cozystack/packages/apps/postgres/templates/db.yaml

---
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: {{ .Release.Name }}
spec:
  instances: {{ .Values.replicas }}
  {{/*
    s3Credentials points at the operator-supplied Secret when
    backup.s3CredentialsSecret.name is set; otherwise it falls back to the
    chart-managed <release>-s3-creds Secret materialised from s3AccessKey/
    s3SecretKey. The override path keeps credentials out of the Postgres
    CR .spec — the CNPG backup driver uses it on restore.
  */}}
  {{- $credCfg := default (dict) .Values.backup.s3CredentialsSecret }}
  {{- $credSecretName := $credCfg.name | default (printf "%s-s3-creds" .Release.Name) }}
  {{/*
    accessKeyIDKey/secretAccessKeyKey only apply when an external Secret was
    supplied via backup.s3CredentialsSecret.name. The chart-managed
    <release>-s3-creds Secret materialised by backup-secret.yaml hard-codes
    AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY, so applying overrides in
    that mode would point CNPG at non-existent keys and break credential
    reads. Default both names unconditionally and let the override take
    effect only in external-Secret mode.
  */}}
  {{- $credAccessKey := "AWS_ACCESS_KEY_ID" }}
  {{- $credSecretKey := "AWS_SECRET_ACCESS_KEY" }}
  {{- if $credCfg.name }}
  {{- $credAccessKey = $credCfg.accessKeyIDKey | default "AWS_ACCESS_KEY_ID" }}
  {{- $credSecretKey = $credCfg.secretAccessKeyKey | default "AWS_SECRET_ACCESS_KEY" }}
  {{- end }}
  {{/*
    endpointCA references a Secret carrying the CA bundle Barman should
    trust. Required when the S3 endpoint serves a self-signed certificate
    (the cozystack default seaweedfs-s3 ingress qualifies). The same
    reference flows into both spec.backup.barmanObjectStore.endpointCA and
    spec.externalClusters[].barmanObjectStore.endpointCA so backup *and*
    recovery can verify TLS - missing it on the externalClusters side made
    bootstrap.recovery panic in CNPG's instance-manager.
  */}}
  {{- $caCfg := default (dict) .Values.backup.endpointCA }}
  {{- $caKey := $caCfg.key | default "ca.crt" }}
  {{- if .Values.backup.enabled }}
  backup:
    barmanObjectStore:
      destinationPath: {{ .Values.backup.destinationPath }}
      endpointURL: {{ .Values.backup.endpointURL }}
      {{- if $caCfg.name }}
      endpointCA:
        name: {{ $caCfg.name }}
        key: {{ $caKey }}
      {{- end }}
      s3Credentials:
        accessKeyId:
          name: {{ $credSecretName }}
          key: {{ $credAccessKey }}
        secretAccessKey:
          name: {{ $credSecretName }}
          key: {{ $credSecretKey }}
    retentionPolicy: {{ .Values.backup.retentionPolicy }}
  {{- end }}

  {{- if .Values.bootstrap.enabled }}
  bootstrap:
    recovery:
      source: {{ .Values.bootstrap.oldName }}
      {{- if .Values.bootstrap.recoveryTime }}
      recoveryTarget:
        targetTime: {{ .Values.bootstrap.recoveryTime }}
      {{- end }}
  externalClusters:
    - name: {{ .Values.bootstrap.oldName }}
      barmanObjectStore:
        destinationPath: {{ .Values.backup.destinationPath }}
        {{- if .Values.bootstrap.serverName }}
        serverName: {{ .Values.bootstrap.serverName }}
        {{- end }}
        endpointURL: {{ .Values.backup.endpointURL }}
        {{- if $caCfg.name }}
        endpointCA:
          name: {{ $caCfg.name }}
          key: {{ $caKey }}
        {{- end }}
        s3Credentials:
          accessKeyId:
            name: {{ $credSecretName }}
            key: {{ $credAccessKey }}
          secretAccessKey:
            name: {{ $credSecretName }}
            key: {{ $credSecretKey }}
  {{- end }}

  resources: {{- include "cozy-lib.resources.defaultingSanitize" (list .Values.resourcesPreset .Values.resources $) | nindent 4 }}

  imageName: ghcr.io/cloudnative-pg/postgresql:{{ include "postgres.versionMap" $ | trimPrefix "v" }}
  enableSuperuserAccess: true
  {{- if .Values._cluster.scheduling }}
  {{- $rawConstraints := get .Values._cluster.scheduling "globalAppTopologySpreadConstraints" }}
  {{- if $rawConstraints }}
  {{- $rawConstraints | fromYaml | toYaml | nindent 2 }}
    labelSelector:
      matchLabels:
        cnpg.io/cluster: {{ .Release.Name }}
  {{- end }}
  {{- end }}
  postgresql:
    parameters:
      {{- $defaults := dict "max_wal_senders" "30" }}
      {{- $params := merge (dict) .Values.postgresql.parameters $defaults }}
      {{- /* Security: Block parameters that enable arbitrary code execution (shell commands or .so loading) */ -}}
      {{- $dangerousParams := list "archive_command" "restore_command" "ssl_passphrase_command" "dynamic_library_path" "local_preload_libraries" "session_preload_libraries" "shared_preload_libraries" }}
      {{- range $key, $value := $params }}
      {{- $normalizedKey := lower $key }}
      {{- if has $normalizedKey $dangerousParams }}
      {{- fail (printf "SECURITY: Parameter '%s' is blocked. This parameter can enable arbitrary code execution and must not be set by tenants." $key) }}
      {{- end }}
      {{ $key }}: {{ $value | toString | quote }}
      {{- end }}

  minSyncReplicas: {{ .Values.quorum.minSyncReplicas }}
  maxSyncReplicas: {{ .Values.quorum.maxSyncReplicas }}

  monitoring:
    enablePodMonitor: true

  storage:
    size: {{ required ".Values.size is required" .Values.size }}
    {{- with .Values.storageClass }}
    storageClass: {{ . }}
    {{- end }}

  inheritedMetadata:
    labels:
      policy.cozystack.io/allow-to-apiserver: "true"
      app.kubernetes.io/name: postgres.apps.cozystack.io
      app.kubernetes.io/instance: {{ $.Release.Name }}
---
apiVersion: cozystack.io/v1alpha1
kind: WorkloadMonitor
metadata:
  name: {{ $.Release.Name }}
  labels:
    workloads.cozystack.io/resource-preset: {{ .Values.resourcesPreset | quote }}
spec:
  replicas: {{ .Values.replicas }}
  minReplicas: 1
  kind: postgres
  type: postgres
  selector:
    app.kubernetes.io/name: postgres.apps.cozystack.io
    app.kubernetes.io/instance: {{ $.Release.Name }}
  version: {{ $.Chart.Version }}