---
# Semaphore's PostgreSQL — a CloudNativePG Cluster (CR of the CNPG CRDs from platform/cnpg), modeled
# on apps/nextcloud-db.yaml (the first CNPG-DB) / platform/keycloak/postgres-cluster.yaml. This is the
# SECOND CNPG-DB in apps/, reusing the pattern established by nextcloud.
#
# WHY A DEDICATED `semaphore-db` NAMESPACE (not co-located in `semaphore`):
#   The app->db edge in catalog/semaphore.yaml (`dependencies: to: semaphore-db`) compiles to a
#   CiliumNetworkPolicy whose egress selector pins BOTH the destination pod label
#   (app.kubernetes.io/name=semaphore-db) AND its namespace (k8s:io.kubernetes.pod.namespace=
#   semaphore-db) — cross-namespace Cilium selectors must name the namespace (catalog/render.py
#   r_dependency_policies). So the DB MUST live in a namespace literally named `semaphore-db` and its
#   pods MUST carry app.kubernetes.io/name=semaphore-db, injected below via inheritedMetadata.
#
# DEFAULT-DENY POSTURE — mirrors keycloak/nextcloud-db (platform/keycloak/namespace.yaml): this
# namespace is INTENTIONALLY not homelab.keithjackson.dev/app-namespace=true, so Kyverno does NOT
# generate the app default-deny baseline here and CNPG runs under Cilium's cluster-wide default-allow —
# the SAME posture the verified keycloak-db / nextcloud-db use. The semaphore SIDE keeps its
# default-deny; its rendered egress-allow opens ONLY semaphore -> semaphore-db:5432, and the DB side's
# default-allow accepts that reciprocal ingress. No app-namespace policy (auth-mode/host-namespace/
# secret-provenance) is weakened.
apiVersion: v1
kind: Namespace
metadata:
  name: semaphore-db
  labels:
    # Match the Cilium egress selector's namespace pin; NOT an app-namespace (see header).
    app.kubernetes.io/name: semaphore-db
---
# Owner credentials for the CNPG cluster. SOPS-encrypted (age); type basic-auth so CNPG's initdb
# consumes it as the `semaphore` role's password instead of generating a random one — this lets the
# SAME password be mirrored into ns semaphore (semaphore-bootstrap/db-password) for the app's env,
# since a Pod cannot read a Secret in another namespace. Provided as apps/semaphore-db-app.sops.yaml.
#
# CNPG Cluster (CR of postgresql.cnpg.io installed by platform/cnpg).
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: semaphore-db
  namespace: semaphore-db
spec:
  # Single Postgres instance on 3-replica Longhorn is acceptable at home scale (ADR-0014, same as
  # keycloak-db / nextcloud-db). The storage is already 3-way replicated by Longhorn; raise to 3 for
  # Postgres-level HA as a future hardening.
  instances: 1
  imageName: ghcr.io/cloudnative-pg/postgresql:16.4
  # Stamp app.kubernetes.io/name=semaphore-db onto every generated pod/service so the rendered
  # semaphore egress CiliumNetworkPolicy's toEndpoints selector matches the primary pod (R-NET-02).
  inheritedMetadata:
    labels:
      app.kubernetes.io/name: semaphore-db
  storage:
    storageClass: longhorn
    size: 5Gi
  bootstrap:
    initdb:
      database: semaphore
      owner: semaphore
      # Use the pre-provisioned owner secret (basic-auth) so its password is known + reusable by the
      # app in the other namespace, instead of the random CNPG-generated one.
      secret:
        name: semaphore-db-app
  # Emit Postgres metrics so Prometheus scrapes DB health (R-OBS-01). The CNPG operator creates the
  # PodMonitor at runtime (CRD present from Phase-4 monitoring).
  monitoring:
    enablePodMonitor: true
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      memory: 512Mi
  # --- Off-cluster DR backup (R-STATE-03) — OPERATOR HAND-OFF (OQ-BKP, shared with Velero, Phase 4) ---
  # When the off-cluster backup target is chosen, add a Barman object store + a ScheduledBackup here
  # (same hand-off as keycloak-db / nextcloud-db). Until then the DB is protected by 3-replica Longhorn
  # + (Phase-4) Velero PVC backups of the namespace; the SD declares backup.policy daily-offcluster.