Erich Blume
ca0c9354ee
## Summary - Add `authentik` database (blumeops-pg cluster) to borgmatic pg_dump backups - Add `immich` database (immich-pg cluster) to borgmatic pg_dump backups - For immich-pg: new borgmatic managed role with `pg_read_all_data`, ExternalSecret, Tailscale LoadBalancer service, and Caddy L4 TCP proxy on port 5433 - Update backup docs to reflect all four CNPG databases + mealie SQLite ## Deploy plan Deploy order matters — k8s resources must exist before ansible can route to them: 1. **ArgoCD (databases app):** sync to pick up immich-pg borgmatic role, ExternalSecret, and Tailscale service ``` argocd app set blumeops-pg --revision feature/borgmatic-all-pg-backups argocd app sync blumeops-pg ``` 2. **Wait** for `immich-pg-tailscale` service to get a Tailscale IP and `immich-pg.tail8d86e.ts.net` to resolve 3. **Ansible (caddy):** deploy Caddy L4 route for port 5433 ``` mise run provision-indri -- --tags caddy ``` 4. **Ansible (borgmatic):** deploy updated config and .pgpass ``` mise run provision-indri -- --tags borgmatic ``` 5. **Verify:** trigger a manual borgmatic run and check all four pg_dump streams succeed ``` borgmatic --verbosity 1 2>&1 | grep -E '(Dumping|ERROR)' ``` ## Test plan - [x] `kubectl kustomize` builds cleanly - [x] `ansible --check --diff` for borgmatic and caddy show expected changes - [ ] ArgoCD sync succeeds for databases app - [ ] `immich-pg.tail8d86e.ts.net` resolves - [ ] `pg.ops.eblu.me:5433` accepts connections - [ ] `borgmatic --verbosity 1` dumps all four databases without errors Reviewed-on: #314
69 lines
1.9 KiB
YAML
69 lines
1.9 KiB
YAML
# PostgreSQL Cluster for Immich
|
|
# Uses VectorChord (successor to pgvecto.rs) for AI-powered vector search
|
|
# See: https://github.com/immich-app/immich/discussions/9060
|
|
# Managed by CloudNativePG operator
|
|
apiVersion: postgresql.cnpg.io/v1
|
|
kind: Cluster
|
|
metadata:
|
|
name: immich-pg
|
|
namespace: databases
|
|
spec:
|
|
instances: 1
|
|
# VectorChord image for PostgreSQL 17 with VectorChord 0.5.0
|
|
# Immich v2.4.1 requires VectorChord >=0.3 <0.6
|
|
# See: https://github.com/tensorchord/VectorChord
|
|
imageName: ghcr.io/tensorchord/cloudnative-vectorchord:17-0.5.0
|
|
|
|
storage:
|
|
size: 10Gi
|
|
storageClass: standard
|
|
|
|
# Bootstrap creates initial database and owner
|
|
bootstrap:
|
|
initdb:
|
|
database: immich
|
|
owner: immich
|
|
postInitSQL:
|
|
# Extensions required by Immich
|
|
- CREATE EXTENSION IF NOT EXISTS vector;
|
|
- CREATE EXTENSION IF NOT EXISTS vchord CASCADE;
|
|
- CREATE EXTENSION IF NOT EXISTS cube CASCADE;
|
|
- CREATE EXTENSION IF NOT EXISTS earthdistance CASCADE;
|
|
|
|
# Managed roles
|
|
# Note: connectionLimit, ensure, inherit are CNPG defaults added to prevent ArgoCD drift
|
|
managed:
|
|
roles:
|
|
# borgmatic read-only user for backups
|
|
- name: borgmatic
|
|
login: true
|
|
connectionLimit: -1
|
|
ensure: present
|
|
inherit: true
|
|
inRoles:
|
|
- pg_read_all_data
|
|
passwordSecret:
|
|
name: immich-pg-borgmatic
|
|
|
|
# Resource limits for minikube environment
|
|
resources:
|
|
requests:
|
|
memory: "256Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "1Gi"
|
|
cpu: "500m"
|
|
|
|
# PostgreSQL configuration
|
|
postgresql:
|
|
# VectorChord requires vchord.so in shared_preload_libraries
|
|
shared_preload_libraries:
|
|
- "vchord.so"
|
|
parameters:
|
|
max_connections: "50"
|
|
shared_buffers: "128MB"
|
|
password_encryption: "scram-sha-256"
|
|
pg_hba:
|
|
# Allow connections from k8s pods
|
|
- host all all 0.0.0.0/0 scram-sha-256
|
|
- host all all ::/0 scram-sha-256
|