# Keep in sync with k8s/knoe/knoe-db.yaml (bootstrap recovery only).
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: knoe-db
spec:
  instances: 3
  enablePDB: false
  imageName: example.invalid:5000/knoe-db:0.0.0
  postgresUID: 100
  postgresGID: 101
  maxSyncReplicas: 1

  affinity:
    # CloudNativePG uses its own affinity schema (not corev1.Affinity). See: `kubectl explain cluster.spec.affinity`
    enablePodAntiAffinity: true
    podAntiAffinityType: required
    topologyKey: kubernetes.io/hostname
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
              - key: knoe.org/node-role
                operator: In
                values:
                  - db

  postgresql:
    parameters:
      shared_buffers: 256MB
      pg_stat_statements.max: '10000'
      pg_stat_statements.track: all
    shared_preload_libraries:
      - pg_stat_statements
      - pg_tde
    pg_hba:
      # allow password access from remote hosts if environment is "#dev"
      - local all postgres trust
      - local all knoe scram-sha-256
      - host all postgres all scram-sha-256
      - host knoe knoe-db all scram-sha-256
      - host all all all scram-sha-256
      - hostssl knoe knoe-db all scram-sha-256
      # - host all all all gss include_realm=1 krb_realm=EXAMPLE.COM

  bootstrap:
    recovery:
      backup:
        name: {{BACKUP_NAME}}

  certificates:
    serverTLSSecret: knoe-db-tls
    serverCASecret: knoe-db-ca

  enableSuperuserAccess: true

  storage:
    size: 1Gi
    pvcTemplate:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 1Gi
      storageClassName: synology-iscsi
      selector:
        matchLabels:
          synology.storage/role: data
  walStorage:
    size: 1Gi
    pvcTemplate:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 1Gi
      storageClassName: synology-iscsi
      selector:
        matchLabels:
          synology.storage/role: wal

  monitoring:
    enablePodMonitor: false