apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: postiz-postgresql-18-cluster
  namespace: postiz
  labels:
    helm.sh/chart: postgres-18-cluster-7.9.1
    app.kubernetes.io/name: postiz-postgresql-18
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "7.9.1"
    app.kubernetes.io/managed-by: Helm
spec:
  instances: 3
  imageName: "ghcr.io/cloudnative-pg/postgresql:18.3-standard-trixie"
  imagePullPolicy: IfNotPresent
  postgresUID: 26
  postgresGID: 26
  storage:
    size: 10Gi
    storageClass: local-path
  walStorage:
    size: 2Gi
    storageClass: local-path
  resources:
    limits:
      hugepages-2Mi: 256Mi
    requests:
      cpu: 100m
      memory: 256Mi
  affinity:
    enablePodAntiAffinity: true
    topologyKey: kubernetes.io/hostname
  primaryUpdateMethod: switchover
  primaryUpdateStrategy: unsupervised
  logLevel: info
  enableSuperuserAccess: false
  enablePDB: true
  postgresql:
    parameters:
      hot_standby_feedback: "on"
      max_slot_wal_keep_size: 2000MB
      shared_buffers: 128MB
  monitoring:
    enablePodMonitor: true
    disableDefaultQueries: false
  plugins:
    - name: barman-cloud.cloudnative-pg.io
      enabled: true
      isWALArchiver: true
      parameters:
        barmanObjectName: "postiz-postgresql-18-backup-garage-local"
        serverName: "postiz-postgresql-18-backup-1"
  bootstrap:
    recovery:
      database: app
      source: postiz-postgresql-18-backup-1
  externalClusters:
    - name: postiz-postgresql-18-backup-1
      plugin:
        name: barman-cloud.cloudnative-pg.io
        enabled: true
        isWALArchiver: false
        parameters:
          barmanObjectName: "postiz-postgresql-18-recovery"
          serverName: postiz-postgresql-18-backup-1
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: postiz-valkey-init-scripts
  labels:
    helm.sh/chart: valkey-0.9.3
    app.kubernetes.io/name: valkey
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/version: "9.0.3"
    app.kubernetes.io/managed-by: Helm
data:
  init.sh: |-
    #!/bin/sh
    set -eu

    # Default config paths
    VALKEY_CONFIG=${VALKEY_CONFIG_PATH:-/data/conf/valkey.conf}

    LOGFILE="/data/init.log"
    DATA_DIR="/data/conf"

    # Logging function (outputs to stderr and file)
    log() {
      echo "$(date) $1" | tee -a "$LOGFILE" >&2
    }
    # Function to get password for a user
    # Usage: get_user_password <username> [password_key]
    # Returns: password via stdout, exits with error if not found
    get_user_password() {
      username="$1"
      password_key="${2:-$username}"
      password=""
      # Try to get password from existing secret first (priority)
      if [ -f "/valkey-users-secret/$password_key" ]; then
        password=$(cat "/valkey-users-secret/$password_key")
        log "Using password from existing secret for user $username"
      elif [ -f "/valkey-auth-secret/${username}-password" ]; then
        # Fallback to inline password
        password=$(cat "/valkey-auth-secret/${username}-password")
        log "Using inline password for user $username"
      else
        log "ERROR: No password found for user $username"
        return 1
      fi

      echo "$password"
    }

    # Clean old log if requested
    if [ "${KEEP_OLD_LOGS:-false}" != "true" ]; then
      rm -f "$LOGFILE"
    fi

    if [ -f "$LOGFILE" ]; then
      log "Detected restart of this instance ($HOSTNAME)"
    fi

    log "Creating configuration in $DATA_DIR..."
    mkdir -p "$DATA_DIR"
    rm -f "$VALKEY_CONFIG"


    # Base valkey.conf
    log "Generating base valkey.conf"
    {
      echo "port 6379"
      echo "protected-mode no"
      echo "bind * -::*"
      echo "dir /data"
    } >>"$VALKEY_CONFIG"
    # Create secure directory for ACL file
    log "Creating /etc/valkey directory for ACL file"
    mkdir -p /etc/valkey

    # Set aclfile path in valkey.conf
    echo "aclfile /etc/valkey/users.acl" >>"$VALKEY_CONFIG"

    # Remove or reset existing ACL file if present (it may be read-only from previous run)
    log "Preparing ACL file at /etc/valkey/users.acl"
    if [ -f /etc/valkey/users.acl ]; then
      log "Removing existing read-only users.acl file"
      chmod 0600 /etc/valkey/users.acl
      rm -f /etc/valkey/users.acl
    fi

