apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: weyma-pgsql
spec:
  instances: 3

  imageName: ghcr.io/cloudnative-pg/postgresql:16.9-5-bullseye

  storage:
    size: 50Gi
    storageClass: rook-ceph-block

  plugins:
    - name: barman-cloud.cloudnative-pg.io
      parameters:
        barmanObjectName: truenas-s3

  inheritedMetadata:
    labels:
      metrics_enabled: "true"
  
  externalClusters:
    - name: weyma-pgsql
      plugin:
        name: barman-cloud.cloudnative-pg.io
        parameters:
          barmanObjectName: truenas-s3
          serverName: weyma-pgsql
    - name: weyma-bs-pgsql
      connectionParameters:
        host: 10.105.6.198
        user: streaming_replica
        dbname: postgres
        sslmode: require
      plugin:
        name: barman-cloud.cloudnative-pg.io
        parameters:
          barmanObjectName: truenas-s3
          serverName: weyma-bs-pgsql
      sslKey:
        name: weyma-pgsql-replication
        key: tls.key
      sslCert:
        name: weyma-pgsql-replication
        key: tls.crt
      sslRootCert:
        name: weyma-pgsql-ca
        key: ca.crt

  replica:
    primary: weyma-pgsql
    source: weyma-bs-pgsql

  managed:
    services:
      additional:
        - selectorType: rw
          serviceTemplate:
            metadata:
              name: weyma-pgsql-ext
            spec:
              type: LoadBalancer
    roles:
    - name: williamp
      ensure: present
      comment: William Peebles
      login: true
      superuser: true
      passwordSecret:
        name: williamp-auth
    - name: authentik
      ensure: present
      comment: authentik
      login: true
      passwordSecret:
        name: authentik-auth
    - name: gitea
      ensure: present
      comment: gitea
      login: true
      passwordSecret:
        name: gitea-auth
    - name: peertube
      ensure: present
      comment: peertube
      login: true
      passwordSecret:
        name: peertube-auth
    - name: netmaker
      ensure: present
      comment: netmaker
      login: true
      passwordSecret:
        name: netmaker-auth
    - name: attic
      ensure: present
      comment: attic
      login: true
      passwordSecret:
        name: attic-auth
    - name: pooler
      ensure: present
      comment: pooler
      login: true
      superuser: true
      passwordSecret:
        name: pgbouncer-auth-query