cnpg-cluster.yaml (13579B)
1 apiVersion: barmancloud.cnpg.io/v1 2 kind: ObjectStore 3 metadata: 4 name: hetzner-base-backup 5 namespace: postgres-cluster 6 spec: 7 retentionPolicy: "30d" 8 configuration: 9 destinationPath: s3://mtrnord-talos-pg-backup/pg-base-backup 10 endpointURL: https://hel1.your-objectstorage.com 11 s3Credentials: 12 accessKeyId: 13 name: pg-s3-credentials 14 key: ACCESS_KEY_ID 15 secretAccessKey: 16 name: pg-s3-credentials 17 key: ACCESS_SECRET_KEY 18 wal: 19 compression: gzip 20 maxParallel: 2 21 data: 22 compression: gzip 23 immediateCheckpoint: true 24 jobs: 2 25 --- 26 apiVersion: postgresql.cnpg.io/v1 27 kind: Cluster 28 metadata: 29 name: pg-cluster-v2 30 namespace: postgres-cluster 31 spec: 32 instances: 3 33 imageName: ghcr.io/cloudnative-pg/postgresql:18.3-202602261638-standard-trixie@sha256:6740b49ca99b8ec7eb8fc9b3e116d1b9c28db0a0062da1026b2b220bcd6b8781 34 enableSuperuserAccess: true 35 primaryUpdateMethod: switchover 36 ephemeralVolumesSizeLimit: 37 shm: 250Mi 38 temporaryData: 250Mi 39 postgresql: 40 parameters: 41 # Tuned by https://pgconfigurator.cybertec-postgresql.com/ 42 # Connectivity 43 max_connections: "300" 44 superuser_reserved_connections: "5" 45 # Memory Settings 46 shared_buffers: 2048 MB 47 work_mem: 32 MB 48 maintenance_work_mem: 320 MB 49 huge_pages: "off" 50 effective_cache_size: 6 GB 51 effective_io_concurrency: "150" 52 random_page_cost: "1.5" 53 # Monitoring 54 track_io_timing: "on" 55 # track execution times of pl-language procedures if any 56 track_functions: pl 57 # Replication 58 max_wal_senders: "10" 59 # Checkpointing 60 checkpoint_timeout: 15 min 61 checkpoint_completion_target: "0.9" 62 max_wal_size: 1024 MB 63 min_wal_size: 512 MB 64 # WAL writing 65 wal_compression: "on" 66 wal_buffers: "-1" 67 wal_writer_delay: 200ms 68 wal_writer_flush_after: 1MB 69 wal_keep_size: 3650 MB 70 # Background writer 71 bgwriter_delay: 200ms 72 bgwriter_lru_maxpages: "100" 73 bgwriter_lru_multiplier: "2.0" 74 bgwriter_flush_after: "0" 75 # Parallel queries: 76 max_worker_processes: "6" 77 max_parallel_workers_per_gather: "3" 78 max_parallel_maintenance_workers: "3" 79 max_parallel_workers: "6" 80 parallel_leader_participation: "on" 81 # Advanced features 82 enable_partitionwise_join: "on" 83 enable_partitionwise_aggregate: "on" 84 jit: "on" 85 max_slot_wal_keep_size: 1000 MB 86 track_wal_io_timing: "on" 87 maintenance_io_concurrency: "150" 88 wal_recycle: "on" 89 #pg_hba: 90 # - host concourse concourse all md5 91 # backup: 92 # target: prefer-standby 93 # retentionPolicy: 30d 94 # barmanObjectStore: 95 # destinationPath: s3://mtrnord-talos-pg-backup/pg-base-backup 96 # endpointURL: https://hel1.your-objectstorage.com 97 # s3Credentials: 98 # accessKeyId: 99 # name: pg-s3-credentials 100 # key: ACCESS_KEY_ID 101 # secretAccessKey: 102 # name: pg-s3-credentials 103 # key: ACCESS_SECRET_KEY 104 # wal: 105 # compression: gzip 106 # maxParallel: 2 107 # data: 108 # compression: gzip 109 # immediateCheckpoint: true 110 # jobs: 2 111 plugins: 112 - name: barman-cloud.cloudnative-pg.io 113 isWALArchiver: true 114 parameters: 115 barmanObjectName: hetzner-base-backup 116 serverName: pg-cluster-v2-restored 117 managed: 118 roles: 119 - name: freshrss 120 ensure: present 121 login: true 122 superuser: false 123 passwordSecret: 124 