version: 1 kind: postgres-host-cluster metadata: id: nc01-host-postgres description: NC01 host-native PostgreSQL 16 for local UniDesk/HWLAB/AgentRun runtime state owner: unidesk relatedIssues: - 1875 - 2250 - 2274 - 2358 - 2380 cluster: role: primary environment: node-local exposure: private-only haPhase: standalone node: id: NC01 route: NC01 mode: host-systemd osFamily: ubuntu requiredHostFacts: minCpu: 1 minMemoryGiB: 1 minDiskFreeGiB: 5 requireSwap: true swap: ensure: true size: 64GiB path: /swapfile expansionPath: /swapfile-unidesk swappiness: 60 sysctlFile: /etc/sysctl.d/90-unidesk-swap.conf postgres: package: manager: apt version: "16" repo: pgdg repoUrl: https://apt.postgresql.org/pub/repos/apt suite: trixie-pgdg component: main signingKeyUrl: https://www.postgresql.org/media/keys/ACCC4CF8.asc signedBy: /usr/share/keyrings/postgresql-pgdg.gpg sourceList: /etc/apt/sources.list.d/pgdg.list service: name: postgresql enabled: true state: running paths: dataDir: /var/lib/postgresql/16/main configDir: /etc/postgresql/16/main logDir: /var/log/postgresql network: port: 5432 listenAddresses: - 127.0.0.1 - 10.42.0.1 connectionHost: 10.42.0.1 publicDns: nc01-host-postgres.local transport: postgres-native-tls sslmode: require tls: enabled: true mode: self-signed-server-cert commonName: nc01-host-postgres certFile: /etc/postgresql/16/main/server.crt keyFile: /etc/postgresql/16/main/server.key futureClientSslmode: require firewall: mode: pg-hba-declared-sources defaultDeny: true allowSources: - id: nc01-local cidr: 127.0.0.1/32 purpose: local-admin - id: nc01-k3s-pods cidr: 10.42.0.0/16 purpose: node-local-k3s-workloads tuning: maxConnections: 100 sharedBuffers: 128MB effectiveCacheSize: 4GB workMem: 4MB maintenanceWorkMem: 64MB walCompression: false checkpointCompletionTarget: 0.9 auth: passwordEncryption: scram-sha-256 pgHba: - type: local database: all user: postgres method: peer - type: host database: all user: all address: 127.0.0.1/32 method: scram-sha-256 - type: hostssl database: agentrun_v02 user: agentrun_v02 address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: postgres user: agentrun_v02 address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: decision_center user: decision_center address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: postgres user: decision_center address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: web_probe_monitor user: web_probe_monitor address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: superapi user: superapi address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: superapi_development user: superapi_development address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: pikaoa user: pikaoa address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: pikaoa_dev user: pikaoa_dev address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: temporal user: temporal address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: temporal_visibility user: temporal address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: tasktree user: tasktree address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: tasktree_production user: tasktree_production address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: hwlab_nc01_v03 user: hwlab_nc01_v03_app address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: hwlab_nc01_production user: hwlab_nc01_production_app address: 10.42.0.0/16 method: scram-sha-256 secrets: source: master-local root: /root/.unidesk/.state/secrets entries: - name: agentrun-nc01-v02-db-credentials sourceRef: platform-db/agentrun-nc01-v02-db.env type: env requiredKeys: - AGENTRUN_NC01_V02_DB_USER - AGENTRUN_NC01_V02_DB_PASSWORD - AGENTRUN_NC01_V02_DB_NAME createIfMissing: enabled: true values: AGENTRUN_NC01_V02_DB_USER: agentrun_v02 AGENTRUN_NC01_V02_DB_NAME: agentrun_v02 randomHex: AGENTRUN_NC01_V02_DB_PASSWORD: 32 - name: decision-center-nc01-db-credentials sourceRef: decision-center/nc01-db.env type: env requiredKeys: - DECISION_CENTER_NC01_DB_USER - DECISION_CENTER_NC01_DB_PASSWORD - DECISION_CENTER_NC01_DB_NAME createIfMissing: enabled: true values: DECISION_CENTER_NC01_DB_USER: decision_center DECISION_CENTER_NC01_DB_NAME: decision_center randomHex: DECISION_CENTER_NC01_DB_PASSWORD: 32 - name: web-probe-monitor-nc01-db-credentials sourceRef: platform-db/web-probe-monitor-nc01-db.env type: env requiredKeys: - WEB_PROBE_MONITOR_NC01_DB_USER - WEB_PROBE_MONITOR_NC01_DB_PASSWORD - WEB_PROBE_MONITOR_NC01_DB_NAME createIfMissing: enabled: true values: WEB_PROBE_MONITOR_NC01_DB_USER: web_probe_monitor WEB_PROBE_MONITOR_NC01_DB_NAME: web_probe_monitor randomHex: WEB_PROBE_MONITOR_NC01_DB_PASSWORD: 32 - name: superapi-nc01-db-credentials sourceRef: platform-db/superapi-nc01-db.env type: env requiredKeys: - SUPERAPI_DB_USER - SUPERAPI_DB_PASSWORD - SUPERAPI_DB_NAME createIfMissing: enabled: true values: SUPERAPI_DB_USER: superapi SUPERAPI_DB_NAME: superapi randomHex: SUPERAPI_DB_PASSWORD: 32 - name: superapi-development-nc01-db-credentials sourceRef: platform-db/superapi-development-nc01-db.env type: env requiredKeys: - SUPERAPI_DEVELOPMENT_DB_USER - SUPERAPI_DEVELOPMENT_DB_PASSWORD - SUPERAPI_DEVELOPMENT_DB_NAME createIfMissing: enabled: true values: SUPERAPI_DEVELOPMENT_DB_USER: superapi_development SUPERAPI_DEVELOPMENT_DB_NAME: superapi_development randomHex: SUPERAPI_DEVELOPMENT_DB_PASSWORD: 32 - name: pikaoa-nc01-db-credentials sourceRef: platform-db/pikaoa-db.env type: env requiredKeys: - PIKAOA_DB_USER - PIKAOA_DB_PASSWORD - PIKAOA_DB_NAME createIfMissing: enabled: true values: PIKAOA_DB_USER: pikaoa PIKAOA_DB_NAME: pikaoa randomHex: PIKAOA_DB_PASSWORD: 32 - name: pikaoa-dev-nc01-db-credentials sourceRef: platform-db/pikaoa-dev-db.env type: env requiredKeys: - PIKAOA_DEV_DB_USER - PIKAOA_DEV_DB_PASSWORD - PIKAOA_DEV_DB_NAME createIfMissing: enabled: true values: PIKAOA_DEV_DB_USER: pikaoa_dev PIKAOA_DEV_DB_NAME: pikaoa_dev randomHex: PIKAOA_DEV_DB_PASSWORD: 32 - name: temporal-nc01-db-credentials sourceRef: platform-db/temporal-nc01-db.env type: env requiredKeys: - TEMPORAL_DB_USER - TEMPORAL_DB_PASSWORD - TEMPORAL_DB_NAME - TEMPORAL_VISIBILITY_DB_NAME createIfMissing: enabled: true values: TEMPORAL_DB_USER: temporal TEMPORAL_DB_NAME: temporal TEMPORAL_VISIBILITY_DB_NAME: temporal_visibility randomHex: TEMPORAL_DB_PASSWORD: 32 - name: tasktree-nc01-db-credentials sourceRef: platform-db/tasktree-nc01-db.env type: env requiredKeys: - TASKTREE_DB_USER - TASKTREE_DB_PASSWORD - TASKTREE_DB_NAME createIfMissing: enabled: true values: TASKTREE_DB_USER: tasktree TASKTREE_DB_NAME: tasktree randomHex: TASKTREE_DB_PASSWORD: 32 - name: tasktree-production-nc01-db-credentials sourceRef: platform-db/tasktree-production-nc01-db.env type: env requiredKeys: - TASKTREE_PRODUCTION_DB_USER - TASKTREE_PRODUCTION_DB_PASSWORD - TASKTREE_PRODUCTION_DB_NAME createIfMissing: enabled: true values: TASKTREE_PRODUCTION_DB_USER: tasktree_production TASKTREE_PRODUCTION_DB_NAME: tasktree_production randomHex: TASKTREE_PRODUCTION_DB_PASSWORD: 32 - name: hwlab-nc01-v03-db-credentials sourceRef: platform-db/hwlab-nc01-v03-db.env type: env requiredKeys: - HWLAB_NC01_V03_DB_USER - HWLAB_NC01_V03_DB_PASSWORD - HWLAB_NC01_V03_DB_NAME createIfMissing: enabled: true values: