apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: login-postgres
  namespace: login
spec:
  # ── HA: 1 primary + 1 standby replica ────────────────────────────────────
  instances: 2

  # ── Storage: local-postgres class (fast local NVMe, no Longhorn overhead) ─
  storage:
    storageClass: local-postgres
    size: 8Gi

  # ── Spread replicas across Proxmox zones (pve-1 / pve-2) ─────────────────
  # Prevents both instances landing on the same physical host.
  # Zone labels: k8s-worker1=pve-1, k8s-worker2=pve-1,
  #              k8s-worker3=pve-2, k8s-worker4=pve-2
  affinity:
    enablePodAntiAffinity: true
    topologyKey: topology.kubernetes.io/zone

  # ── Bootstrap: create the keycloak database and owner role ───────────────
  bootstrap:
    initdb:
      database: keycloak
      owner: keycloak

  # WAL archival (barman-cloud → MinIO) intentionally omitted until BarmanObjectStore
  # CRD is confirmed present in this cluster. Add back via plugins block once verified.

  # ── PostgreSQL tuning for Keycloak workload ───────────────────────────────
  postgresql:
    parameters:
      max_connections: "200"
      shared_buffers: "256MB"
      work_mem: "8MB"
      maintenance_work_mem: "64MB"

  # ── Resources ─────────────────────────────────────────────────────────────
  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 512Mi
      cpu: 500m