    # Create ACL file with secure permissions
    touch /etc/valkey/users.acl
    chmod 0600 /etc/valkey/users.acl
    # Generate ACL entries for each user
    log "Generating ACL entries for users"

    # User: default
    PASSWORD=$(get_user_password "default" "default") || exit 1

    # Hash the password and write ACL entry
    PASSHASH=$(echo -n "$PASSWORD" | sha256sum | cut -f 1 -d " ")
    echo "user default on #$PASSHASH ~* &* +@all" >> /etc/valkey/users.acl

    # Set final permissions
    chmod 0400 /etc/valkey/users.acl
    log "ACL file created with 0400 permissions"
    # Replica mode configuration
    log "Configuring replication mode"

    # Use POD_INDEX from Kubernetes metadata
    POD_INDEX=${POD_INDEX:-0}
    IS_MASTER=false

    # Check if this is pod-0 (master)
    if [ "$POD_INDEX" = "0" ]; then
      IS_MASTER=true
      log "This pod (index $POD_INDEX) is configured as MASTER"
    else
      log "This pod (index $POD_INDEX) is configured as REPLICA"
    fi

    # Configure replica settings
    if [ "$IS_MASTER" = "false" ]; then
      MASTER_HOST="postiz-valkey-0.postiz-valkey-headless.postiz.svc.cluster.local"
      MASTER_PORT="6379"

      log "Configuring replica to follow master at $MASTER_HOST:$MASTER_PORT"

      {
        echo ""
        echo "# Replica Configuration"
        echo "replicaof $MASTER_HOST $MASTER_PORT"
        echo "replica-announce-ip postiz-valkey-$POD_INDEX.postiz-valkey-headless.postiz.svc.cluster.local"
        echo ""
        echo "# Master authentication"
      } >>"$VALKEY_CONFIG"
      # Get the password for the replication user
      REPL_PASSWORD=$(get_user_password "default" "default") || exit 1

      # Write masterauth configuration
      echo "masterauth $REPL_PASSWORD" >>"$VALKEY_CONFIG"
      echo "masteruser default" >>"$VALKEY_CONFIG"
      log "Configured masterauth with user default"
    fi

