pikasTech-unidesk/config/platform-db/postgres-nc01.yaml

version: 1
kind: postgres-host-cluster

metadata:
  id: nc01-host-postgres
  description: NC01 host-native PostgreSQL 16 for local UniDesk/HWLAB/AgentRun runtime state
  owner: unidesk
  relatedIssues:
    - 1875
    - 2250
    - 2274
    - 2358
    - 2380

cluster:
  role: primary
  environment: node-local
  exposure: private-only
  haPhase: standalone

node:
  id: NC01
  route: NC01
  mode: host-systemd
  osFamily: ubuntu
  requiredHostFacts:
    minCpu: 1
    minMemoryGiB: 1
    minDiskFreeGiB: 5
    requireSwap: true
  swap:
    ensure: true
    size: 64GiB
    path: /swapfile
    expansionPath: /swapfile-unidesk
    swappiness: 60
    sysctlFile: /etc/sysctl.d/90-unidesk-swap.conf

postgres:
  package:
    manager: apt
    version: "16"
    repo: pgdg
    repoUrl: https://apt.postgresql.org/pub/repos/apt
    suite: trixie-pgdg
    component: main
    signingKeyUrl: https://www.postgresql.org/media/keys/ACCC4CF8.asc
    signedBy: /usr/share/keyrings/postgresql-pgdg.gpg
    sourceList: /etc/apt/sources.list.d/pgdg.list
  service:
    name: postgresql
    enabled: true
    state: running
  paths:
    dataDir: /var/lib/postgresql/16/main
    configDir: /etc/postgresql/16/main
    logDir: /var/log/postgresql
  network:
    port: 5432
    listenAddresses:
      - 127.0.0.1
      - 10.42.0.1
    connectionHost: 10.42.0.1
    publicDns: nc01-host-postgres.local
    transport: postgres-native-tls
    sslmode: require
    tls:
      enabled: true
      mode: self-signed-server-cert
      commonName: nc01-host-postgres
      certFile: /etc/postgresql/16/main/server.crt
      keyFile: /etc/postgresql/16/main/server.key
      futureClientSslmode: require
    firewall:
      mode: pg-hba-declared-sources
      defaultDeny: true
      allowSources:
        - id: nc01-local
          cidr: 127.0.0.1/32
          purpose: local-admin
        - id: nc01-k3s-pods
          cidr: 10.42.0.0/16
          purpose: node-local-k3s-workloads
  tuning:
    maxConnections: 100
    sharedBuffers: 128MB
    effectiveCacheSize: 4GB
    workMem: 4MB
    maintenanceWorkMem: 64MB
    walCompression: false
    checkpointCompletionTarget: 0.9
  auth:
    passwordEncryption: scram-sha-256
    pgHba:
      - type: local
        database: all
        user: postgres
        method: peer
      - type: host
        database: all
        user: all
        address: 127.0.0.1/32
        method: scram-sha-256
      - type: hostssl
        database: agentrun_v02
        user: agentrun_v02
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: postgres
        user: agentrun_v02
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: decision_center
        user: decision_center
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: postgres
        user: decision_center
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: web_probe_monitor
        user: web_probe_monitor
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: superapi
        user: superapi
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: superapi_development
        user: superapi_development
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: pikaoa
        user: pikaoa
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: pikaoa_dev
        user: pikaoa_dev
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: temporal
        user: temporal
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: temporal_visibility
        user: temporal
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: tasktree
        user: tasktree
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: tasktree_production
        user: tasktree_production
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: hwlab_nc01_v03
        user: hwlab_nc01_v03_app
        address: 10.42.0.0/16
        method: scram-sha-256
      - type: hostssl
        database: hwlab_nc01_production
        user: hwlab_nc01_production_app
        address: 10.42.0.0/16
        method: scram-sha-256

