postgres_argocd_appset.yaml

---
# webapp is deployed 2nd because we need secrets and persistent volumes up 1st
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: zitadel-postgres-app-set
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "3"
spec:
  goTemplate: true
  # generator allows us to source specific values from an external k8s secret
  generators:
    - plugin:
        configMapRef:
          name: secret-var-plugin-generator
        input:
          parameters:
            secret_vars:
              - zitadel_s3_endpoint
              - zitadel_postgres_backup_schedule
  template:
    metadata:
      name: zitadel-postgres-cluster
      namespace: zitadel
      annotations:
        argocd.argoproj.io/sync-wave: "3"
    spec:
      project: zitadel
      destination:
        server: "https://kubernetes.default.svc"
        namespace: zitadel
      syncPolicy:
        syncOptions:
          - ApplyOutOfSyncOnly=true
        automated:
          prune: true
          selfHeal: true
      source:
        repoURL: https://small-hack.github.io/cloudnative-pg-cluster-chart
        chart: cnpg-cluster
        targetRevision: 0.4.0
        helm:
          releaseName: zitadel-postgres-cluster
          valuesObject:
            name: zitadel-postgres
            instances: 1

            bootstrap:
              initdb:
                database: zitadel
                owner: zitadel
                secret:
                  name: zitadel-pgsql-credentials
                # postInitApplicationSQLRefs:
                #   secretRefs:
                #     - name: zitadel-postgres-init-script
                #       key: init.sql

            enableSuperuserAccess: true

            backup:
              # barman is a utility for backing up postgres to s3
              barmanObjectStore:
                destinationPath: "s3://zitadel-postgres"
                endpointURL: "https://{{ .zitadel_s3_endpoint }}"
                s3Credentials:
                  accessKeyId:
                    name: s3-postgres-credentials
                    key: "accessKeyId"
                  secretAccessKey:
                    name: s3-postgres-credentials
                    key: "secretAccessKey"
                wal:
                  compression: gzip
                  maxParallel: 8
              retentionPolicy: "3d"

            certificates:
              server:
                enabled: true
                generate: true
              client:
                enabled: true
                generate: true
              user:
                enabled: true
                username:
                  - zitadel
                  - postgres

            scheduledBackup:
              name: zitadel-pg-backup
              spec:
                # hourly full data backups
                schedule: '{{ .zitadel_postgres_backup_schedule }}'
                backupOwnerReference: self
                cluster:
                  name: zitadel-postgres

            monitoring:
              enablePodMonitor: false

            postgresql:
              pg_hba:
                - hostnossl all all 0.0.0.0/0 reject
                - hostssl all all 0.0.0.0/0 cert clientcert=verify-full