version: 1 kind: postgres-host-cluster metadata: id: nc01-host-postgres description: NC01 host-native PostgreSQL 16 for local UniDesk/HWLAB/AgentRun runtime state owner: unidesk relatedIssues: - 1875 - 2250 - 2274 cluster: role: primary environment: node-local exposure: private-only haPhase: standalone node: id: NC01 route: NC01 mode: host-systemd osFamily: ubuntu requiredHostFacts: minCpu: 1 minMemoryGiB: 1 minDiskFreeGiB: 5 requireSwap: true swap: ensure: true size: 12GiB path: /swapfile postgres: package: manager: apt version: "16" repo: pgdg repoUrl: https://apt.postgresql.org/pub/repos/apt suite: trixie-pgdg component: main signingKeyUrl: https://www.postgresql.org/media/keys/ACCC4CF8.asc signedBy: /usr/share/keyrings/postgresql-pgdg.gpg sourceList: /etc/apt/sources.list.d/pgdg.list service: name: postgresql enabled: true state: running paths: dataDir: /var/lib/postgresql/16/main configDir: /etc/postgresql/16/main logDir: /var/log/postgresql network: port: 5432 listenAddresses: - 127.0.0.1 - 10.42.0.1 connectionHost: 10.42.0.1 publicDns: nc01-host-postgres.local transport: postgres-native-tls sslmode: require tls: enabled: true mode: self-signed-server-cert commonName: nc01-host-postgres certFile: /etc/postgresql/16/main/server.crt keyFile: /etc/postgresql/16/main/server.key futureClientSslmode: require firewall: mode: pg-hba-declared-sources defaultDeny: true allowSources: - id: nc01-local cidr: 127.0.0.1/32 purpose: local-admin - id: nc01-k3s-pods cidr: 10.42.0.0/16 purpose: node-local-k3s-workloads tuning: maxConnections: 100 sharedBuffers: 128MB effectiveCacheSize: 4GB workMem: 4MB maintenanceWorkMem: 64MB walCompression: false checkpointCompletionTarget: 0.9 auth: passwordEncryption: scram-sha-256 pgHba: - type: local database: all user: postgres method: peer - type: host database: all user: all address: 127.0.0.1/32 method: scram-sha-256 - type: hostssl database: agentrun_v02 user: agentrun_v02 address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: postgres user: agentrun_v02 address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: decision_center user: decision_center address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: postgres user: decision_center address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: web_probe_monitor user: web_probe_monitor address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: pikaoa user: pikaoa address: 10.42.0.0/16 method: scram-sha-256 - type: hostssl database: pikaoa_dev user: pikaoa_dev address: 10.42.0.0/16 method: scram-sha-256 secrets: source: master-local root: /root/.unidesk/.state/secrets entries: - name: agentrun-nc01-v02-db-credentials sourceRef: platform-db/agentrun-nc01-v02-db.env type: env requiredKeys: - AGENTRUN_NC01_V02_DB_USER - AGENTRUN_NC01_V02_DB_PASSWORD - AGENTRUN_NC01_V02_DB_NAME createIfMissing: enabled: true values: AGENTRUN_NC01_V02_DB_USER: agentrun_v02 AGENTRUN_NC01_V02_DB_NAME: agentrun_v02 randomHex: AGENTRUN_NC01_V02_DB_PASSWORD: 32 - name: decision-center-nc01-db-credentials sourceRef: decision-center/nc01-db.env type: env requiredKeys: - DECISION_CENTER_NC01_DB_USER - DECISION_CENTER_NC01_DB_PASSWORD - DECISION_CENTER_NC01_DB_NAME createIfMissing: enabled: true values: DECISION_CENTER_NC01_DB_USER: decision_center DECISION_CENTER_NC01_DB_NAME: decision_center randomHex: DECISION_CENTER_NC01_DB_PASSWORD: 32 - name: web-probe-monitor-nc01-db-credentials sourceRef: platform-db/web-probe-monitor-nc01-db.env type: env requiredKeys: - WEB_PROBE_MONITOR_NC01_DB_USER - WEB_PROBE_MONITOR_NC01_DB_PASSWORD - WEB_PROBE_MONITOR_NC01_DB_NAME createIfMissing: enabled: true values: WEB_PROBE_MONITOR_NC01_DB_USER: web_probe_monitor WEB_PROBE_MONITOR_NC01_DB_NAME: web_probe_monitor randomHex: WEB_PROBE_MONITOR_NC01_DB_PASSWORD: 32 - name: pikaoa-nc01-db-credentials sourceRef: platform-db/pikaoa-db.env type: env requiredKeys: - PIKAOA_DB_USER - PIKAOA_DB_PASSWORD - PIKAOA_DB_NAME createIfMissing: enabled: true values: PIKAOA_DB_USER: pikaoa PIKAOA_DB_NAME: pikaoa randomHex: PIKAOA_DB_PASSWORD: 32 - name: pikaoa-dev-nc01-db-credentials sourceRef: platform-db/pikaoa-dev-db.env type: env requiredKeys: - PIKAOA_DEV_DB_USER - PIKAOA_DEV_DB_PASSWORD - PIKAOA_DEV_DB_NAME createIfMissing: enabled: true values: PIKAOA_DEV_DB_USER: pikaoa_dev PIKAOA_DEV_DB_NAME: pikaoa_dev randomHex: PIKAOA_DEV_DB_PASSWORD: 32 objects: roles: - name: agentrun_v02 passwordRef: sourceRef: platform-db/agentrun-nc01-v02-db.env