secrets:
  source: master-local
  root: /root/.unidesk/.state/secrets
  entries:
    - name: agentrun-nc01-v02-db-credentials
      sourceRef: platform-db/agentrun-nc01-v02-db.env
      type: env
      requiredKeys:
        - AGENTRUN_NC01_V02_DB_USER
        - AGENTRUN_NC01_V02_DB_PASSWORD
        - AGENTRUN_NC01_V02_DB_NAME
      createIfMissing:
        enabled: true
        values:
          AGENTRUN_NC01_V02_DB_USER: agentrun_v02
          AGENTRUN_NC01_V02_DB_NAME: agentrun_v02
        randomHex:
          AGENTRUN_NC01_V02_DB_PASSWORD: 32
    - name: decision-center-nc01-db-credentials
      sourceRef: decision-center/nc01-db.env
      type: env
      requiredKeys:
        - DECISION_CENTER_NC01_DB_USER
        - DECISION_CENTER_NC01_DB_PASSWORD
        - DECISION_CENTER_NC01_DB_NAME
      createIfMissing:
        enabled: true
        values:
          DECISION_CENTER_NC01_DB_USER: decision_center
          DECISION_CENTER_NC01_DB_NAME: decision_center
        randomHex:
          DECISION_CENTER_NC01_DB_PASSWORD: 32
    - name: web-probe-monitor-nc01-db-credentials
      sourceRef: platform-db/web-probe-monitor-nc01-db.env
      type: env
      requiredKeys:
        - WEB_PROBE_MONITOR_NC01_DB_USER
        - WEB_PROBE_MONITOR_NC01_DB_PASSWORD
        - WEB_PROBE_MONITOR_NC01_DB_NAME
      createIfMissing:
        enabled: true
        values:
          WEB_PROBE_MONITOR_NC01_DB_USER: web_probe_monitor
          WEB_PROBE_MONITOR_NC01_DB_NAME: web_probe_monitor
        randomHex:
          WEB_PROBE_MONITOR_NC01_DB_PASSWORD: 32
    - name: superapi-nc01-db-credentials
      sourceRef: platform-db/superapi-nc01-db.env
      type: env
      requiredKeys:
        - SUPERAPI_DB_USER
        - SUPERAPI_DB_PASSWORD
        - SUPERAPI_DB_NAME
      createIfMissing:
        enabled: true
        values:
          SUPERAPI_DB_USER: superapi
          SUPERAPI_DB_NAME: superapi
        randomHex:
          SUPERAPI_DB_PASSWORD: 32
    - name: superapi-development-nc01-db-credentials
      sourceRef: platform-db/superapi-development-nc01-db.env
      type: env
      requiredKeys:
        - SUPERAPI_DEVELOPMENT_DB_USER
        - SUPERAPI_DEVELOPMENT_DB_PASSWORD
        - SUPERAPI_DEVELOPMENT_DB_NAME
      createIfMissing:
        enabled: true
        values:
          SUPERAPI_DEVELOPMENT_DB_USER: superapi_development
          SUPERAPI_DEVELOPMENT_DB_NAME: superapi_development
        randomHex:
          SUPERAPI_DEVELOPMENT_DB_PASSWORD: 32
    - name: pikaoa-nc01-db-credentials
      sourceRef: platform-db/pikaoa-db.env
      type: env
      requiredKeys:
        - PIKAOA_DB_USER
        - PIKAOA_DB_PASSWORD
        - PIKAOA_DB_NAME
      createIfMissing:
        enabled: true
        values:
          PIKAOA_DB_USER: pikaoa
          PIKAOA_DB_NAME: pikaoa
        randomHex:
          PIKAOA_DB_PASSWORD: 32
    - name: pikaoa-dev-nc01-db-credentials
      sourceRef: platform-db/pikaoa-dev-db.env
      type: env
      requiredKeys:
        - PIKAOA_DEV_DB_USER
        - PIKAOA_DEV_DB_PASSWORD
        - PIKAOA_DEV_DB_NAME
      createIfMissing:
        enabled: true
        values:
          PIKAOA_DEV_DB_USER: pikaoa_dev
          PIKAOA_DEV_DB_NAME: pikaoa_dev
        randomHex:
          PIKAOA_DEV_DB_PASSWORD: 32
    - name: temporal-nc01-db-credentials
      sourceRef: platform-db/temporal-nc01-db.env
      type: env
      requiredKeys:
        - TEMPORAL_DB_USER
        - TEMPORAL_DB_PASSWORD
        - TEMPORAL_DB_NAME
        - TEMPORAL_VISIBILITY_DB_NAME
      createIfMissing:
        enabled: true
        values:
          TEMPORAL_DB_USER: temporal
          TEMPORAL_DB_NAME: temporal
          TEMPORAL_VISIBILITY_DB_NAME: temporal_visibility
        randomHex:
          TEMPORAL_DB_PASSWORD: 32
    - name: tasktree-nc01-db-credentials
      sourceRef: platform-db/tasktree-nc01-db.env
      type: env
      requiredKeys:
        - TASKTREE_DB_USER
        - TASKTREE_DB_PASSWORD
        - TASKTREE_DB_NAME
      createIfMissing:
        enabled: true
        values:
          TASKTREE_DB_USER: tasktree
          TASKTREE_DB_NAME: tasktree
        randomHex:
          TASKTREE_DB_PASSWORD: 32
    - name: tasktree-production-nc01-db-credentials
      sourceRef: platform-db/tasktree-production-nc01-db.env
      type: env
      requiredKeys:
        - TASKTREE_PRODUCTION_DB_USER
        - TASKTREE_PRODUCTION_DB_PASSWORD
        - TASKTREE_PRODUCTION_DB_NAME
      createIfMissing:
        enabled: true
        values:
          TASKTREE_PRODUCTION_DB_USER: tasktree_production
          TASKTREE_PRODUCTION_DB_NAME: tasktree_production
        randomHex:
          TASKTREE_PRODUCTION_DB_PASSWORD: 32
    - name: hwlab-nc01-v03-db-credentials
      sourceRef: platform-db/hwlab-nc01-v03-db.env
      type: env
      requiredKeys:
        - HWLAB_NC01_V03_DB_USER
        - HWLAB_NC01_V03_DB_PASSWORD
        - HWLAB_NC01_V03_DB_NAME
      createIfMissing:
        enabled: true
        values:
          HWLAB_NC01_V03_DB_USER: hwlab_nc01_v03_app
          HWLAB_NC01_V03_DB_NAME: hwlab_nc01_v03
        randomHex:
          HWLAB_NC01_V03_DB_PASSWORD: 32
    - name: hwlab-nc01-production-db-credentials
      sourceRef: platform-db/hwlab-nc01-production-db.env
      type: env
      requiredKeys:
        - HWLAB_NC01_PRODUCTION_DB_USER
        - HWLAB_NC01_PRODUCTION_DB_PASSWORD
        - HWLAB_NC01_PRODUCTION_DB_NAME
      createIfMissing:
        enabled: true
        values:
          HWLAB_NC01_PRODUCTION_DB_USER: hwlab_nc01_production_app
          HWLAB_NC01_PRODUCTION_DB_NAME: hwlab_nc01_production
        randomHex:
          HWLAB_NC01_PRODUCTION_DB_PASSWORD: 32

