      shared_buffers: "256MB"
      max_parallel_workers: "4"
      max_parallel_workers_per_gather: "4"
      # WAL archiving for backups
      archive_mode: "on"
      archive_timeout: "5min"
      log_destination: "csvlog"
      log_directory: "/controller/log"
      log_filename: "postgres"
      log_rotation_age: "0"
      dynamic_shared_memory_type: "posix"

  # Storage on Longhorn
  storage:
    size: 10Gi
    storageClass: longhorn

  # Monitoring
  monitoring:
    enablePodMonitor: false
    disableDefaultQueries: false
    customQueriesConfigMap:
      - name: cnpg-default-monitoring
        key: queries

  # Pod anti-affinity for spreading replicas
  affinity:
    podAntiAffinityType: preferred