WIP keycloak stack (gate probe)

platform/keycloak/postgres-cluster.yaml

@@ -0,0 +1,41 @@
+---
+# Keycloak's PostgreSQL — a CloudNativePG Cluster (CR of the CNPG CRDs installed by platform/cnpg).
+# CARRIED BY platform-config (dependsOn platform) so the postgresql.cnpg.io CRDs exist first (F-MON1).
+#
+# DR-critical (R-IDP-05): storage on the 3-replica `longhorn` StorageClass (ADR-0003) — the data
+# survives node loss. CNPG creates the keycloak-db-app Secret (keys username/password) that the
+# Keycloak CR consumes, plus the keycloak-db-rw/-ro/-r Services. Keycloak is stateless and rebuilds
+# from this DB + the git-managed realm import (docs/15).
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: keycloak-db
+  namespace: keycloak
+spec:
+  # Single Postgres instance on 3-replica Longhorn is acceptable for the home scale (ADR-0014:
+  # "single replica with DB on Longhorn + backups is acceptable"). Raise to 3 for Postgres-level HA
+  # as a future hardening (prod) — the storage is already 3-way replicated by Longhorn.
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.4
+  storage:
+    storageClass: longhorn
+    size: 5Gi
+  bootstrap:
+    initdb:
+      database: keycloak
+      owner: keycloak
+  # Emit Postgres metrics so Prometheus scrapes DB health (R-OBS-01). The CNPG operator creates the
+  # PodMonitor at runtime (CRD already present from Phase-4 monitoring) — no kustomize CRD-ordering hazard.
+  monitoring:
+    enablePodMonitor: true
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      memory: 512Mi
+  # --- Off-cluster DR backup (R-IDP-05) — OPERATOR HAND-OFF (OQ-BKP, shared with Velero, Phase 4) ---
+  # When the off-cluster backup target is chosen, add a Barman object store + a ScheduledBackup:
+  #   spec.backup.barmanObjectStore = { destinationPath, endpointURL, s3Credentials {…SOPS…} }
+  #   + a postgresql.cnpg.io/v1 ScheduledBackup (cron) referencing this Cluster.
+  # Until then the DB is protected by 3-replica Longhorn + (Phase-4) Velero PVC backups of the namespace.