objects:
  roles:
    - name: agentrun_v02
      passwordRef:
        sourceRef: platform-db/agentrun-nc01-v02-db.env
        key: AGENTRUN_NC01_V02_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: decision_center
      passwordRef:
        sourceRef: decision-center/nc01-db.env
        key: DECISION_CENTER_NC01_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: web_probe_monitor
      passwordRef:
        sourceRef: platform-db/web-probe-monitor-nc01-db.env
        key: WEB_PROBE_MONITOR_NC01_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: superapi
      passwordRef:
        sourceRef: platform-db/superapi-nc01-db.env
        key: SUPERAPI_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: superapi_development
      passwordRef:
        sourceRef: platform-db/superapi-development-nc01-db.env
        key: SUPERAPI_DEVELOPMENT_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: pikaoa
      passwordRef:
        sourceRef: platform-db/pikaoa-db.env
        key: PIKAOA_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: pikaoa_dev
      passwordRef:
        sourceRef: platform-db/pikaoa-dev-db.env
        key: PIKAOA_DEV_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: temporal
      passwordRef:
        sourceRef: platform-db/temporal-nc01-db.env
        key: TEMPORAL_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: tasktree
      passwordRef:
        sourceRef: platform-db/tasktree-nc01-db.env
        key: TASKTREE_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: tasktree_production
      passwordRef:
        sourceRef: platform-db/tasktree-production-nc01-db.env
        key: TASKTREE_PRODUCTION_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: hwlab_nc01_v03_app
      passwordRef:
        sourceRef: platform-db/hwlab-nc01-v03-db.env
        key: HWLAB_NC01_V03_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
    - name: hwlab_nc01_production_app
      passwordRef:
        sourceRef: platform-db/hwlab-nc01-production-db.env
        key: HWLAB_NC01_PRODUCTION_DB_PASSWORD
      login: true
      attributes:
        createdb: false
        createrole: false
        superuser: false
  databases:
    - name: agentrun_v02
      owner: agentrun_v02
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: decision_center
      owner: decision_center
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: web_probe_monitor
      owner: web_probe_monitor
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: superapi
      owner: superapi
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: superapi_development
      owner: superapi_development
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: pikaoa
      owner: pikaoa
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: pikaoa_dev
      owner: pikaoa_dev
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: temporal
      owner: temporal
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: temporal_visibility
      owner: temporal
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: tasktree
      owner: tasktree
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: tasktree_production
      owner: tasktree_production
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: hwlab_nc01_v03
      owner: hwlab_nc01_v03_app
      encoding: UTF8
      locale: C.UTF-8
      extensions: []
    - name: hwlab_nc01_production
      owner: hwlab_nc01_production_app
      encoding: UTF8
      locale: C.UTF-8
      extensions: []