HWLAB_NC01_V03_DB_USER: hwlab_nc01_v03_app HWLAB_NC01_V03_DB_NAME: hwlab_nc01_v03 randomHex: HWLAB_NC01_V03_DB_PASSWORD: 32 - name: hwlab-nc01-production-db-credentials sourceRef: platform-db/hwlab-nc01-production-db.env type: env requiredKeys: - HWLAB_NC01_PRODUCTION_DB_USER - HWLAB_NC01_PRODUCTION_DB_PASSWORD - HWLAB_NC01_PRODUCTION_DB_NAME createIfMissing: enabled: true values: HWLAB_NC01_PRODUCTION_DB_USER: hwlab_nc01_production_app HWLAB_NC01_PRODUCTION_DB_NAME: hwlab_nc01_production randomHex: HWLAB_NC01_PRODUCTION_DB_PASSWORD: 32 objects: roles: - name: agentrun_v02 passwordRef: sourceRef: platform-db/agentrun-nc01-v02-db.env key: AGENTRUN_NC01_V02_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: decision_center passwordRef: sourceRef: decision-center/nc01-db.env key: DECISION_CENTER_NC01_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: web_probe_monitor passwordRef: sourceRef: platform-db/web-probe-monitor-nc01-db.env key: WEB_PROBE_MONITOR_NC01_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: superapi passwordRef: sourceRef: platform-db/superapi-nc01-db.env key: SUPERAPI_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: superapi_development passwordRef: sourceRef: platform-db/superapi-development-nc01-db.env key: SUPERAPI_DEVELOPMENT_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: pikaoa passwordRef: sourceRef: platform-db/pikaoa-db.env key: PIKAOA_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: pikaoa_dev passwordRef: sourceRef: platform-db/pikaoa-dev-db.env key: PIKAOA_DEV_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: temporal passwordRef: sourceRef: platform-db/temporal-nc01-db.env key: TEMPORAL_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: tasktree passwordRef: sourceRef: platform-db/tasktree-nc01-db.env key: TASKTREE_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: tasktree_production passwordRef: sourceRef: platform-db/tasktree-production-nc01-db.env key: TASKTREE_PRODUCTION_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: hwlab_nc01_v03_app passwordRef: sourceRef: platform-db/hwlab-nc01-v03-db.env key: HWLAB_NC01_V03_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: hwlab_nc01_production_app passwordRef: sourceRef: platform-db/hwlab-nc01-production-db.env key: HWLAB_NC01_PRODUCTION_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false databases: - name: agentrun_v02 owner: agentrun_v02 encoding: UTF8 locale: C.UTF-8 extensions: [] - name: decision_center owner: decision_center encoding: UTF8 locale: C.UTF-8 extensions: [] - name: web_probe_monitor owner: web_probe_monitor encoding: UTF8 locale: C.UTF-8 extensions: [] - name: superapi owner: superapi encoding: UTF8 locale: C.UTF-8 extensions: [] - name: superapi_development owner: superapi_development encoding: UTF8 locale: C.UTF-8 extensions: [] - name: pikaoa owner: pikaoa encoding: UTF8 locale: C.UTF-8 extensions: [] - name: pikaoa_dev owner: pikaoa_dev encoding: UTF8 locale: C.UTF-8 extensions: [] - name: temporal owner: temporal encoding: UTF8 locale: C.UTF-8 extensions: [] - name: temporal_visibility owner: temporal encoding: UTF8 locale: C.UTF-8 extensions: [] - name: tasktree owner: tasktree encoding: UTF8 locale: C.UTF-8 extensions: [] - name: tasktree_production owner: tasktree_production encoding: UTF8 locale: C.UTF-8 extensions: [] - name: hwlab_nc01_v03 owner: hwlab_nc01_v03_app encoding: UTF8 locale: C.UTF-8 extensions: [] - name: hwlab_nc01_production owner: hwlab_nc01_production_app encoding: UTF8 locale: C.UTF-8 extensions: [] managedOperations: monitorReset: database: web_probe_monitor owner: web_probe_monitor