black-start cnpg replication config

kubernetes/manifests/cnpg.nix

@@ -0,0 +1,108 @@
+{
+  services.k3s.manifests = {
+    "objectstore.yaml".content = {
+      apiVersion = "barmancloud.cnpg.io/v1";
+      kind = "ObjectStore";
+      metadata.name = "truenas-s3";
+      metadata.namespace = "cloudnativepg";
+      spec = {
+        configuration = {
+          destinationPath = "s3://weyma-talos-shared-pgsql-new/";
+          endpointURL = "http://10.105.15.20:9000";
+          s3Credentials = {
+            accessKeyId = {
+              key = "s3AccessKey";
+              name = "s3-backup-creds";
+            };
+            secretAccessKey = {
+              key = "s3SecretKey";
+              name = "s3-backup-creds";
+            };
+          };
+        };
+      };
+    };
+    "pg-cluster.yaml".content = {
+      apiVersion = "postgresql.cnpg.io/v1";
+      kind = "Cluster";
+      metadata.name = "weyma-bs-pgsql";
+      metadata.namespace = "cloudnativepg";
+      spec = {
+        instances = 1;
+        imageName = "ghcr.io/cloudnative-pg/postgresql:16.9-5-bullseye";
+        storage = {
+          size = "50Gi";
+          storageClass = "local-path";
+        };
+        plugins = [
+          {
+            name = "barman-cloud.cloudnative-pg.io";
+            parameters.barmanObjectName = "truenas-s3";
+          }
+        ];
+        bootstrap.recovery.source = "weyma-pgsql";
+        externalClusters = [
+          {
+            name = "weyma-bs-pgsql";
+            plugin = {
+              name = "barman-cloud.cloudnative-pg.io";
+              parameters = {
+                barmanObjectName = "truenas-s3";
+                serverName = "weyma-bs-pgsql";
+              };
+            };
+          }
+          {
+            name = "weyma-pgsql";
+            connectionParameters = {
+              host = "10.105.10.24";
+              user = "streaming_replica";
+              dbname = "postgres";
+              sslmode = "require";
+            };
+            plugin = {
+              name = "barman-cloud.cloudnative-pg.io";
+              parameters = {
+                barmanObjectName = "truenas-s3";
+                serverName = "weyma-pgsql";
+              };
+            };
+            sslKey = {
+              name = "weyma-pgsql-replication";
+              key = "tls.key";
+            };
+            sslCert = {
+              name = "weyma-pgsql-replication";
+              key = "tls.crt";
+            };
+            sslRootCert = {
+              name = "weyma-pgsql-ca";
+              key = "ca.crt";
+            };
+          }
+        ];
+        replica = {
+          primary = "weyma-pgsql";
+          source = "weyma-pgsql";
+        };
+        managed.services.additional = [
+          {
+            selectorType = "rw";
+            serviceTemplate = {
+              metadata.name = "weyma-bs-pgsql-ext";
+              spec.type = "LoadBalancer";
+            };
+          }
+        ];
+      };
+    };
+    "weyma-pgsql-ca.yaml".content = {
+      apiVersion = "v1";
+      kind = "Secret";
+      metadata.name = "weyma-pgsql-ca";
+      metadata.namespace = "cloudnativepg";
+      # this is fine to be in plaintext since it's just a cert and contains no key
+      data."ca.crt" = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJtekNDQVVLZ0F3SUJBZ0lRUjMzT3F3OTJKbDlmeXFzMkZyREd0akFLQmdncWhrak9QUVFEQWpBdU1SWXcKRkFZRFZRUUxFdzFqYkc5MVpHNWhkR2wyWlhCbk1SUXdFZ1lEVlFRREV3dDNaWGx0WVMxd1ozTnhiREFlRncweQpOVEV5TWpnd01URTROVEZhRncweU5qQXpNamd3TVRFNE5URmFNQzR4RmpBVUJnTlZCQXNURFdOc2IzVmtibUYwCmFYWmxjR2N4RkRBU0JnTlZCQU1UQzNkbGVXMWhMWEJuYzNGc01Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMEQKQVFjRFFnQUU5c1R4R0tLNWdRVnhmZzNkZWtlbHpFSGlMbG5GaHBZa1hTMzJSYlphV0llZ3ZWWk11cC9TRmU4YQoyai92TWdETldpZVJWcHBTVElBeml0YUxQYXdvSktOQ01FQXdEZ1lEVlIwUEFRSC9CQVFEQWdJRU1BOEdBMVVkCkV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGRysxclg2aUgwaG50bE0yaEpXdnpGaW9peTZGTUFvR0NDcUcKU000OUJBTUNBMGNBTUVRQ0lBeXhPS3VGVFhhQUJwaGhJZDI0VXZkU0FLTytPanpIZStvbVJYeDdqbTJOQWlCbAo1TVc0MDZzU3haTDgydTFtL2J3V0JXQWZPTWhLNXVlYmIyemR3QzE0Vmc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==";
+    };
+  };
+}