name: freshrss 125 - name: meowlnir 126 ensure: present 127 login: true 128 comment: Read Only Access for synapse required but RW to meowlnir db 129 superuser: false 130 passwordSecret: 131 name: meowlnir 132 - name: connectivity-tester-stage 133 ensure: present 134 login: true 135 superuser: false 136 passwordSecret: 137 name: connectivity-tester-stage 138 - name: connectivity-tester 139 ensure: present 140 login: true 141 superuser: false 142 passwordSecret: 143 name: connectivity-tester 144 - name: draupnir_synapse 145 ensure: present 146 login: true 147 superuser: false 148 passwordSecret: 149 name: draupnir-synapse 150 - name: authentik 151 ensure: present 152 login: true 153 superuser: false 154 passwordSecret: 155 name: authentik 156 - name: ejabberd 157 ensure: present 158 login: true 159 superuser: false 160 passwordSecret: 161 name: ejabberd 162 - name: vaultwarden 163 ensure: present 164 login: true 165 superuser: false 166 passwordSecret: 167 name: vaultwarden 168 - name: mastodon 169 ensure: present 170 login: true 171 superuser: false 172 passwordSecret: 173 name: mastodon 174 - name: openproject 175 ensure: present 176 login: true 177 superuser: false 178 passwordSecret: 179 name: openproject 180 - name: plausible 181 ensure: present 182 login: true 183 superuser: false 184 passwordSecret: 185 name: plausible 186 - name: coder 187 ensure: present 188 login: true 189 superuser: false 190 passwordSecret: 191 name: coder 192 - name: matrix_auth 193 ensure: present 194 login: true 195 superuser: false 196 passwordSecret: 197 name: matrix-auth 198 - name: cachet 199 ensure: present 200 login: true 201 superuser: false 202 passwordSecret: 203 name: cachet 204 - name: docuseal 205 ensure: present 206 login: true 207 superuser: false 208 passwordSecret: 209 name: docuseal 210 - name: bugzilla 211 ensure: present 212 login: true 213 superuser: false 214 passwordSecret: 215 name: bugzilla 216 - name: rundeck 217 ensure: present 218 login: true 219 superuser: false 220 passwordSecret: 221 name: rundeck 222 - name: plane 223 ensure: present 224 login: true 225 superuser: false 226 passwordSecret: 227 name: plane 228 - name: gotosocial 229 ensure: present 230 login: true 231 superuser: false 232 passwordSecret: 233 name: gotosocial 234 - name: grafana-ro 235 ensure: present 236 login: true 237 superuser: false 238 passwordSecret: 239 name: grafana-ro 240 - name: mailman 241 ensure: present 242 login: true 243 superuser: false 244 passwordSecret: 245 name: mailman 246 - name: bookwyrm 247 ensure: present 248 login: true 249 superuser: false 250 passwordSecret: 251 name: bookwyrm 252 - name: concourse 253 ensure: present 254 login: true 255 superuser: false 256 passwordSecret: 257 name: concourse 258 - name: weblate 259 ensure: present 260 login: true 261 superuser: false 262 passwordSecret: 263 name: weblate 264 - name: sentry 265 ensure: present 266 login: true 267 superuser: false 268 passwordSecret: 269 name: sentry 270 - name: immich 271 ensure: present 272 login: true 273 superuser: false 274 passwordSecret: 275 name: immich 276 - name: convex 277 ensure: present 278 login: true 279 superuser: false 280 passwordSecret: 281 name: convex 282 - name: peertube 283 ensure: present 284 login: true 285 superuser: false 286 passwordSecret: 287 name: peertube 288 - name: persephone 289 ensure: present 290 login: true 291 superuser: false 292 passwordSecret: 293 name: persephone 294 - name: stalwart 295 ensure: present 296 login: true 297 superuser: false 298 passwordSecret: 299 name: stalwart 300 bootstrap: 301 recovery: 302 source: pg-s3-backup 303 recoveryTarget: 304 targetTime: "2026-02-27T20:58:00Z" 305 306 externalClusters: 307 - name: pg-s3-backup 308 plugin: 309 name: barman-cloud.cloudnative-pg.io 310 parameters: 311 barmanObjectName: hetzner-base-backup 312 serverName: pg-cluster-v2 313 314 storage: 315 storageClass: hcloud-volumes 316 size: 35Gi 317 --- 318 apiVersion: monitoring.coreos.com/v1 319 kind: PodMonitor 320 metadata: 321 name: pg-cluster-v2 322 namespace: postgres-cluster 323 spec: 324 selector: 325 matchLabels: 326 cnpg.io/cluster: pg-cluster-v2 327 podMetricsEndpoints: 328 - port: metrics 329 --- 330 apiVersion: postgresql.cnpg.io/v1 331 kind: ScheduledBackup 332 metadata: 333 name: hetzner-base-backup 334 namespace: postgres-cluster 335 spec: 336 schedule: 0 5 4 * * * 337 backupOwnerReference: self 338 immediate: true 339 target: prefer-standby 340 cluster: 341 name: pg-cluster-v2 342 method: plugin 343 pluginConfiguration: 344 name: barman-cloud.cloudnative-pg.io 345 --- 346 apiVersion: postgresql.cnpg.io/v1 347 kind: Database 348 metadata: 349 name: rundeck 350 namespace: postgres-cluster 351 spec: 352 name: rundeck 353 owner: rundeck 354 cluster: 355 name: pg-cluster-v2 356 --- 357 apiVersion: postgresql.cnpg.io/v1 358 kind: Database 359 metadata: 360 name: plane 361 namespace: postgres-cluster 362 spec: 363 name: plane 364 owner: plane 365 cluster: 366 name: pg-cluster-v2 367 --- 368 apiVersion: postgresql.cnpg.io/v1 369 kind: Database 370 metadata: 371 name: meowlnir 372 namespace: postgres-cluster 373 spec: 374 name: meowlnir 375 owner: meowlnir 376 cluster: 377 name: pg-cluster-v2 378 --- 379 apiVersion: postgresql.cnpg.io/v1 380 kind: Database 381 metadata: 382 name: connectivity-tester-stage 383 namespace: postgres-cluster 384 spec: 385 name: connectivity-tester-stage 386 owner: connectivity-tester-stage 387 cluster: 388 name: pg-cluster-v2 389 --- 390 apiVersion: postgresql.cnpg.io/v1 391 kind: Database 392 metadata: 393 name: connectivity-tester 394 namespace: postgres-cluster 395 spec: 396 name: connectivity-tester 397 owner: connectivity-tester 398 cluster: 399 name: pg-cluster-v2 400 --- 401 apiVersion: postgresql.cnpg.io/v1 402 kind: Database 403 metadata: 404 name: freshrss 405 namespace: postgres-cluster 406 spec: 407 name: freshrss 408 owner: freshrss 409 cluster: 410 name: pg-cluster-v2 411 --- 412 apiVersion: postgresql.cnpg.io/v1 413 kind: Database 414 metadata: 415 name: synapse 416 namespace: postgres-cluster 417 spec: 418 name: synapse 419 owner: synapse 420 ensure: absent 421 cluster: 422 name: pg-cluster-v2 423 --- 424 apiVersion: postgresql.cnpg.io/v1 425 kind: Database 426 metadata: 427 name: authentik 428 namespace: postgres-cluster 429 spec: 430 name: authentik 431 owner: authentik 432 ensure: present 433 cluster: 434 name: pg-cluster-v2 435 --- 436 apiVersion: postgresql.cnpg.io/v1 437 kind: Database 438 metadata: 439 name: draupnir-synapse 440 namespace: postgres-cluster 441 spec: 442 name: draupnir_synapse 443 owner: draupnir_synapse 444 ensure: present 445 cluster: 446 