    # Append extra configs if present
    if [ -f /usr/local/etc/valkey/valkey.conf ]; then
      log "Appending /usr/local/etc/valkey/valkey.conf"
      cat /usr/local/etc/valkey/valkey.conf >>"$VALKEY_CONFIG"
    fi
    if [ -d /extravalkeyconfigs ]; then
      log "Appending files in /extravalkeyconfigs/"
      cat /extravalkeyconfigs/* >>"$VALKEY_CONFIG"
    fi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postiz-cloudflared
  labels:
    app.kubernetes.io/controller: main
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: cloudflared
    app.kubernetes.io/version: 2026.3.0
    helm.sh/chart: cloudflared-2.4.0
  namespace: postiz
spec:
  revisionHistoryLimit: 3
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/controller: main
      app.kubernetes.io/name: cloudflared
      app.kubernetes.io/instance: postiz
  template:
    metadata:
      labels:
        app.kubernetes.io/controller: main
        app.kubernetes.io/instance: postiz
        app.kubernetes.io/name: cloudflared
    spec:
      enableServiceLinks: false
      serviceAccountName: default
      automountServiceAccountToken: true
      hostIPC: false
      hostNetwork: false
      hostPID: false
      dnsPolicy: ClusterFirst
      containers:
        - args:
            - tunnel
            - --protocol
            - http2
            - --no-autoupdate
            - run
            - --token
            - $(CF_MANAGED_TUNNEL_TOKEN)
          env:
            - name: CF_MANAGED_TUNNEL_TOKEN
              valueFrom:
                secretKeyRef:
                  key: cf-tunnel-token
                  name: postiz-cloudflared-secret
          image: cloudflare/cloudflared:2026.3.0
          imagePullPolicy: IfNotPresent
          name: main
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postiz
  labels:
    app.kubernetes.io/controller: main
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz
    helm.sh/chart: postiz-4.6.2
  namespace: postiz
spec:
  revisionHistoryLimit: 3
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/controller: main
      app.kubernetes.io/name: postiz
      app.kubernetes.io/instance: postiz
  template:
    metadata:
      labels:
        app.kubernetes.io/controller: main
        app.kubernetes.io/instance: postiz
        app.kubernetes.io/name: postiz
    spec:
      enableServiceLinks: false
      serviceAccountName: default
      automountServiceAccountToken: true
      hostIPC: false
      hostNetwork: false
      hostPID: false
      dnsPolicy: ClusterFirst
      containers:
        - env:
            - name: MAIN_URL
              value: https://postiz.alexlebens.dev
            - name: FRONTEND_URL
              value: https://postiz.alexlebens.dev
            - name: NEXT_PUBLIC_BACKEND_URL
              value: https://postiz.alexlebens.dev/api
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  key: JWT_SECRET
                  name: postiz-config-secret
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  key: uri
                  name: postiz-postgresql-18-cluster-app
            - name: REDIS_URL
              valueFrom:
                secretKeyRef:
                  key: REDIS_URL
                  name: postiz-valkey-config
            - name: BACKEND_INTERNAL_URL
              value: http://localhost:3000
            - name: IS_GENERAL
              value: "true"
            - name: STORAGE_PROVIDER
              value: local
            - name: UPLOAD_DIRECTORY
              value: /uploads
            - name: NEXT_PUBLIC_UPLOAD_DIRECTORY
              value: /uploads
            - name: NEXT_PUBLIC_POSTIZ_OAUTH_DISPLAY_NAME
              value: Authentik
            - name: NEXT_PUBLIC_POSTIZ_OAUTH_LOGO_URL
              value: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
            - name: POSTIZ_GENERIC_OAUTH
              value: "true"
            - name: POSTIZ_OAUTH_URL
              value: https://auth.alexlebens.dev
            - name: POSTIZ_OAUTH_AUTH_URL
              value: https://auth.alexlebens.dev/application/o/authorize/
            - name: POSTIZ_OAUTH_TOKEN_URL
              value: https://auth.alexlebens.dev/application/o/token/
            - name: POSTIZ_OAUTH_USERINFO_URL
              value: https://auth.alexlebens.dev/application/o/userinfo/
            - name: POSTIZ_OAUTH_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  key: client
                  name: postiz-oidc-secret
            - name: POSTIZ_OAUTH_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  key: secret
                  name: postiz-oidc-secret
            - name: POSTIZ_OAUTH_SCOPE
              value: openid profile email
          image: ghcr.io/gitroomhq/postiz-app:v2.20.2
          imagePullPolicy: IfNotPresent
          name: main
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
          volumeMounts:
            - mountPath: /config
              name: config
            - mountPath: /uploads
              name: uploads
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: postiz-config
        - name: uploads
          persistentVolumeClaim:
            claimName: postiz-uploads
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-cloudflared-secret
  namespace: postiz
  labels:
    helm.sh/chart: cloudflared-2.4.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "2.4.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-cloudflared-secret
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: cf-tunnel-token
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cloudflare/tunnels/postiz
        metadataPolicy: None
        property: token
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-config-backup-secret-external
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-config-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-config-backup-secret-external
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_SECRET_ACCESS_KEY
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-config-backup-secret-local
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-config-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-config-backup-secret-local
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-local
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-local
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-config-backup-secret-remote
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-config-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-config-backup-secret-remote
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-remote
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-remote
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-config-secret
  namespace: postiz
  labels:
    app.kubernetes.io/name: postiz-config-secret
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: JWT_SECRET
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/postiz/config
        metadataPolicy: None
        property: JWT_SECRET
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-oidc-secret
  namespace: postiz
  labels:
    app.kubernetes.io/name: postiz-oidc-secret
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: client
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/postiz
        metadataPolicy: None