kubernetes/manifests/default.nix

@@ -1,5 +1,6 @@
 {
     imports = [
         ./test.nix
+        ./cnpg.nix
     ];
 }

kubernetes/secrets/cloudnativepg/weyma-pgsql-replication.nix

@@ -0,0 +1,18 @@
+{ config, ... }:
+{
+  sops.templates."weyma-pgsql-replication.yaml" = {
+    mode = "0444";
+    content = ''
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: weyma-pgsql-replication
+        namespace: cloudnativepg
+      type: Opaque
+      data:
+        tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJuVENDQVVTZ0F3SUJBZ0lRVEcvaEhOSG5IeGxQVzdtTGI5akIxekFLQmdncWhrak9QUVFEQWpBdU1SWXcKRkFZRFZRUUxFdzFqYkc5MVpHNWhkR2wyWlhCbk1SUXdFZ1lEVlFRREV3dDNaWGx0WVMxd1ozTnhiREFlRncweQpOVEV5TWpnd01URTROVEZhRncweU5qQXpNamd3TVRFNE5URmFNQnd4R2pBWUJnTlZCQU1NRVhOMGNtVmhiV2x1CloxOXlaWEJzYVdOaE1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRWVRQzVjb2pzUDMwUTZGcnMKS1draTBjRHpDSkk1eVNoS25PaURRR24yQ1FtNEhmaWRGd3V6cFBOdWlaUHk4TjFmNFRzRlJwNy8ybDhSeUd0OQovWjhUMWFOV01GUXdEZ1lEVlIwUEFRSC9CQVFEQWdPSU1CTUdBMVVkSlFRTU1Bb0dDQ3NHQVFVRkJ3TUNNQXdHCkExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVYjdXdGZxSWZTR2UyVXphRWxhL01XS2lMTG9Vd0NnWUkKS29aSXpqMEVBd0lEUndBd1JBSWdWeG5OeEVBM3lGYVdRZk1JTDAxKzB2RXBiZVBGcElNdkkxVkNTT3Z2QzhvQwpJR3k4MVVwYmFucVVRdUd6alJjZmxYWDdrSjRqcUlhUWFWUUE0SmRNNzFpQQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+        tls.key: ${config.sops.placeholder.weyma_pgsql_replication_tls_key}
+    '';
+    path = "/var/lib/rancher/k3s/server/manifests/secrets/weyma-pgsql-replication.yaml";
+  };
+}

kubernetes/secrets/default.nix

@@ -1,5 +1,6 @@
 {
   imports = [
     ./cloudnativepg/s3-backup-creds.nix
+    ./cloudnativepg/weyma-pgsql-replication.nix
   ];
 }

security/sops.nix

@@ -19,6 +19,8 @@
                 neededForUsers = true;
             };
             cnpg_s3_backup_key = {};
+
+            weyma_pgsql_replication_tls_key = {};
         };
     };
 }

