version: 1
kind: postgres-host-cluster

metadata:
  id: nc01-host-postgres
  description: NC01 host-native PostgreSQL 16 for local UniDesk/HWLAB runtime state
  owner: unidesk

cluster:
  role: primary
  environment: node-local
  exposure: private-only
  haPhase: standalone

node:
  id: NC01
  route: NC01
  mode: host-systemd
  osFamily: ubuntu

postgres:
  package:
    manager: apt
    version: "16"
  service:
    name: postgresql
    enabled: true
    state: running
  network:
    port: 5432
    listenAddresses:
      - 127.0.0.1
      - 10.42.0.1
    connectionHost: 10.42.0.1
    transport: postgres-native-tls
    sslmode: require
  auth:
    passwordEncryption: scram-sha-256
    pgHba:
      - type: local
        database: all
        user: postgres
        method: peer
      - type: host
        database: all
        user: all
        address: 127.0.0.1/32
        method: scram-sha-256
      - type: host
        database: all
        user: all
        address: 10.42.0.0/16
        method: scram-sha-256

secrets:
  root: /root/unidesk/.state/secrets