        property: client
    - secretKey: secret
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/postiz
        metadataPolicy: None
        property: secret
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-postgresql-18-backup-garage-local-secret
  namespace: postiz
  labels:
    helm.sh/chart: postgres-18-cluster-7.9.1
    app.kubernetes.io/name: postiz-postgresql-18
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "7.9.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-postgresql-18-backup-garage-local-secret
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ACCESS_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-postgresql-18-recovery-secret
  namespace: postiz
  labels:
    helm.sh/chart: postgres-18-cluster-7.9.1
    app.kubernetes.io/name: postiz-postgresql-18
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "7.9.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-postgresql-18-recovery-secret
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ACCESS_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-uploads-backup-secret-external
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-upload-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-uploads-backup-secret-external
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-uploads"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_SECRET_ACCESS_KEY
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-uploads-backup-secret-local
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-upload-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-uploads-backup-secret-local
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-uploads"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-local
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-local
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-uploads-backup-secret-remote
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-upload-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-uploads-backup-secret-remote
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/postiz/postiz-uploads"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-remote
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-remote
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: postiz-valkey-config
  namespace: postiz
  labels:
    app.kubernetes.io/name: postiz-valkey-config
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: REDIS_URL
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/postiz/valkey
        metadataPolicy: None
        property: url
    - secretKey: user
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/postiz/valkey
        metadataPolicy: None
        property: user
    - secretKey: password
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/postiz/valkey
        metadataPolicy: None
        property: password
    - secretKey: default
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/postiz/valkey
        metadataPolicy: None
        property: password
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: http-route-postiz
  namespace: postiz
  labels:
    app.kubernetes.io/name: http-route-postiz
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - postiz.alexlebens.net
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - group: ''
          kind: Service
          name: postiz
          port: 80
          weight: 100
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: HTTPRoute
metadata:
  name: postiz
  labels:
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz
    helm.sh/chart: postiz-4.6.2
  namespace: postiz
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - "postiz.alexlebens.net"
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: postiz
          namespace: postiz
          port: 80
          weight: 100
      matches:
        - path:
            type: PathPrefix
            value: /
---
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
  name: postiz-postgresql-18-backup-garage-local
  namespace: postiz
  labels:
    helm.sh/chart: postgres-18-cluster-7.9.1
    app.kubernetes.io/name: postiz-postgresql-18
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "7.9.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-postgresql-18-backup-garage-local
spec:
  retentionPolicy: 7d
  instanceSidecarConfiguration:
    env:
      - name: AWS_REQUEST_CHECKSUM_CALCULATION
        value: when_required
      - name: AWS_RESPONSE_CHECKSUM_VALIDATION
        value: when_required
  configuration:
    destinationPath: s3://postgres-backups/cl01tl/postiz/postiz-postgresql-18-cluster
    endpointURL: http://garage-main.garage:3900
    s3Credentials:
      accessKeyId:
        name: postiz-postgresql-18-backup-garage-local-secret
        key: ACCESS_KEY_ID
      secretAccessKey:
        name: postiz-postgresql-18-backup-garage-local-secret
        key: ACCESS_SECRET_KEY
      region:
        name: postiz-postgresql-18-backup-garage-local-secret
        key: ACCESS_REGION
---
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
  name: "postiz-postgresql-18-recovery"
  namespace: postiz
  labels:
    helm.sh/chart: postgres-18-cluster-7.9.1
    app.kubernetes.io/name: postiz-postgresql-18
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "7.9.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: "postiz-postgresql-18-recovery"
spec:
  configuration:
    destinationPath: s3://postgres-backups/cl01tl/postiz/postiz-postgresql-18-cluster
    endpointURL: http://garage-main.garage:3900
    wal:
      compression: snappy
      maxParallel: 1
    data:
      compression: snappy
      jobs: 1
    s3Credentials:
      accessKeyId:
        name: postiz-postgresql-18-recovery-secret
        key: ACCESS_KEY_ID
      secretAccessKey:
        name: postiz-postgresql-18-recovery-secret
        key: ACCESS_SECRET_KEY
      region:
        name: postiz-postgresql-18-recovery-secret
        key: ACCESS_REGION
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: postiz-config
  labels:
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz
    helm.sh/chart: postiz-4.6.2
  annotations:
    helm.sh/resource-policy: keep
  namespace: postiz
spec:
  accessModes:
    - "ReadWriteOnce"
  resources:
    requests:
      storage: "2Gi"
  storageClassName: "ceph-block"
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: postiz-uploads
  labels:
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz
    helm.sh/chart: postiz-4.6.2
  annotations:
    helm.sh/resource-policy: keep
  namespace: postiz
spec:
  accessModes:
    - "ReadWriteOnce"
  resources:
    requests:
      storage: "10Gi"
  storageClassName: "ceph-block"
---
apiVersion: v1
kind: Pod
metadata:
  name: postiz-valkey-test-auth-existing
  labels:
    helm.sh/chart: valkey-0.9.3
    app.kubernetes.io/name: valkey
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/version: "9.0.3"
    app.kubernetes.io/managed-by: Helm
  annotations:
    "helm.sh/hook": test
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  restartPolicy: Never
  containers:
    - name: test-auth
      image: "valkey/valkey:9.0.3"
      command:
        - sh
        - -c
        - |
          set -e
          echo "Testing authentication with usersExistingSecret..."
          TLS_FLAGS=""

