Erich Blume
22f418d0dc
## Summary Review session covering 3 docs, plus a codebase-wide cleanup: ### Docs reviewed - **connect-to-postgres** — verified end-to-end (psql connection tested), stamped - **create-release-artifact-workflow** — clarified that `build-blumeops.yaml` is only a version bump example (not a packages API example) - **deploy-k8s-service** — fixed stale repoURL (`indri:2200` → `forge.ops.eblu.me:2222`), wrong Caddy config keys (`upstream` → `backend`, added missing `host`), updated Homepage group to "Services", added Tailscale tag documentation ### Codebase cleanup - Migrated all remaining `op item get --fields` calls to `op read` URI syntax across 7 files (docs, READMEs, YAML comments) - Simplified the `op read` vs `op item get` guidance in CLAUDE.md ## Side findings (not addressed) - New `immich-pg` CNPG cluster not yet documented in the postgresql reference card ## Test plan - [x] `psql` connection to `pg.ops.eblu.me` verified - [x] All pre-commit hooks pass - [x] `docs-check-links`, `docs-check-index`, `docs-check-frontmatter` pass Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/191
140 lines
4.4 KiB
Markdown
140 lines
4.4 KiB
Markdown
# Database Manifests
|
|
|
|
PostgreSQL clusters managed by CloudNativePG operator.
|
|
|
|
## Clusters
|
|
|
|
| Cluster | Image | Purpose |
|
|
|---------|-------|---------|
|
|
| blumeops-pg | cloudnative-pg/postgresql:18 | General services (miniflux, teslamate) |
|
|
| immich-pg | tensorchord/cloudnative-vectorchord:17 | Immich (requires pgvecto.rs extension) |
|
|
|
|
## blumeops-pg
|
|
|
|
Single-instance PostgreSQL cluster for blumeops services.
|
|
|
|
### Configuration
|
|
|
|
- **Instances**: 1 (single-node for minikube)
|
|
- **Storage**: 10Gi on `standard` storage class
|
|
- **Initial database**: `miniflux` owned by `miniflux` user
|
|
|
|
### Users/Roles
|
|
|
|
| User | Role | Purpose | Password Source |
|
|
|-----------|----------------|----------------------------------|---------------------------------------|
|
|
| postgres | superuser | CNPG internal (avoid using) | `blumeops-pg-superuser` secret |
|
|
| miniflux | app owner | Owns miniflux database | `blumeops-pg-app` secret |
|
|
| eblume | superuser | Admin access (matches brew pg) | `blumeops-pg-eblume` secret (manual) |
|
|
| borgmatic | pg_read_all_data | Backup access for borgmatic | `blumeops-pg-borgmatic` secret (manual) |
|
|
|
|
### Manual Secret Setup
|
|
|
|
Before deploying, create the password secrets:
|
|
|
|
```bash
|
|
# Create namespace first
|
|
kubectl create namespace databases
|
|
|
|
# Apply eblume password from 1Password
|
|
op inject -i argocd/manifests/databases/secret-eblume.yaml.tpl | kubectl apply -f -
|
|
|
|
# Apply borgmatic password from 1Password
|
|
op inject -i argocd/manifests/databases/secret-borgmatic.yaml.tpl | kubectl apply -f -
|
|
```
|
|
|
|
The `miniflux` user password is auto-generated by CloudNativePG and stored in `blumeops-pg-app`.
|
|
|
|
### Connection Information
|
|
|
|
After the cluster is healthy:
|
|
|
|
```bash
|
|
# Connect via Tailscale (temporary hostname during migration)
|
|
psql -h k8s-pg.tail8d86e.ts.net -U eblume -W -d miniflux
|
|
|
|
# Or with password from 1Password
|
|
PGPASSWORD=$(op read "op://blumeops/guxu3j7ajhjyey6xxl2ovsl2ui/password") \
|
|
psql -h k8s-pg.tail8d86e.ts.net -U eblume -d miniflux
|
|
|
|
# Get miniflux app credentials (for applications)
|
|
kubectl -n databases get secret blumeops-pg-app -o jsonpath='{.data.uri}' | base64 -d
|
|
|
|
# Get postgres superuser credentials (emergency only)
|
|
kubectl -n databases get secret blumeops-pg-superuser -o jsonpath='{.data.password}' | base64 -d
|
|
```
|
|
|
|
### Connecting via kubectl port-forward
|
|
|
|
Alternative if Tailscale service is unavailable:
|
|
|
|
```bash
|
|
# Terminal 1: Port-forward to the primary
|
|
kubectl -n databases port-forward svc/blumeops-pg-rw 5432:5432
|
|
|
|
# Terminal 2: Connect as eblume
|
|
PGPASSWORD=$(op read "op://blumeops/guxu3j7ajhjyey6xxl2ovsl2ui/password") \
|
|
psql -h localhost -U eblume -d miniflux
|
|
```
|
|
|
|
### Status
|
|
|
|
```bash
|
|
# Check cluster health
|
|
kubectl -n databases get cluster blumeops-pg
|
|
|
|
# Check pods
|
|
kubectl -n databases get pods -l cnpg.io/cluster=blumeops-pg
|
|
|
|
# Check managed roles status
|
|
kubectl -n databases get cluster blumeops-pg -o jsonpath='{.status.managedRolesStatus}' | jq
|
|
|
|
# Operator logs
|
|
kubectl -n databases logs -l cnpg.io/cluster=blumeops-pg
|
|
```
|
|
|
|
## Tailscale Exposure
|
|
|
|
### Current: Temporary Service
|
|
|
|
`k8s-pg.tail8d86e.ts.net` - LoadBalancer service for testing during migration.
|
|
|
|
### Phase 4: Production Service
|
|
|
|
After miniflux migrates to k8s, the `pg.tail8d86e.ts.net` Tailscale service will switch
|
|
from brew PostgreSQL (indri) to this k8s cluster. At that point:
|
|
1. Delete `service-tailscale.yaml` (the `k8s-pg` service)
|
|
2. Update/create a service with `tailscale.com/hostname: "pg"`
|
|
3. Verify the orphaned `k8s-pg` device is removed from tailnet
|
|
|
|
## immich-pg
|
|
|
|
PostgreSQL cluster for Immich with VectorChord extension for AI-powered vector search.
|
|
|
|
### Configuration
|
|
|
|
- **Instances**: 1 (single-node for minikube)
|
|
- **Storage**: 10Gi on `standard` storage class
|
|
- **Image**: `ghcr.io/tensorchord/cloudnative-vectorchord:17-0.5.0` (VectorChord 0.5.0 for Immich compatibility)
|
|
- **Extensions**: `vector`, `vchord`, `cube`, `earthdistance`
|
|
|
|
### Connection
|
|
|
|
Immich connects via `immich-pg-rw.databases.svc.cluster.local:5432`.
|
|
|
|
The `immich` user password is auto-generated by CloudNativePG and stored in `immich-pg-app` secret:
|
|
|
|
```bash
|
|
# Get immich app credentials
|
|
kubectl -n databases get secret immich-pg-app -o jsonpath='{.data.password}' | base64 -d
|
|
```
|
|
|
|
### Status
|
|
|
|
```bash
|
|
# Check cluster health
|
|
kubectl -n databases get cluster immich-pg
|
|
|
|
# Check pods
|
|
kubectl -n databases get pods -l cnpg.io/cluster=immich-pg
|
|
```
|