name: pg-cluster-v2 447 --- 448 apiVersion: postgresql.cnpg.io/v1 449 kind: Database 450 metadata: 451 name: d4all 452 namespace: postgres-cluster 453 spec: 454 name: d4all 455 owner: draupnir_synapse 456 ensure: present 457 cluster: 458 name: pg-cluster-v2 459 --- 460 apiVersion: postgresql.cnpg.io/v1 461 kind: Database 462 metadata: 463 name: vaultwarden 464 namespace: postgres-cluster 465 spec: 466 name: vaultwarden 467 owner: vaultwarden 468 ensure: present 469 cluster: 470 name: pg-cluster-v2 471 --- 472 apiVersion: postgresql.cnpg.io/v1 473 kind: Database 474 metadata: 475 name: gotosocial 476 namespace: postgres-cluster 477 spec: 478 name: gotosocial 479 owner: gotosocial 480 ensure: present 481 cluster: 482 name: pg-cluster-v2 483 --- 484 apiVersion: postgresql.cnpg.io/v1 485 kind: Database 486 metadata: 487 name: mailman 488 namespace: postgres-cluster 489 spec: 490 name: mailman 491 owner: mailman 492 ensure: present 493 cluster: 494 name: pg-cluster-v2 495 --- 496 apiVersion: postgresql.cnpg.io/v1 497 kind: Database 498 metadata: 499 name: plausible 500 namespace: postgres-cluster 501 spec: 502 name: plausible 503 owner: plausible 504 ensure: present 505 cluster: 506 name: pg-cluster-v2 507 --- 508 apiVersion: postgresql.cnpg.io/v1 509 kind: Database 510 metadata: 511 name: bookwyrm 512 namespace: postgres-cluster 513 spec: 514 name: bookwyrm 515 owner: bookwyrm 516 ensure: present 517 cluster: 518 name: pg-cluster-v2 519 --- 520 apiVersion: postgresql.cnpg.io/v1 521 kind: Database 522 metadata: 523 name: concourse 524 namespace: postgres-cluster 525 spec: 526 name: concourse 527 owner: concourse 528 ensure: present 529 cluster: 530 name: pg-cluster-v2 531 --- 532 apiVersion: postgresql.cnpg.io/v1 533 kind: Database 534 metadata: 535 name: weblate 536 namespace: postgres-cluster 537 spec: 538 name: weblate 539 owner: weblate 540 ensure: present 541 cluster: 542 name: pg-cluster-v2 543 --- 544 apiVersion: postgresql.cnpg.io/v1 545 kind: Database 546 metadata: 547 name: sentry 548 namespace: postgres-cluster 549 spec: 550 name: sentry 551 owner: sentry 552 ensure: present 553 cluster: 554 name: pg-cluster-v2 555 --- 556 apiVersion: postgresql.cnpg.io/v1 557 kind: Database 558 metadata: 559 name: immich 560 namespace: postgres-cluster 561 spec: 562 name: immich 563 owner: immich 564 ensure: present 565 cluster: 566 name: pg-cluster-v2 567 --- 568 apiVersion: postgresql.cnpg.io/v1 569 kind: Database 570 metadata: 571 name: convex 572 namespace: postgres-cluster 573 spec: 574 name: convex 575 owner: convex 576 ensure: present 577 cluster: 578 name: pg-cluster-v2 579 --- 580 apiVersion: postgresql.cnpg.io/v1 581 kind: Database 582 metadata: 583 name: peertube 584 namespace: postgres-cluster 585 spec: 586 name: peertube 587 owner: peertube 588 ensure: present 589 cluster: 590 name: pg-cluster-v2 591 --- 592 apiVersion: postgresql.cnpg.io/v1 593 kind: Database 594 metadata: 595 name: persephone 596 namespace: postgres-cluster 597 spec: 598 name: persephone 599 owner: persephone 600 ensure: present 601 cluster: 602 name: pg-cluster-v2 603 --- 604 apiVersion: postgresql.cnpg.io/v1 605 kind: Database 606 metadata: 607 name: stalwart 608 namespace: postgres-cluster 609 spec: 610 name: stalwart 611 owner: stalwart 612 ensure: present 613 cluster: 614 name: pg-cluster-v2