security/sops_nix.yaml

@@ -1,6 +1,7 @@
 pw_williamp: ENC[AES256_GCM,data:HuZKDBB+9FHzoMg8KrCIdQ==,iv:DvCAqtsE/JbCGmlW7czAM9X+tB3aQDvOd1OcTWjNrow=,tag:YBsZG+RKlebJlKPToD+cSQ==,type:str]
 pw_root: ENC[AES256_GCM,data:hbPcqxEFhdH4Y6KOFFCMfujL0B9uHzmNAwNNK4qLEVE=,iv:XrwGEYbc9OWckvoRfrKJmjXjB13BJG6lit5TR+Xarn8=,tag:fWtL0tsXBuCQHGorRlNIfw==,type:str]
 cnpg_s3_backup_key: ENC[AES256_GCM,data:zaMuxcu2XwgkmhkYnYKeZQQwRzSEJGPT2662B7k5JHzCH4e1TEEd+A==,iv:Na2iAuqgx8UNnDvXvP3N+csqVZFTsDwqR6OKeO/b/GY=,tag:jHeFVdRdTwk83XG6T1TwGA==,type:str]
+weyma_pgsql_replication_tls_key: ENC[AES256_GCM,data:WHCH9DJMa5/L9BCNAyfYUmgptCLu+NVtEIDjjPeb7adDUfz/fDwAUB7TOXBf19AyXaCD4NTw4IVm6UVp9/8azpAVyQ5uR5R0X3eVYAEdIHUQdOPVQsCmIQTAMwih2G41QedM3Q+gA/JRIqxX+DwtH44Celb069VmiGmlzwLbvPt9d9ZREs3KKr7p/GvVoa2atMk74/qLAKSmkAP9yZJ3q5azmmQ5/skECWmvRJ4prr/uUpIzzMIIQ6kyaafE3sKf8s/+rlsb+zT+6T527OX54xmp0QCDPQuqhEiuFvLXnqxiDwcgZ+QWbFQwj5ubCU++F3GtasCec5/wTSKa26MgNd7DvSwpQH0vdxszOoxStxNAXSouIevwFdKsvAZP60x3jWs+BcFry+cFlVrAMp5NmQ==,iv:JN+9SeyIx4kJfTiuFucLp8cKCEGeWvd3DbNeMsfeVms=,tag:GSkGD1kRmzruG0bWmxa+xA==,type:str]
 sops:
     age:
         - recipient: age1usxppyy4nfqtlvlvj5fgcwze6yy3yyvuqadrcmwwtt5dtctfkfrqzuk5w3
@@ -12,7 +13,7 @@ sops:
             Q1VUZnpnOUh2SVQ2RC9XOG5qUTVzeWMKd4nZfXETJi1tbRrUDb938mk+OOnIru9t
             F66KTiCc7akLC165G1ywBMShMPi5K+X9vRzGfmzUmwOHh2f4tZLBHA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-17T16:34:22Z"
-    mac: ENC[AES256_GCM,data:41TNxYgscdIZbbNxczTXzmPotyT4/ZsxspRihNf9NAj2c4PdQXNPeIMzS9meuH9LD4CTo9ws/pP7SBpPKnx4PzqdDekPvhdj9qIKdLjpKkJd+N0WfFXEgGEj7nAyc0lR2z6oSPuMB15xk8hIKT1prL9lDjjYRH3aKlhjaqP53LQ=,iv:RZpDhBWkbLL/pgwIuoPYUZd1Pmu0n7zt165DO7+uMHM=,tag:DQhFTgaFCgCV62QLCjozUg==,type:str]
+    lastmodified: "2026-03-17T23:33:54Z"
+    mac: ENC[AES256_GCM,data:Sl/Ah1zqTOAXKZhY7YX5Q842UoeYmBUmEFOxPF84NsxkPBLXX4VhvkHv03zptmvFVYnmUUKwzjjcJAzSb8izvNC4pjShhvmYPOZ04cbPP1lCZ21Z5A7PoKUqifDiFgwESZLUj6wyuvJX/euNLAjwr0XED2dILAbXw3h2A8smPu8=,iv:sDuGfuq+kHB6z9HyUZvjBJuIcztd3YlGkDPL0jaa7A8=,tag:oCCO5ge0Dur83IeOamG+vA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0