          # Test basic connection (no auth - will fail if auth is properly configured)
          PING_RESULT=$(valkey-cli -h postiz-valkey -p 6379 $TLS_FLAGS PING 2>&1 || true)
          if [ "$PING_RESULT" = "PONG" ]; then
            echo "✗ Authentication test failed: server allows unauthenticated access"
            exit 1
          fi

          echo "✓ Authentication is enforced (unauthenticated access denied)"
          echo "✓ Received expected error: $PING_RESULT"
          echo "⚠ Manual verification recommended for usersExistingSecret configuration"
          exit 0
      volumeMounts:
        - name: valkey-users-secret
          mountPath: /valkey-users-secret
          readOnly: true
  volumes:
    - name: valkey-users-secret
      secret:
        secretName: postiz-valkey-config
---
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: postiz-postgresql-18-alert-rules
  namespace: postiz
  labels:
    helm.sh/chart: postgres-18-cluster-7.9.1
    app.kubernetes.io/name: postiz-postgresql-18
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "7.9.1"
    app.kubernetes.io/managed-by: Helm
spec:
  groups:
    - name: cloudnative-pg/postiz-postgresql-18
      rules:
        - alert: CNPGClusterBackendsWaitingWarning
          annotations:
            summary: CNPG Cluster a backend is waiting for longer than 5 minutes.
            description: |-
              Pod {{ $labels.pod }}
              has been waiting for longer than 5 minutes
          expr: |
            cnpg_backends_waiting_total{namespace="postiz"} > 300
          for: 1m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterDatabaseDeadlockConflictsWarning
          annotations:
            summary: CNPG Cluster has over 10 deadlock conflicts.
            description: |-
              There are over 10 deadlock conflicts in
              {{ $labels.pod }}
          expr: |
            cnpg_pg_stat_database_deadlocks{namespace="postiz"} > 10
          for: 1m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterHACritical
          annotations:
            summary: CNPG Cluster has no standby replicas!
            description: |-
              CloudNativePG Cluster "{{`{{`}} $labels.job {{`}}`}}" has no ready standby replicas. Your cluster at a severe
              risk of data loss and downtime if the primary instance fails.

              The primary instance is still online and able to serve queries, although connections to the `-ro` endpoint
              will fail. The `-r` endpoint os operating at reduced capacity and all traffic is being served by the main.

              This can happen during a normal fail-over or automated minor version upgrades in a cluster with 2 or less
              instances. The replaced instance may need some time to catch-up with the cluster primary instance.

              This alarm will be always trigger if your cluster is configured to run with only 1 instance. In this
              case you may want to silence it.
            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterHACritical.md
          expr: |
            max by (job) (cnpg_pg_replication_streaming_replicas{namespace="postiz"} - cnpg_pg_replication_is_wal_receiver_up{namespace="postiz"}) < 1
          for: 5m
          labels:
            severity: critical
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterHAWarning
          annotations:
            summary: CNPG Cluster less than 2 standby replicas.
            description: |-
              CloudNativePG Cluster "{{`{{`}} $labels.job {{`}}`}}" has only {{`{{`}} $value {{`}}`}} standby replicas, putting
              your cluster at risk if another instance fails. The cluster is still able to operate normally, although
              the `-ro` and `-r` endpoints operate at reduced capacity.

              This can happen during a normal fail-over or automated minor version upgrades. The replaced instance may
              need some time to catch-up with the cluster primary instance.

              This alarm will be constantly triggered if your cluster is configured to run with less than 3 instances.
              In this case you may want to silence it.
            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterHAWarning.md
          expr: |
            max by (job) (cnpg_pg_replication_streaming_replicas{namespace="postiz"} - cnpg_pg_replication_is_wal_receiver_up{namespace="postiz"}) < 2
          for: 5m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterHighConnectionsCritical
          annotations:
            summary: CNPG Instance maximum number of connections critical!
            description: |-
              CloudNativePG Cluster "postiz/postiz-postgresql-18-cluster" instance {{`{{`}} $labels.pod {{`}}`}} is using {{`{{`}} $value {{`}}`}}% of
              the maximum number of connections.
            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterHighConnectionsCritical.md
          expr: |
            sum by (pod) (cnpg_backends_total{namespace="postiz", pod=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"}) / max by (pod) (cnpg_pg_settings_setting{name="max_connections", namespace="postiz", pod=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"}) * 100 > 95
          for: 5m
          labels:
            severity: critical
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterHighConnectionsWarning
          annotations:
            summary: CNPG Instance is approaching the maximum number of connections.
            description: |-
              CloudNativePG Cluster "postiz/postiz-postgresql-18-cluster" instance {{`{{`}} $labels.pod {{`}}`}} is using {{`{{`}} $value {{`}}`}}% of
              the maximum number of connections.
            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterHighConnectionsWarning.md
          expr: |
            sum by (pod) (cnpg_backends_total{namespace="postiz", pod=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"}) / max by (pod) (cnpg_pg_settings_setting{name="max_connections", namespace="postiz", pod=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"}) * 100 > 80
          for: 5m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterHighReplicationLag
          annotations:
            summary: CNPG Cluster high replication lag
            description: |-
              CloudNativePG Cluster "postiz/postiz-postgresql-18-cluster" is experiencing a high replication lag of
              {{`{{`}} $value {{`}}`}}ms.