schema: monitor secretRef: platform-db/web-probe-monitor-nc01-db.env exports: connectionStrings: - name: agentrun-nc01-v02-database-url sourceSecretRef: platform-db/agentrun-nc01-v02-db.env render: envKey: DATABASE_URL format: postgresql://$(AGENTRUN_NC01_V02_DB_USER):$(AGENTRUN_NC01_V02_DB_PASSWORD)@$(PGHOST):5432/$(AGENTRUN_NC01_V02_DB_NAME)?sslmode=require&uselibpqcompat=true variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: agentrun/nc01-v02-mgr-db.env key: DATABASE_URL mode: update-or-insert consumers: - scope: agentrun-v02 secret: agentrun-v02-mgr-db key: DATABASE_URL - name: decision-center-nc01-database-url sourceSecretRef: decision-center/nc01-db.env render: envKey: DATABASE_URL format: postgresql://$(DECISION_CENTER_NC01_DB_USER):$(DECISION_CENTER_NC01_DB_PASSWORD)@$(PGHOST):5432/$(DECISION_CENTER_NC01_DB_NAME)?sslmode=require&uselibpqcompat=true variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: decision-center/nc01-db.env key: DATABASE_URL mode: update-or-insert consumers: - scope: decision-center secret: decision-center-runtime-secrets key: DATABASE_URL - name: web-probe-monitor-nc01-database-url sourceSecretRef: platform-db/web-probe-monitor-nc01-db.env render: envKey: DATABASE_URL format: postgresql://$(WEB_PROBE_MONITOR_NC01_DB_USER):$(WEB_PROBE_MONITOR_NC01_DB_PASSWORD)@$(PGHOST):5432/$(WEB_PROBE_MONITOR_NC01_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: hwlab/web-probe-monitor-db.env key: DATABASE_URL mode: update-or-insert consumers: - scope: hwlab-web-probe-monitor secret: hwlab-web-probe-monitor-db key: DATABASE_URL - name: superapi-nc01-database-url sourceSecretRef: platform-db/superapi-nc01-db.env render: envKey: DATABASE_URL format: postgresql://$(SUPERAPI_DB_USER):$(SUPERAPI_DB_PASSWORD)@$(PGHOST):5432/$(SUPERAPI_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: platform-infra/superapi.env key: DATABASE_URL mode: update-or-insert consumers: - scope: superapi-production secret: superapi-production-runtime key: DATABASE_URL - name: superapi-development-nc01-database-url sourceSecretRef: platform-db/superapi-development-nc01-db.env render: envKey: DATABASE_URL format: postgresql://$(SUPERAPI_DEVELOPMENT_DB_USER):$(SUPERAPI_DEVELOPMENT_DB_PASSWORD)@$(PGHOST):5432/$(SUPERAPI_DEVELOPMENT_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: platform-infra/superapi-development.env key: DATABASE_URL mode: update-or-insert consumers: - scope: superapi-development secret: superapi-development-runtime key: DATABASE_URL - name: pikaoa-database-url sourceSecretRef: platform-db/pikaoa-db.env render: envKey: DATABASE_URL format: postgresql://$(PIKAOA_DB_USER):$(PIKAOA_DB_PASSWORD)@$(PGHOST):5432/$(PIKAOA_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: platform-infra/pikaoa.env key: DATABASE_URL mode: update-or-insert consumers: - scope: pikaoa secret: pikaoa-runtime key: DATABASE_URL - name: pikaoa-dev-database-url sourceSecretRef: platform-db/pikaoa-dev-db.env render: envKey: DATABASE_URL format: postgresql://$(PIKAOA_DEV_DB_USER):$(PIKAOA_DEV_DB_PASSWORD)@$(PGHOST):5432/$(PIKAOA_DEV_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: platform-infra/pikaoa-dev.env key: DATABASE_URL mode: update-or-insert consumers: - scope: pikaoa-dev secret: pikaoa-dev-runtime key: DATABASE_URL - name: tasktree-nc01-database-url sourceSecretRef: platform-db/tasktree-nc01-db.env render: envKey: DATABASE_URL format: postgresql://$(TASKTREE_DB_USER):$(TASKTREE_DB_PASSWORD)@$(PGHOST):5432/$(TASKTREE_DB_NAME)?sslmode=require&uselibpqcompat=true variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: hwlab/tasktree-nc01-db.env key: DATABASE_URL mode: update-or-insert consumers: - scope: hwlab-v03 secret: hwlab-tasktree-db key: DATABASE_URL - name: tasktree-production-nc01-database-url sourceSecretRef: platform-db/tasktree-production-nc01-db.env render: envKey: DATABASE_URL format: postgresql://$(TASKTREE_PRODUCTION_DB_USER):$(TASKTREE_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(TASKTREE_PRODUCTION_DB_NAME)?sslmode=require&uselibpqcompat=true variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: hwlab/tasktree-production-nc01-db.env key: DATABASE_URL mode: update-or-insert consumers: - scope: hwlab-production secret: hwlab-tasktree-db key: DATABASE_URL - name: hwlab-nc01-v03-cloud-api-database-url sourceSecretRef: platform-db/hwlab-nc01-v03-db.env render: envKey: DATABASE_URL format: postgresql://$(HWLAB_NC01_V03_DB_USER):$(HWLAB_NC01_V03_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_V03_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: hwlab/nc01-v03-cloud-api-db.env key: DATABASE_URL mode: update-or-insert consumers: - scope: hwlab-v03 secret: hwlab-cloud-api-v03-db key: DATABASE_URL - name: hwlab-nc01-v03-openfga-datastore-uri sourceSecretRef: platform-db/hwlab-nc01-v03-db.env render: envKey: DATASTORE_URI format: postgres://$(HWLAB_NC01_V03_DB_USER):$(HWLAB_NC01_V03_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_V03_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: hwlab/nc01-v03-openfga-db.env key: DATASTORE_URI mode: update-or-insert consumers: - scope: hwlab-v03 secret: hwlab-v03-openfga key: DATASTORE_URI - name: hwlab-nc01-production-cloud-api-database-url sourceSecretRef: platform-db/hwlab-nc01-production-db.env render: envKey: DATABASE_URL format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: hwlab/nc01-production-cloud-api-db.env key: DATABASE_URL mode: update-or-insert consumers: - scope: hwlab-production secret: hwlab-cloud-api-production-db key: DATABASE_URL - name: hwlab-nc01-production-migration-database-url sourceSecretRef: platform-db/hwlab-nc01-production-db.env render: envKey: MIGRATION_DATABASE_URL format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require&uselibpqcompat=true variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: hwlab/nc01-production-cloud-api-db.env key: MIGRATION_DATABASE_URL mode: update-or-insert consumers: - scope: hwlab-production secret: hwlab-cloud-api-production-db key: MIGRATION_DATABASE_URL - name: hwlab-nc01-production-openfga-datastore-uri sourceSecretRef: platform-db/hwlab-nc01-production-db.env render: envKey: DATASTORE_URI format: postgres://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: hwlab/nc01-production-openfga-db.env key: DATASTORE_URI mode: update-or-insert consumers: - scope: hwlab-production secret: hwlab-production-openfga key: DATASTORE_URI backup: logicalDumps: - enabled: false database: agentrun_v02 scriptPath: /usr/local/sbin/unidesk-nc01-agentrun-v02-pgdump.sh serviceName: unidesk-nc01-agentrun-v02-pgdump.service timerName: unidesk-nc01-agentrun-v02-pgdump.timer schedule: "*-*-* 03:37:00" retentionDays: 7 warningAfterHours: 36 destination: type: nc01-local path: /var/backups/unidesk/platform-db/nc01/agentrun-v02 pgDump: host: 127.0.0.1 format: custom encryption: enabled: false - enabled: true database: pikaoa scriptPath: /usr/local/sbin/unidesk-nc01-pikaoa-pgdump.sh serviceName: unidesk-nc01-pikaoa-pgdump.service timerName: unidesk-nc01-pikaoa-pgdump.timer schedule: "*-*-* 03:47:00" retentionDays: 14 warningAfterHours: 36 destination: type: nc01-local path: /var/backups/unidesk/platform-db/nc01/pikaoa pgDump: host: 127.0.0.1 format: custom encryption: enabled: false