k8s-starter-pack/apps/authentik/templates/postgresql.yaml

# Backups live outside the cluster so a Longhorn or cluster-wide failure does
# not remove both PostgreSQL and its recovery data. Credentials are produced by
# the encrypted SopsSecret in this chart.
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
  name: authentik-backups
  namespace: {{ .Release.Namespace }}
spec:
  retentionPolicy: 30d
  configuration:
    destinationPath: s3://ahmza-talos-cnpg-backups/authentik/
    endpointURL: https://s3.eu-central-003.backblazeb2.com
    s3Credentials:
      accessKeyId:
        name: backblaze-b2-credentials
        key: ACCESS_KEY_ID
      secretAccessKey:
        name: backblaze-b2-credentials
        key: ACCESS_SECRET_KEY
      region:
        name: backblaze-b2-credentials
        key: AWS_REGION
    wal:
      compression: gzip
      # Require Backblaze's S3-compatible SSE-B2 encryption rather than
      # relying only on the bucket's default encryption policy.
      encryption: AES256
      maxParallel: 2
    data:
      compression: gzip
      encryption: AES256
      jobs: 2
  # Backblaze implements the S3 API but does not require every optional AWS
  # checksum behavior. These settings avoid incompatible optional checksums.
  instanceSidecarConfiguration:
    env:
      - name: AWS_REQUEST_CHECKSUM_CALCULATION
        value: when_required
      - name: AWS_RESPONSE_CHECKSUM_VALIDATION
        value: when_required
---
# One PostgreSQL instance is enough initially: Longhorn replicates its volume
# across workers and can reattach it after a node failure. A second database
# instance can be added later if shorter failover time justifies another full
# copy of the data and WAL.
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: authentik-postgres
  namespace: {{ .Release.Namespace }}
  annotations:
    # Argo CD may update this database but must never delete it automatically
    # merely because a manifest or parent Application was removed from Git.
    argocd.argoproj.io/sync-options: Prune=false
spec:
  instances: 1
  imageName: >-
    ghcr.io/cloudnative-pg/postgresql:16.13-202603020816-standard-trixie

  bootstrap:
    initdb:
      database: authentik
      owner: authentik

  storage:
    # The default StorageClass is Longhorn. Omitting storageClass here keeps the
    # database on that established replicated storage path.
    size: 10Gi

  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: "2"
      memory: 2Gi

  plugins:
    - name: barman-cloud.cloudnative-pg.io
      # CloudNativePG defaults this to true. Keeping it explicit prevents Argo
      # CD from reporting harmless drift between Git and the live resource.
      enabled: true
      isWALArchiver: true
      parameters:
        barmanObjectName: authentik-backups
---
# CloudNativePG cron expressions have six fields; the leading zero is seconds.
# WAL is archived continuously, while this creates a full base backup nightly.
apiVersion: postgresql.cnpg.io/v1
kind: ScheduledBackup
metadata:
  name: authentik-postgres-daily
  namespace: {{ .Release.Namespace }}
spec:
  schedule: "0 0 2 * * *"
  immediate: false
  backupOwnerReference: self
  cluster:
    name: authentik-postgres
  method: plugin
  pluginConfiguration:
    name: barman-cloud.cloudnative-pg.io