              High replication lag indicates network issues, busy instances, slow queries or suboptimal configuration.
            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterHighReplicationLag.md
          expr: |
            max(cnpg_pg_replication_lag{namespace="postiz",pod=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"}) * 1000 > 1000
          for: 5m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterInstancesOnSameNode
          annotations:
            summary: CNPG Cluster instances are located on the same node.
            description: |-
              CloudNativePG Cluster "postiz/postiz-postgresql-18-cluster" has {{`{{`}} $value {{`}}`}}
              instances on the same node {{`{{`}} $labels.node {{`}}`}}.

              A failure or scheduled downtime of a single node will lead to a potential service disruption and/or data loss.
            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterInstancesOnSameNode.md
          expr: |
            count by (node) (kube_pod_info{namespace="postiz", pod=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"}) > 1
          for: 5m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterLongRunningTransactionWarning
          annotations:
            summary: CNPG Cluster query is taking longer than 5 minutes.
            description: |-
              CloudNativePG Cluster Pod {{ $labels.pod }}
              is taking more than 5 minutes (300 seconds) for a query.
          expr: |-
            cnpg_backends_max_tx_duration_seconds{namespace="postiz"} > 300
          for: 1m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterLowDiskSpaceCritical
          annotations:
            summary: CNPG Instance is running out of disk space!
            description: |-
              CloudNativePG Cluster "postiz/postiz-postgresql-18-cluster" is running extremely low on disk space. Check attached PVCs!
            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterLowDiskSpaceCritical.md
          expr: |
            max(max by(persistentvolumeclaim) (1 - kubelet_volume_stats_available_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"} / kubelet_volume_stats_capacity_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"})) > 0.9 OR
            max(max by(persistentvolumeclaim) (1 - kubelet_volume_stats_available_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$-wal"} / kubelet_volume_stats_capacity_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$-wal"})) > 0.9 OR
            max(sum by (namespace,persistentvolumeclaim) (kubelet_volume_stats_used_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$-tbs.*"})
                /
                sum by (namespace,persistentvolumeclaim) (kubelet_volume_stats_capacity_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$-tbs.*"})
                *
                on(namespace, persistentvolumeclaim) group_left(volume)
                kube_pod_spec_volumes_persistentvolumeclaims_info{pod=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"}
            ) > 0.9
          for: 5m
          labels:
            severity: critical
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterLowDiskSpaceWarning
          annotations:
            summary: CNPG Instance is running out of disk space.
            description: |-
              CloudNativePG Cluster "postiz/postiz-postgresql-18-cluster" is running low on disk space. Check attached PVCs.
            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterLowDiskSpaceWarning.md
          expr: |
            max(max by(persistentvolumeclaim) (1 - kubelet_volume_stats_available_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"} / kubelet_volume_stats_capacity_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"})) > 0.7 OR
            max(max by(persistentvolumeclaim) (1 - kubelet_volume_stats_available_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$-wal"} / kubelet_volume_stats_capacity_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$-wal"})) > 0.7 OR
            max(sum by (namespace,persistentvolumeclaim) (kubelet_volume_stats_used_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$-tbs.*"})
                /
                sum by (namespace,persistentvolumeclaim) (kubelet_volume_stats_capacity_bytes{namespace="postiz", persistentvolumeclaim=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$-tbs.*"})
                *
                on(namespace, persistentvolumeclaim) group_left(volume)
                kube_pod_spec_volumes_persistentvolumeclaims_info{pod=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"}
            ) > 0.7
          for: 5m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterOffline
          annotations:
            summary: CNPG Cluster has no running instances!
            description: |-
              CloudNativePG Cluster "postiz/postiz-postgresql-18-cluster" has no ready instances.

              Having an offline cluster means your applications will not be able to access the database, leading to
              potential service disruption and/or data loss.
            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterOffline.md
          expr: |
            (count(cnpg_collector_up{namespace="postiz",pod=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"}) OR on() vector(0)) == 0
          for: 5m
          labels:
            severity: critical
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterPGDatabaseXidAgeWarning
          annotations:
            summary: CNPG Cluster has a number of transactions from the frozen XID to the current one.
            description: |-
              Over 300,000,000 transactions from frozen xid
              on pod {{ $labels.pod }}
          expr: |
            cnpg_pg_database_xid_age{namespace="postiz"} > 300000000
          for: 1m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterPGReplicationWarning
          annotations:
            summary: CNPG Cluster standby is lagging behind the primary.
            description: |-
              Standby is lagging behind by over 300 seconds (5 minutes)
          expr: |
            cnpg_pg_replication_lag{namespace="postiz"} > 300
          for: 1m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterReplicaFailingReplicationWarning
          annotations:
            summary: CNPG Cluster has a replica is failing to replicate.
            description: |-
              Replica {{ $labels.pod }}
              is failing to replicate
          expr: |
            cnpg_pg_replication_in_recovery{namespace="postiz"} > cnpg_pg_replication_is_wal_receiver_up{namespace="postiz"}
          for: 1m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
        - alert: CNPGClusterZoneSpreadWarning
          annotations:
            summary: CNPG Cluster instances in the same zone.
            description: |-
              CloudNativePG Cluster "postiz/postiz-postgresql-18-cluster" has instances in the same availability zone.

