Stage Authentik database and backups

2026-10-16 16:03:02 +00:00
parent 019039126a
commit f56c6719da
6 changed files with 203 additions and 0 deletions
@@ -0,0 +1,96 @@
+# Backups live outside the cluster so a Longhorn or cluster-wide failure does
+# not remove both PostgreSQL and its recovery data. Credentials are produced by
+# the encrypted SopsSecret in this chart.
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: authentik-backups
+  namespace: {{ .Release.Namespace }}
+spec:
+  retentionPolicy: 30d
+  configuration:
+    destinationPath: s3://ahmza-talos-cnpg-backups/authentik/
+    endpointURL: https://s3.eu-central-003.backblazeb2.com
+    s3Credentials:
+      accessKeyId:
+        name: backblaze-b2-credentials
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: backblaze-b2-credentials
+        key: ACCESS_SECRET_KEY
+      region:
+        name: backblaze-b2-credentials
+        key: AWS_REGION
+    wal:
+      compression: gzip
+      maxParallel: 2
+    data:
+      compression: gzip
+      jobs: 2
+  # Backblaze implements the S3 API but does not require every optional AWS
+  # checksum behavior. These settings avoid incompatible optional checksums.
+  instanceSidecarConfiguration:
+    env:
+      - name: AWS_REQUEST_CHECKSUM_CALCULATION
+        value: when_required
+      - name: AWS_RESPONSE_CHECKSUM_VALIDATION
+        value: when_required
+---
+# One PostgreSQL instance is enough initially: Longhorn replicates its volume
+# across workers and can reattach it after a node failure. A second database
+# instance can be added later if shorter failover time justifies another full
+# copy of the data and WAL.
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: authentik-postgres
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    # Argo CD may update this database but must never delete it automatically
+    # merely because a manifest or parent Application was removed from Git.
+    argocd.argoproj.io/sync-options: Prune=false
+spec:
+  instances: 1
+  imageName: >-
+    ghcr.io/cloudnative-pg/postgresql:16.13-202603020816-standard-trixie
+
+  bootstrap:
+    initdb:
+      database: authentik
+      owner: authentik
+
+  storage:
+    # The default StorageClass is Longhorn. Omitting storageClass here keeps the
+    # database on that established replicated storage path.
+    size: 10Gi
+
+  resources:
+    requests:
+      cpu: 250m
+      memory: 512Mi
+    limits:
+      cpu: "2"
+      memory: 2Gi
+
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: authentik-backups
+---
+# CloudNativePG cron expressions have six fields; the leading zero is seconds.
+# WAL is archived continuously, while this creates a full base backup nightly.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: authentik-postgres-daily
+  namespace: {{ .Release.Namespace }}
+spec:
+  schedule: "0 0 2 * * *"
+  immediate: false
+  backupOwnerReference: self
+  cluster:
+    name: authentik-postgres
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io