managedOperations:
  monitorReset:
    database: web_probe_monitor
    owner: web_probe_monitor
    schema: monitor
    secretRef: platform-db/web-probe-monitor-nc01-db.env

exports:
  connectionStrings:
    - name: agentrun-nc01-v02-database-url
      sourceSecretRef: platform-db/agentrun-nc01-v02-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(AGENTRUN_NC01_V02_DB_USER):$(AGENTRUN_NC01_V02_DB_PASSWORD)@$(PGHOST):5432/$(AGENTRUN_NC01_V02_DB_NAME)?sslmode=require&uselibpqcompat=true
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: agentrun/nc01-v02-mgr-db.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: agentrun-v02
          secret: agentrun-v02-mgr-db
          key: DATABASE_URL
    - name: decision-center-nc01-database-url
      sourceSecretRef: decision-center/nc01-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(DECISION_CENTER_NC01_DB_USER):$(DECISION_CENTER_NC01_DB_PASSWORD)@$(PGHOST):5432/$(DECISION_CENTER_NC01_DB_NAME)?sslmode=require&uselibpqcompat=true
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: decision-center/nc01-db.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: decision-center
          secret: decision-center-runtime-secrets
          key: DATABASE_URL
    - name: web-probe-monitor-nc01-database-url
      sourceSecretRef: platform-db/web-probe-monitor-nc01-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(WEB_PROBE_MONITOR_NC01_DB_USER):$(WEB_PROBE_MONITOR_NC01_DB_PASSWORD)@$(PGHOST):5432/$(WEB_PROBE_MONITOR_NC01_DB_NAME)?sslmode=require
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: hwlab/web-probe-monitor-db.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: hwlab-web-probe-monitor
          secret: hwlab-web-probe-monitor-db
          key: DATABASE_URL
    - name: superapi-nc01-database-url
      sourceSecretRef: platform-db/superapi-nc01-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(SUPERAPI_DB_USER):$(SUPERAPI_DB_PASSWORD)@$(PGHOST):5432/$(SUPERAPI_DB_NAME)?sslmode=require
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: platform-infra/superapi.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: superapi-production
          secret: superapi-production-runtime
          key: DATABASE_URL
    - name: superapi-development-nc01-database-url
      sourceSecretRef: platform-db/superapi-development-nc01-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(SUPERAPI_DEVELOPMENT_DB_USER):$(SUPERAPI_DEVELOPMENT_DB_PASSWORD)@$(PGHOST):5432/$(SUPERAPI_DEVELOPMENT_DB_NAME)?sslmode=require
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: platform-infra/superapi-development.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: superapi-development
          secret: superapi-development-runtime
          key: DATABASE_URL
    - name: pikaoa-database-url
      sourceSecretRef: platform-db/pikaoa-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(PIKAOA_DB_USER):$(PIKAOA_DB_PASSWORD)@$(PGHOST):5432/$(PIKAOA_DB_NAME)?sslmode=require
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: platform-infra/pikaoa.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: pikaoa
          secret: pikaoa-runtime
          key: DATABASE_URL
    - name: pikaoa-dev-database-url
      sourceSecretRef: platform-db/pikaoa-dev-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(PIKAOA_DEV_DB_USER):$(PIKAOA_DEV_DB_PASSWORD)@$(PGHOST):5432/$(PIKAOA_DEV_DB_NAME)?sslmode=require
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: platform-infra/pikaoa-dev.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: pikaoa-dev
          secret: pikaoa-dev-runtime
          key: DATABASE_URL
    - name: tasktree-nc01-database-url
      sourceSecretRef: platform-db/tasktree-nc01-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(TASKTREE_DB_USER):$(TASKTREE_DB_PASSWORD)@$(PGHOST):5432/$(TASKTREE_DB_NAME)?sslmode=require&uselibpqcompat=true
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: hwlab/tasktree-nc01-db.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: hwlab-v03
          secret: hwlab-tasktree-db
          key: DATABASE_URL
    - name: tasktree-production-nc01-database-url