              A disaster in one availability zone will lead to a potential service disruption and/or data loss.
            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterZoneSpreadWarning.md
          expr: |
            3 > count(count by (label_topology_kubernetes_io_zone) (kube_pod_info{namespace="postiz", pod=~"postiz-postgresql-18-cluster-([1-9][0-9]*)$"} * on(node,instance) group_left(label_topology_kubernetes_io_zone) kube_node_labels)) < 3
          for: 5m
          labels:
            severity: warning
            namespace: postiz
            cnpg_cluster: postiz-postgresql-18-cluster
---
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
  name: postiz-config-backup-source-external
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-config-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-config-backup
spec:
  sourcePVC: postiz-config
  trigger:
    schedule: 52 10 * * *
  restic:
    pruneIntervalDays: 7
    repository: postiz-config-backup-secret-external
    retain:
      daily: 7
      hourly: 0
      monthly: 3
      weekly: 4
      yearly: 1
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 1Gi
---
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
  name: postiz-config-backup-source-local
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-config-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-config-backup
spec:
  sourcePVC: postiz-config
  trigger:
    schedule: 52 8 * * *
  restic:
    pruneIntervalDays: 7
    repository: postiz-config-backup-secret-local
    retain:
      daily: 7
      hourly: 0
      monthly: 3
      weekly: 4
      yearly: 1
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 1Gi
---
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
  name: postiz-config-backup-source-remote
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-config-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-config-backup
spec:
  sourcePVC: postiz-config
  trigger:
    schedule: 52 9 * * *
  restic:
    pruneIntervalDays: 7
    repository: postiz-config-backup-secret-remote
    retain:
      daily: 7
      hourly: 0
      monthly: 3
      weekly: 4
      yearly: 1
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 1Gi
---
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
  name: postiz-uploads-backup-source-external
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-upload-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-uploads-backup
spec:
  sourcePVC: postiz-uploads
  trigger:
    schedule: 54 10 * * *
  restic:
    pruneIntervalDays: 7
    repository: postiz-uploads-backup-secret-external
    retain:
      daily: 7
      hourly: 0
      monthly: 3
      weekly: 4
      yearly: 1
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 1Gi
---
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
  name: postiz-uploads-backup-source-local
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-upload-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-uploads-backup
spec:
  sourcePVC: postiz-uploads
  trigger:
    schedule: 54 8 * * *
  restic:
    pruneIntervalDays: 7
    repository: postiz-uploads-backup-secret-local
    retain:
      daily: 7
      hourly: 0
      monthly: 3
      weekly: 4
      yearly: 1
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 1Gi
---
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
  name: postiz-uploads-backup-source-remote
  namespace: postiz
  labels:
    helm.sh/chart: volsync-target-upload-0.8.0
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "0.8.0"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz-uploads-backup
spec:
  sourcePVC: postiz-uploads
  trigger:
    schedule: 54 9 * * *
  restic:
    pruneIntervalDays: 7
    repository: postiz-uploads-backup-secret-remote
    retain:
      daily: 7
      hourly: 0
      monthly: 3
      weekly: 4
      yearly: 1
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 1Gi
---
apiVersion: postgresql.cnpg.io/v1
kind: ScheduledBackup
metadata:
  name: "postiz-postgresql-18-scheduled-backup-live-backup"
  namespace: postiz
  labels:
    helm.sh/chart: postgres-18-cluster-7.9.1
    app.kubernetes.io/name: postiz-postgresql-18
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/part-of: postiz
    app.kubernetes.io/version: "7.9.1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: "postiz-postgresql-18-scheduled-backup-live-backup"
spec:
  immediate: true
  suspend: false
  schedule: "0 20 15 * * *"
  backupOwnerReference: self
  cluster:
    name: postiz-postgresql-18-cluster
  method: plugin
  pluginConfiguration:
    name: barman-cloud.cloudnative-pg.io
    parameters:
      barmanObjectName: "postiz-postgresql-18-backup-garage-local"
---
apiVersion: v1
kind: Service
metadata:
  name: postiz-valkey-headless
  labels:
    helm.sh/chart: valkey-0.9.3
