version: 1
kind: postgres-host-cluster

metadata:
  id: nc01-host-postgres
  description: NC01 host-native PostgreSQL 16 for local UniDesk/HWLAB/AgentRun runtime state
  owner: unidesk
  relatedIssues: []

cluster:
  role: primary
  environment: node-local
  exposure: private-only
  haPhase: standalone

node:
  id: NC01
  route: NC01
  mode: host-systemd
  osFamily: ubuntu
  requiredHostFacts:
    minCpu: 1
    minMemoryGiB: 1
    minDiskFreeGiB: 5
    requireSwap: false
  swap:
    ensure: false
    size: 1G
    path: /swapfile

postgres:
  package:
    manager: apt
    version: "16"
    repo: pgdg
    repoUrl: https://apt.postgresql.org/pub/repos/apt
    suite: trixie-pgdg
    component: main
    signingKeyUrl: https://www.postgresql.org/media/keys/ACCC4CF8.asc
    signedBy: /usr/share/keyrings/postgresql-pgdg.gpg
    sourceList: /etc/apt/sources.list.d/pgdg.list
  service:
    name: postgresql
    enabled: true
    state: running
  paths:
    dataDir: /var/lib/postgresql/16/main
    configDir: /etc/postgresql/16/main
    logDir: /var/log/postgresql
  network:
    port: 5432
    listenAddresses:
      - 127.0.0.1
      - 10.42.0.1
    connectionHost: 10.42.0.1
    publicDns: nc01-host-postgres.local
    transport: postgres-native-tls
    sslmode: require
    tls:
      enabled: true
      mode: self-signed-server-cert
      commonName: nc01-host-postgres
      certFile: /etc/postgresql/16/main/server.crt
      keyFile: /etc/postgresql/16/main/server.key
      futureClientSslmode: require
    firewall:
      mode: pg-hba-declared-sources
      defaultDeny: true
      allowSources:
        - id: nc01-local
          cidr: 127.0.0.1/32
          purpose: local-admin
        - id: nc01-k3s-pods
          cidr: 10.42.0.0/16
          purpose: node-local-k3s-workloads
  tuning:
    maxConnections: 100
    sharedBuffers: 128MB
    effectiveCacheSize: 4GB
    workMem: 4MB
    maintenanceWorkMem: 64MB
    walCompression: false
    checkpointCompletionTarget: 0.9
  auth:
    passwordEncryption: scram-sha-256
    pgHba:
      - type: local
        database: all
        user: postgres
        method: peer
      - type: host
        database: all
        user: all
        address: 127.0.0.1/32
        method: scram-sha-256
      - type: hostssl
        database: agentrun_v02
        user: agentrun_v02
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: postgres
        user: agentrun_v02
        address: 10.42.0.0/16
        method: scram-sha-256

secrets:
  source: master-local
  root: /root/unidesk/.state/secrets
  entries:
    - name: agentrun-nc01-v02-db-credentials
      sourceRef: platform-db/agentrun-nc01-v02-db.env
      type: env
      requiredKeys:
        - AGENTRUN_NC01_V02_DB_USER
        - AGENTRUN_NC01_V02_DB_PASSWORD
        - AGENTRUN_NC01_V02_DB_NAME
      createIfMissing:
        enabled: true
        values:
          AGENTRUN_NC01_V02_DB_USER: agentrun_v02
          AGENTRUN_NC01_V02_DB_NAME: agentrun_v02
        randomHex:
          AGENTRUN_NC01_V02_DB_PASSWORD: 32

objects:
  roles:
    - name: agentrun_v02
      passwordRef:
        sourceRef: platform-db/agentrun-nc01-v02-db.env
        key: AGENTRUN_NC01_V02_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
  databases:
    - name: agentrun_v02
      owner: agentrun_v02
      encoding: UTF8
      locale: C.UTF-8
      extensions: []

exports:
  connectionStrings:
    - name: agentrun-nc01-v02-database-url
      sourceSecretRef: platform-db/agentrun-nc01-v02-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(AGENTRUN_NC01_V02_DB_USER):$(AGENTRUN_NC01_V02_DB_PASSWORD)@$(PGHOST):5432/$(AGENTRUN_NC01_V02_DB_NAME)?sslmode=require&uselibpqcompat=true
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: agentrun/nc01-v02-mgr-db.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: agentrun-v02
          secret: agentrun-v02-mgr-db
          key: DATABASE_URL

backup:
  logicalDump:
    enabled: false
    schedule: "*-*-* 03:37:00"
    database: agentrun_v02
    retentionDays: 7
    destination:
      type: local-directory
      path: /var/backups/unidesk/platform-db/nc01/agentrun-v02
    encryption:
      enabled: false