WIP keycloak stack (gate probe)

platform/cnpg/README.md

@@ -0,0 +1,24 @@
+# platform/cnpg
+
+**CloudNativePG** — the PostgreSQL operator that runs Keycloak's DR-critical database.
+
+- **Governing ADR:** [ADR-0014 — IdP: Keycloak](../../../home-network-k3s/decisions/adr-0014-idp-keycloak.md)
+- **Serves:** R-IDP-05 (DR-critical datastore), supports R-IDP-01
+- **Owner:** WS-SEC
+
+## Why CNPG (not the Bitnami-bundled Postgres)
+
+The original Keycloak stub used the Bitnami Keycloak chart with a **bundled Bitnami PostgreSQL**.
+Bitnami's free Docker Hub images were purged/relocated (DECISIONS-LOG **F-KY1**) — a deploy on stock
+Bitnami tags ImagePullBackOffs. CloudNativePG:
+
+- ships from **ghcr.io/cloudnative-pg** (unaffected by the Bitnami purge),
+- runs Postgres as a replicated `Cluster` on **Longhorn** (3 instances → survives node loss),
+- gives **declarative backup/restore** (`ScheduledBackup` + Barman object store) — the clean DR hook
+  for **R-IDP-05** (off-cluster backup) once the backup target lands (OQ-BKP, Phase 4).
+
+## Controllers/configs split (F-MON1)
+
+This directory installs only the **operator + CRDs** (controllers). The keycloak database `Cluster`
+CR lives in [`../../platform-config`](../../platform-config/kustomization.yaml)
+(`dependsOn: platform`, wait) so the `postgresql.cnpg.io` CRDs exist before the CR applies.