      sourceSecretRef: platform-db/tasktree-production-nc01-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(TASKTREE_PRODUCTION_DB_USER):$(TASKTREE_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(TASKTREE_PRODUCTION_DB_NAME)?sslmode=require&uselibpqcompat=true
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: hwlab/tasktree-production-nc01-db.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: hwlab-production
          secret: hwlab-tasktree-db
          key: DATABASE_URL
    - name: hwlab-nc01-v03-cloud-api-database-url
      sourceSecretRef: platform-db/hwlab-nc01-v03-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(HWLAB_NC01_V03_DB_USER):$(HWLAB_NC01_V03_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_V03_DB_NAME)?sslmode=require
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: hwlab/nc01-v03-cloud-api-db.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: hwlab-v03
          secret: hwlab-cloud-api-v03-db
          key: DATABASE_URL
    - name: hwlab-nc01-v03-openfga-datastore-uri
      sourceSecretRef: platform-db/hwlab-nc01-v03-db.env
      render:
        envKey: DATASTORE_URI
        format: postgres://$(HWLAB_NC01_V03_DB_USER):$(HWLAB_NC01_V03_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_V03_DB_NAME)?sslmode=require
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: hwlab/nc01-v03-openfga-db.env
        key: DATASTORE_URI
        mode: update-or-insert
      consumers:
        - scope: hwlab-v03
          secret: hwlab-v03-openfga
          key: DATASTORE_URI
    - name: hwlab-nc01-production-cloud-api-database-url
      sourceSecretRef: platform-db/hwlab-nc01-production-db.env
      render:
        envKey: DATABASE_URL
        format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: hwlab/nc01-production-cloud-api-db.env
        key: DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: hwlab-production
          secret: hwlab-cloud-api-production-db
          key: DATABASE_URL
    - name: hwlab-nc01-production-migration-database-url
      sourceSecretRef: platform-db/hwlab-nc01-production-db.env
      render:
        envKey: MIGRATION_DATABASE_URL
        format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require&uselibpqcompat=true
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: hwlab/nc01-production-cloud-api-db.env
        key: MIGRATION_DATABASE_URL
        mode: update-or-insert
      consumers:
        - scope: hwlab-production
          secret: hwlab-cloud-api-production-db
          key: MIGRATION_DATABASE_URL
    - name: hwlab-nc01-production-openfga-datastore-uri
      sourceSecretRef: platform-db/hwlab-nc01-production-db.env
      render:
        envKey: DATASTORE_URI
        format: postgres://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require
        variables:
          PGHOST: 10.42.0.1
      writeToSecretSource:
        sourceRef: hwlab/nc01-production-openfga-db.env
        key: DATASTORE_URI
        mode: update-or-insert
      consumers:
        - scope: hwlab-production
          secret: hwlab-production-openfga
          key: DATASTORE_URI

backup:
  logicalDumps:
    - enabled: false
      database: agentrun_v02
      scriptPath: /usr/local/sbin/unidesk-nc01-agentrun-v02-pgdump.sh
      serviceName: unidesk-nc01-agentrun-v02-pgdump.service
      timerName: unidesk-nc01-agentrun-v02-pgdump.timer
      schedule: "*-*-* 03:37:00"
      retentionDays: 7
      warningAfterHours: 36
      destination:
        type: nc01-local
        path: /var/backups/unidesk/platform-db/nc01/agentrun-v02
      pgDump:
        host: 127.0.0.1
        format: custom
      encryption:
        enabled: false
    - enabled: true
      database: pikaoa
      scriptPath: /usr/local/sbin/unidesk-nc01-pikaoa-pgdump.sh
      serviceName: unidesk-nc01-pikaoa-pgdump.service
      timerName: unidesk-nc01-pikaoa-pgdump.timer
      schedule: "*-*-* 03:47:00"
      retentionDays: 14
      warningAfterHours: 36
      destination:
        type: nc01-local
        path: /var/backups/unidesk/platform-db/nc01/pikaoa
      pgDump:
        host: 127.0.0.1
        format: custom
      encryption:
        enabled: false