key: AGENTRUN_NC01_V02_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: decision_center passwordRef: sourceRef: decision-center/nc01-db.env key: DECISION_CENTER_NC01_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: web_probe_monitor passwordRef: sourceRef: platform-db/web-probe-monitor-nc01-db.env key: WEB_PROBE_MONITOR_NC01_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: pikaoa passwordRef: sourceRef: platform-db/pikaoa-db.env key: PIKAOA_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false - name: pikaoa_dev passwordRef: sourceRef: platform-db/pikaoa-dev-db.env key: PIKAOA_DEV_DB_PASSWORD login: true attributes: createdb: false createrole: false superuser: false databases: - name: agentrun_v02 owner: agentrun_v02 encoding: UTF8 locale: C.UTF-8 extensions: [] - name: decision_center owner: decision_center encoding: UTF8 locale: C.UTF-8 extensions: [] - name: web_probe_monitor owner: web_probe_monitor encoding: UTF8 locale: C.UTF-8 extensions: [] - name: pikaoa owner: pikaoa encoding: UTF8 locale: C.UTF-8 extensions: [] - name: pikaoa_dev owner: pikaoa_dev encoding: UTF8 locale: C.UTF-8 extensions: [] managedOperations: monitorReset: database: web_probe_monitor owner: web_probe_monitor schema: monitor secretRef: platform-db/web-probe-monitor-nc01-db.env exports: connectionStrings: - name: agentrun-nc01-v02-database-url sourceSecretRef: platform-db/agentrun-nc01-v02-db.env render: envKey: DATABASE_URL format: postgresql://$(AGENTRUN_NC01_V02_DB_USER):$(AGENTRUN_NC01_V02_DB_PASSWORD)@$(PGHOST):5432/$(AGENTRUN_NC01_V02_DB_NAME)?sslmode=require&uselibpqcompat=true variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: agentrun/nc01-v02-mgr-db.env key: DATABASE_URL mode: update-or-insert consumers: - scope: agentrun-v02 secret: agentrun-v02-mgr-db key: DATABASE_URL - name: decision-center-nc01-database-url sourceSecretRef: decision-center/nc01-db.env render: envKey: DATABASE_URL format: postgresql://$(DECISION_CENTER_NC01_DB_USER):$(DECISION_CENTER_NC01_DB_PASSWORD)@$(PGHOST):5432/$(DECISION_CENTER_NC01_DB_NAME)?sslmode=require&uselibpqcompat=true variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: decision-center/nc01-db.env key: DATABASE_URL mode: update-or-insert consumers: - scope: decision-center secret: decision-center-runtime-secrets key: DATABASE_URL - name: web-probe-monitor-nc01-database-url sourceSecretRef: platform-db/web-probe-monitor-nc01-db.env render: envKey: DATABASE_URL format: postgresql://$(WEB_PROBE_MONITOR_NC01_DB_USER):$(WEB_PROBE_MONITOR_NC01_DB_PASSWORD)@$(PGHOST):5432/$(WEB_PROBE_MONITOR_NC01_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: hwlab/web-probe-monitor-db.env key: DATABASE_URL mode: update-or-insert consumers: - scope: hwlab-web-probe-monitor secret: hwlab-web-probe-monitor-db key: DATABASE_URL - name: pikaoa-database-url sourceSecretRef: platform-db/pikaoa-db.env render: envKey: DATABASE_URL format: postgresql://$(PIKAOA_DB_USER):$(PIKAOA_DB_PASSWORD)@$(PGHOST):5432/$(PIKAOA_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: platform-infra/pikaoa.env key: DATABASE_URL mode: update-or-insert consumers: - scope: pikaoa secret: pikaoa-runtime key: DATABASE_URL - name: pikaoa-dev-database-url sourceSecretRef: platform-db/pikaoa-dev-db.env render: envKey: DATABASE_URL format: postgresql://$(PIKAOA_DEV_DB_USER):$(PIKAOA_DEV_DB_PASSWORD)@$(PGHOST):5432/$(PIKAOA_DEV_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: sourceRef: platform-infra/pikaoa-dev.env key: DATABASE_URL mode: update-or-insert consumers: - scope: pikaoa-dev secret: pikaoa-dev-runtime key: DATABASE_URL backup: logicalDumps: - enabled: false database: agentrun_v02 scriptPath: /usr/local/sbin/unidesk-nc01-agentrun-v02-pgdump.sh serviceName: unidesk-nc01-agentrun-v02-pgdump.service timerName: unidesk-nc01-agentrun-v02-pgdump.timer schedule: "*-*-* 03:37:00" retentionDays: 7 warningAfterHours: 36 destination: type: nc01-local path: /var/backups/unidesk/platform-db/nc01/agentrun-v02 pgDump: host: 127.0.0.1 format: custom encryption: enabled: false - enabled: true database: pikaoa scriptPath: /usr/local/sbin/unidesk-nc01-pikaoa-pgdump.sh serviceName: unidesk-nc01-pikaoa-pgdump.service timerName: unidesk-nc01-pikaoa-pgdump.timer schedule: "*-*-* 03:47:00" retentionDays: 14 warningAfterHours: 36 destination: type: nc01-local path: /var/backups/unidesk/platform-db/nc01/pikaoa pgDump: host: 127.0.0.1 format: custom encryption: enabled: false