WIP keycloak stack (gate probe)

platform/cnpg/README.md

@@ -0,0 +1,24 @@
+# platform/cnpg
+
+**CloudNativePG** — the PostgreSQL operator that runs Keycloak's DR-critical database.
+
+- **Governing ADR:** [ADR-0014 — IdP: Keycloak](../../../home-network-k3s/decisions/adr-0014-idp-keycloak.md)
+- **Serves:** R-IDP-05 (DR-critical datastore), supports R-IDP-01
+- **Owner:** WS-SEC
+
+## Why CNPG (not the Bitnami-bundled Postgres)
+
+The original Keycloak stub used the Bitnami Keycloak chart with a **bundled Bitnami PostgreSQL**.
+Bitnami's free Docker Hub images were purged/relocated (DECISIONS-LOG **F-KY1**) — a deploy on stock
+Bitnami tags ImagePullBackOffs. CloudNativePG:
+
+- ships from **ghcr.io/cloudnative-pg** (unaffected by the Bitnami purge),
+- runs Postgres as a replicated `Cluster` on **Longhorn** (3 instances → survives node loss),
+- gives **declarative backup/restore** (`ScheduledBackup` + Barman object store) — the clean DR hook
+  for **R-IDP-05** (off-cluster backup) once the backup target lands (OQ-BKP, Phase 4).
+
+## Controllers/configs split (F-MON1)
+
+This directory installs only the **operator + CRDs** (controllers). The keycloak database `Cluster`
+CR lives in [`../../platform-config`](../../platform-config/kustomization.yaml)
+(`dependsOn: platform`, wait) so the `postgresql.cnpg.io` CRDs exist before the CR applies.

platform/cnpg/helmrelease.yaml

@@ -0,0 +1,38 @@
+---
+# CloudNativePG operator (ghcr.io/cloudnative-pg images — NOT Bitnami, unaffected by the F-KY1 purge).
+# Installs the postgresql.cnpg.io CRDs + a cluster-wide operator. The keycloak database itself is a
+# `Cluster` CR carried by platform-config (dependsOn platform) — the controllers/configs split
+# (F-MON1): a CR of a CRD this HelmRelease registers must NOT apply in the same pass.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cloudnative-pg
+  namespace: cnpg-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cloudnative-pg
+      version: ">=0.22.0 <1.0.0"   # TODO(WS-SEC): pin at bring-up; Renovate maintains
+      sourceRef:
+        kind: HelmRepository
+        name: cloudnative-pg
+        namespace: cnpg-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    # Single operator replica is plenty for a home cluster; it only reconciles CRs.
+    replicaCount: 1
+    resources:
+      requests:
+        cpu: 50m
+        memory: 100Mi
+      limits:
+        memory: 256Mi
+    # Expose operator metrics so the ServiceMonitor (platform-config) can scrape DB/operator health.
+    monitoring:
+      podMonitorEnabled: false      # we ship a ServiceMonitor for the Cluster instead (docs/10)

platform/cnpg/helmrepository.yaml

@@ -0,0 +1,13 @@
+---
+# CloudNativePG — the PostgreSQL operator backing Keycloak's DR-critical database (ADR-0014).
+# Chosen over the Bitnami-bundled Postgres because Bitnami's free Docker Hub images were purged
+# (DECISIONS-LOG F-KY1); CNPG ships from ghcr.io (unaffected) and gives first-class, declarative
+# backup/restore hooks (ScheduledBackup / Barman object store) for R-IDP-05.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cloudnative-pg
+  namespace: cnpg-system
+spec:
+  interval: 1h
+  url: https://cloudnative-pg.github.io/charts

platform/cnpg/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helmrepository.yaml
+  - helmrelease.yaml

platform/cnpg/namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cnpg-system