feat(cnpg): synchronous replication, quorum of 1, dataDurability preferred

Three instances replicating ASYNCHRONOUSLY still lose data on failover: COMMIT
returns as soon as the primary has flushed locally, so a primary that dies
before its standbys catch up takes the last few transactions with it and the
promoted standby comes up quietly missing them. On keycloak-db that is a
just-created user, a rotated credential or a consent vanishing at exactly the
moment of a failover.

`method: any` + `number: 1` makes COMMIT wait for ONE of the two standbys to
confirm — the point of having them.

dataDurability: preferred, NEVER required. `required` is a strict quorum:
fewer than `number` healthy standbys and writes BLOCK. Postgres here shares
three nodes with etcd and the CNI, so one degraded standby — a node reboot, a
Longhorn replica rebuild, a Cilium restart — would turn a partial degradation
into a total write outage, and on the SSO database that takes kubectl OIDC,
Grafana, Headlamp, Gitea and forward-auth with it. `preferred` keeps
synchronous commit while a healthy standby is there and relaxes the required
count dynamically when one is not. dataDurability is only honoured while
standbyNamesPre/standbyNamesPost are unset — both are.

NON-DISRUPTIVE: this compiles to `synchronous_standby_names`, a reload-only
PostgreSQL parameter. No pod restart, no switchover, no client disconnect.
It is the last of the three commits because it wants standbys that already
exist and are already on their final nodes.

Field shape verified against the live clusters.postgresql.cnpg.io CRD before
relying on it (CNPG 1.30.0, byte-identical schema on k3s-prod and k3s-dev):
spec.postgresql.synchronous requires `method` (enum any|first) and `number`
(x-kubernetes-validation self > 0); `dataDurability` is enum required|
preferred. None of the three Clusters previously had a `postgresql:` block,
so this adds one rather than merging into existing parameters.

DEV IMPACT: identical and non-disruptive, same reload-only path.

Verified: yamllint clean; both tiers render the block.

Co-Authored-By: Claude Opus 5 <[email protected]>
(cherry picked from commit f1ce19461415e77eb2f1ca5109ebab49edf0860b)

apps/wave-0/nextcloud-db.yaml

@@ -69,6 +69,21 @@ spec:
     enablePodAntiAffinity: true
     podAntiAffinityType: required
   primaryUpdateMethod: switchover
+  # SYNCHRONOUS REPLICATION — quorum of ONE standby, PREFERRED durability (2026-09-07). Full
+  # rationale in platform/keycloak/postgres-cluster.yaml. Short version: async replication loses the
+  # last few transactions when a primary dies before its standbys catch up, and `method: any` +
+  # `number: 1` makes COMMIT wait for one standby to confirm. dataDurability MUST stay `preferred`,
+  # never `required` — `required` blocks writes outright when fewer than `number` healthy standbys
+  # are available, which on a 3-node cluster sharing nodes with etcd and the CNI turns one degraded
+  # standby into a total write outage. `preferred` relaxes to async instead.
+  #
+  # NON-DISRUPTIVE: compiles to `synchronous_standby_names`, a reload-only PostgreSQL parameter —
+  # no restart, no switchover, no client disconnect. Land it after the anti-affinity roll.
+  postgresql:
+    synchronous:
+      method: any
+      number: 1
+      dataDurability: preferred
   storage:
     storageClass: longhorn
     size: 5Gi

apps/wave-0/semaphore-db.yaml

@@ -70,6 +70,21 @@ spec:
     enablePodAntiAffinity: true
     podAntiAffinityType: required
   primaryUpdateMethod: switchover
+  # SYNCHRONOUS REPLICATION — quorum of ONE standby, PREFERRED durability (2026-09-07). Full
+  # rationale in platform/keycloak/postgres-cluster.yaml. Short version: async replication loses the
+  # last few transactions when a primary dies before its standbys catch up, and `method: any` +
+  # `number: 1` makes COMMIT wait for one standby to confirm. dataDurability MUST stay `preferred`,
+  # never `required` — `required` blocks writes outright when fewer than `number` healthy standbys
+  # are available, which on a 3-node cluster sharing nodes with etcd and the CNI turns one degraded
+  # standby into a total write outage. `preferred` relaxes to async instead.
+  #
+  # NON-DISRUPTIVE: compiles to `synchronous_standby_names`, a reload-only PostgreSQL parameter —
+  # no restart, no switchover, no client disconnect. Land it after the anti-affinity roll.
+  postgresql:
+    synchronous:
+      method: any
+      number: 1
+      dataDurability: preferred
   storage:
     storageClass: longhorn
     size: 5Gi

platform/keycloak/postgres-cluster.yaml

@@ -75,6 +75,39 @@ spec:
   # AND a postgresql parameter in the same reconcile. Renovate bumping the image alone is fine;
   # never combine an image bump with a postgresql.parameters change in one commit.
   primaryUpdateMethod: switchover
+  # SYNCHRONOUS REPLICATION — quorum of ONE standby, PREFERRED durability (2026-09-07).
+  #
+  # Standbys are asynchronous by default: COMMIT returns as soon as the PRIMARY has flushed locally,
+  # so a primary that dies before its standbys catch up takes the last few transactions with it and
+  # the promoted standby comes up quietly missing them. On the IdP database that is a just-created
+  # user, a rotated credential or a consent silently disappearing at exactly the moment of a
+  # failover — the hardest class of bug to notice and the worst one to have. `method: any` +
+  # `number: 1` makes COMMIT wait for ONE of the two standbys to confirm, which is the entire point
+  # of having them.
+  #
+  # dataDurability: preferred — AND NEVER `required`. `required` is a STRICT quorum: if fewer than
+  # `number` healthy standbys are available, writes BLOCK. Postgres here shares three nodes with
+  # etcd and the CNI, so one degraded standby — a node reboot, a Longhorn replica rebuild, a Cilium
+  # restart — would turn a partial degradation into a TOTAL WRITE OUTAGE on SSO, and SSO is the
+  # dependency of kubectl OIDC, Grafana, Headlamp, Gitea and forward-auth. `preferred` keeps
+  # synchronous commit whenever a healthy standby is there and relaxes the required count
+  # dynamically when one is not: durability when we can have it, availability when we cannot. That
+  # is the right trade for a 3-node home cluster; a 5-node cluster with a spare could revisit it.
+  # (dataDurability is only honoured while standbyNamesPre/standbyNamesPost are unset — they are.)
+  #
+  # NON-DISRUPTIVE TO APPLY: this compiles to `synchronous_standby_names`, which PostgreSQL treats
+  # as a RELOAD-only parameter. No pod restart, no switchover, no client disconnect — CNPG reloads
+  # the config in place. Landing it AFTER the anti-affinity roll is deliberate: it wants standbys
+  # that already exist and are already on their final nodes, and it must not be folded into a roll.
+  #
+  # Field shape verified against the live clusters.postgresql.cnpg.io CRD (CNPG 1.30.0, identical
+  # on prod and dev): spec.postgresql.synchronous requires `method` (enum any|first) and `number`
+  # (>0); `dataDurability` is enum required|preferred.
+  postgresql:
+    synchronous:
+      method: any
+      number: 1
+      dataDurability: preferred
   storage:
     storageClass: longhorn
     size: 5Gi