fix(cicd): add NC01 PaC status closeout

config/agentrun.yaml

@@ -924,7 +924,7 @@ controlPlane:
               - fenced
               - late-write-rejected
         localPostgres:
-          enabled: true
+          enabled: false
           serviceName: agentrun-v02-postgres
           image: postgres:16-alpine
           storage: 5Gi
@@ -962,11 +962,17 @@ controlPlane:
             repository: pikasTech/agent_skills
             sourceBranch: master
       database:
-        mode: local-postgres
+        mode: external-postgres
+        provider: NC01
+        configRef: config/platform-db/postgres-nc01.yaml
+        database: agentrun_v02
+        user: agentrun_v02
+        sslmode: require
+        secretSourceRef: agentrun/nc01-v02-mgr-db.env
         secretRef:
           name: agentrun-v02-mgr-db
           key: DATABASE_URL
-        localPostgresExpectedAbsent: false
+        localPostgresExpectedAbsent: true
       secrets:
         - id: manager-api-key
           sourceRef: hwlab/nc01-v03-admin.env
@@ -1357,4 +1363,4 @@ controlPlane:
         targetRef:
           namespace: agentrun-v02
           name: agentrun-v01-tool-unidesk-ssh
-          key: UNIDESK_SSH_CLIENT_TOKEN
+          key: UNIDESK_SSH_CLIENT_TOKEN

config/platform-db/postgres-nc01.yaml

@@ -3,8 +3,9 @@ kind: postgres-host-cluster
 
 metadata:
   id: nc01-host-postgres
-  description: NC01 host-native PostgreSQL 16 for local UniDesk/HWLAB runtime state
+  description: NC01 host-native PostgreSQL 16 for local UniDesk/HWLAB/AgentRun runtime state
   owner: unidesk
+  relatedIssues: []
 
 cluster:
   role: primary
@@ -17,23 +18,69 @@ node:
   route: NC01
   mode: host-systemd
   osFamily: ubuntu
+  requiredHostFacts:
+    minCpu: 1
+    minMemoryGiB: 1
+    minDiskFreeGiB: 5
+    requireSwap: false
+  swap:
+    ensure: false
+    size: 1G
+    path: /swapfile
 
 postgres:
   package:
     manager: apt
     version: "16"
+    repo: pgdg
+    repoUrl: https://apt.postgresql.org/pub/repos/apt
+    suite: trixie-pgdg
+    component: main
+    signingKeyUrl: https://www.postgresql.org/media/keys/ACCC4CF8.asc
+    signedBy: /usr/share/keyrings/postgresql-pgdg.gpg
+    sourceList: /etc/apt/sources.list.d/pgdg.list
   service:
     name: postgresql
     enabled: true
     state: running
+  paths:
+    dataDir: /var/lib/postgresql/16/main
+    configDir: /etc/postgresql/16/main
+    logDir: /var/log/postgresql
   network:
     port: 5432
     listenAddresses:
       - 127.0.0.1
       - 10.42.0.1
     connectionHost: 10.42.0.1
+    publicDns: nc01-host-postgres.local
     transport: postgres-native-tls
     sslmode: require
+    tls:
+      enabled: true
+      mode: self-signed-server-cert
+      commonName: nc01-host-postgres
+      certFile: /etc/postgresql/16/main/server.crt
+      keyFile: /etc/postgresql/16/main/server.key
+      futureClientSslmode: require
+    firewall:
+      mode: pg-hba-declared-sources
+      defaultDeny: true
+      allowSources:
+        - id: nc01-local
+          cidr: 127.0.0.1/32
+          purpose: local-admin
+        - id: nc01-k3s-pods
+          cidr: 10.42.0.0/16
+          purpose: node-local-k3s-workloads
+  tuning:
+    maxConnections: 100
+    sharedBuffers: 128MB
+    effectiveCacheSize: 4GB
+    workMem: 4MB
+    maintenanceWorkMem: 64MB
+    walCompression: false
+    checkpointCompletionTarget: 0.9
   auth:
     passwordEncryption: scram-sha-256
     pgHba:
@@ -46,11 +93,80 @@ postgres:
         user: all
         address: 127.0.0.1/32
         method: scram-sha-256
-      - type: host
-        database: all
-        user: all
+      - type: hostssl
+        database: agentrun_v02
+        user: agentrun_v02
+        address: 10.42.0.0/16
+        method: scram-sha-256
+      - type: hostssl
+        database: postgres
+        user: agentrun_v02
         address: 10.42.0.0/16
         method: scram-sha-256
 
 secrets:
+  source: master-local
   root: /root/unidesk/.state/secrets
+  entries:
+    - name: agentrun-nc01-v02-db-credentials
+      sourceRef: platform-db/agentrun-nc01-v02-db.env
+      type: env
+      requiredKeys:
+        - AGENTRUN_NC01_V02_DB_USER
+        - AGENTRUN_NC01_V02_DB_PASSWORD
+        - AGENTRUN_NC01_V02_DB_NAME
+      createIfMissing:
+        enabled: true
+        values:
+          AGENTRUN_NC01_V02_DB_USER: agentrun_v02
+          AGENTRUN_NC01_V02_DB_NAME: agentrun_v02
+        randomHex:
+          AGENTRUN_NC01_V02_DB_PASSWORD: 32
+
+objects:
+  roles:
+    - name: agentrun_v02
+      passwordRef:
+        sourceRef: platform-db/agentrun-nc01-v02-db.env
+        key: AGENTRUN_NC01_V02_DB_PASSWORD
+      login: true
+      attributes:
+        createdb: false
+        createrole: false
+        superuser: false
+  databases:
+    - name: agentrun_v02
+      owner: agentrun_v02
+      encoding: UTF8
+      locale: C.UTF-8
+      extensions: []
+
+exports:
+  connectionStrings:
+    - name: agentrun-nc01-v02-database-url
+      sourceSecretRef: platform-db/agentrun-nc01-v02-db.env
+      render:
+        envKey: DATABASE_URL
+        format: postgresql://$(AGENTRUN_NC01_V02_DB_USER):$(AGENTRUN_NC01_V02_DB_PASSWORD)@$(PGHOST):5432/$(AGENTRUN_NC01_V02_DB_NAME)?sslmode=require&uselibpqcompat=true
+        variables:
+          PGHOST: 10.42.0.1
+      writeToSecretSource:
+        sourceRef: agentrun/nc01-v02-mgr-db.env
+        key: DATABASE_URL
+        mode: update-or-insert
+      consumers:
+        - scope: agentrun-v02
+          secret: agentrun-v02-mgr-db
+          key: DATABASE_URL
+
+backup:
+  logicalDump:
+    enabled: false
+    schedule: "*-*-* 03:37:00"
+    database: agentrun_v02
+    retentionDays: 7
+    destination:
+      type: local-directory
+      path: /var/backups/unidesk/platform-db/nc01/agentrun-v02
+    encryption:
+      enabled: false