---
# Keycloak's PostgreSQL — a CloudNativePG Cluster (CR of the CNPG CRDs installed by platform/cnpg).
# CARRIED BY platform-config (dependsOn platform) so the postgresql.cnpg.io CRDs exist first (F-MON1).
#
# DR-critical (R-IDP-05): storage on the 3-replica `longhorn` StorageClass (ADR-0003) — the data
# survives node loss. CNPG creates the keycloak-db-app Secret (keys username/password) that the
# Keycloak CR consumes, plus the keycloak-db-rw/-ro/-r Services. Keycloak is stateless and rebuilds
# from this DB + the git-managed realm import (docs/15).
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: keycloak-db
  namespace: keycloak
spec:
  # Single Postgres instance on 3-replica Longhorn is acceptable for the home scale (ADR-0014:
  # "single replica with DB on Longhorn + backups is acceptable"). Raise to 3 for Postgres-level HA
  # as a future hardening (prod) — the storage is already 3-way replicated by Longhorn.
  instances: 1
  imageName: ghcr.io/cloudnative-pg/postgresql:16.4
  storage:
    storageClass: longhorn
    size: 5Gi
  bootstrap:
    initdb:
      database: keycloak
      owner: keycloak
  # Emit Postgres metrics so Prometheus scrapes DB health (R-OBS-01). The CNPG operator creates the
  # PodMonitor at runtime (CRD already present from Phase-4 monitoring) — no kustomize CRD-ordering hazard.
  monitoring:
    enablePodMonitor: true
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      memory: 512Mi
  # --- Off-cluster DR backup (R-IDP-05) — CNPG-native Barman → object storage ---
  # Continuous WAL archiving + periodic base backups give proper Postgres PITR (superior to a Velero
  # PVC snapshot for a live DB). CNPG appends `serverName` (defaults to the Cluster name) to
  # destinationPath, so objects land under ${CNPG_BACKUP_PATH}/keycloak-db/ — dev
  # s3://cnpg/keycloak-db/ on the on-Proxmox MinIO, prod s3://k3s-prod-backup/barman/keycloak-db/ on
  # Cloudflare R2. Both endpointURL and destinationPath are cluster-vars knobs (R-ENV-02),
  # substituted by the `platform-config` Kustomization (this file sits under platform/keycloak/ but
  # platform-config is the only tier that lists it as a resource — see its kustomization.yaml).
  # Credentials: the scoped key from the in-namespace SOPS Secret keycloak-db-backup-credentials
  # (a Pod only reads same-ns Secrets).
  #
  # *** archive_mode IS ON, SO A FAILING ARCHIVE COMMAND IS A DISK-FULL CLOCK, NOT A DEGRADED
  # BACKUP. *** Postgres will not recycle a WAL segment it has not successfully archived, so
  # whenever these two values are wrong the pgdata PVC fills monotonically until the primary
  # PANICs. This is not hypothetical: prod ran from bootstrap to 2026-09-07 with
  # `endpointURL: TBD-PROD-S3-BACKUP-ENDPOINT` (barman-cloud-wal-archive exit 4 on every segment)
  # and had burned ~579 MiB of a 5 GiB PVC on the way to taking SSO — and with it kubectl OIDC,
  # Grafana, Headlamp, Gitea and forward-auth — down with it. Never leave a placeholder here, and
  # treat `ContinuousArchiving=False` on this Cluster as an availability incident, not a backup one.
  backup:
    retentionPolicy: "30d"          # keep 30 days of base backups + WAL (PITR window); prunes older
    barmanObjectStore:
      destinationPath: ${CNPG_BACKUP_PATH}
      endpointURL: ${S3_BACKUP_ENDPOINT}
      s3Credentials:
        accessKeyId:
          name: keycloak-db-backup-credentials
          key: ACCESS_KEY_ID
        secretAccessKey:
          name: keycloak-db-backup-credentials
          key: ACCESS_SECRET_KEY
      wal:
        compression: gzip
        maxParallel: 2
      data:
        compression: gzip
---
# Daily base backup of keycloak-db (WAL is archived continuously by the barmanObjectStore above).
# CNPG cron is 6-field (sec min hour dom mon dow). immediate:true takes a first base backup as soon
# as the schedule is created so the PITR chain has a starting point. Staggered 01:00 (nextcloud 02:00,
# semaphore 04:00, Velero 03:00) to avoid concurrent base backups hammering MinIO.
apiVersion: postgresql.cnpg.io/v1
kind: ScheduledBackup
metadata:
  name: keycloak-db-daily
  namespace: keycloak
spec:
  immediate: true
  schedule: "0 0 1 * * *"
  backupOwnerReference: self
  cluster:
    name: keycloak-db
  method: barmanObjectStore