    app.kubernetes.io/name: valkey
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/version: "9.0.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: headless
spec:
  type: ClusterIP
  clusterIP: None
  publishNotReadyAddresses: true
  ports:
    - name: tcp
      port: 6379
      targetPort: tcp
      protocol: TCP
  selector:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/instance: postiz
---
apiVersion: v1
kind: Service
metadata:
  name: postiz-valkey-read
  labels:
    helm.sh/chart: valkey-0.9.3
    app.kubernetes.io/name: valkey
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/version: "9.0.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: read
spec:
  type: ClusterIP
  ports:
    - name: tcp
      port: 6379
      targetPort: tcp
      protocol: TCP
  selector:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/instance: postiz
---
apiVersion: v1
kind: Service
metadata:
  name: postiz-valkey
  labels:
    helm.sh/chart: valkey-0.9.3
    app.kubernetes.io/name: valkey
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/version: "9.0.3"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: primary
spec:
  type: ClusterIP
  ports:
    - port: 6379
      targetPort: tcp
      protocol: TCP
      name: tcp
  selector:
    app.kubernetes.io/name: valkey
    app.kubernetes.io/instance: postiz
    statefulset.kubernetes.io/pod-name: postiz-valkey-0
---
apiVersion: v1
kind: Service
metadata:
  name: postiz
  labels:
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postiz
    app.kubernetes.io/service: postiz
    helm.sh/chart: postiz-4.6.2
  namespace: postiz
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 5000
      protocol: TCP
      name: http
  selector:
    app.kubernetes.io/controller: main
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/name: postiz
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: postiz-valkey
  labels:
    helm.sh/chart: valkey-0.9.3
    app.kubernetes.io/name: valkey
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/version: "9.0.3"
    app.kubernetes.io/managed-by: Helm
automountServiceAccountToken: false
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postiz-valkey
  labels:
    helm.sh/chart: valkey-0.9.3
    app.kubernetes.io/name: valkey
    app.kubernetes.io/instance: postiz
    app.kubernetes.io/version: "9.0.3"
    app.kubernetes.io/managed-by: Helm
spec:
  serviceName: postiz-valkey-headless
  replicas: 3
  podManagementPolicy: OrderedReady
  selector:
    matchLabels:
      app.kubernetes.io/name: valkey
      app.kubernetes.io/instance: postiz
  volumeClaimTemplates:
    - metadata:
        name: valkey-data
      spec:
        accessModes:
          - ReadWriteOnce
        storageClassName: "ceph-block"
        resources:
          requests:
            storage: "1Gi"
  template:
    metadata:
      labels:
        app.kubernetes.io/name: valkey
        app.kubernetes.io/instance: postiz
      annotations:
        checksum/initconfig: "fe93fb7000602d0fb3b36b111a77c4a3"
    spec:
      automountServiceAccountToken: false
      serviceAccountName: postiz-valkey
      securityContext:
        fsGroup: 1000
        runAsGroup: 1000
        runAsUser: 1000
      initContainers:
        - name: postiz-valkey-init
          image: docker.io/valkey/valkey:9.0.3
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
          command: ["/scripts/init.sh"]
          env:
            - name: POD_INDEX
              valueFrom:
                fieldRef:
                  fieldPath: metadata.labels['apps.kubernetes.io/pod-index']
          volumeMounts:
            - name: valkey-data
              mountPath: /data
            - name: scripts
              mountPath: /scripts
            - name: valkey-acl
              mountPath: /etc/valkey
            - name: valkey-users-secret
              mountPath: /valkey-users-secret
              readOnly: true
      containers:
        - name: postiz-valkey
          image: docker.io/valkey/valkey:9.0.3
          imagePullPolicy: IfNotPresent
          command: ["valkey-server"]
          args: ["/data/conf/valkey.conf"]
          securityContext:
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 1000
          env:
            - name: POD_INDEX
              valueFrom:
                fieldRef:
                  fieldPath: metadata.labels['apps.kubernetes.io/pod-index']
            - name: VALKEY_LOGLEVEL
              value: "notice"
          ports:
            - name: tcp
              containerPort: 6379
              protocol: TCP
          startupProbe:
            exec:
              command: ["sh", "-c", "valkey-cli ping"]
          livenessProbe:
            exec:
              command: ["sh", "-c", "valkey-cli ping"]
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
          volumeMounts:
            - name: valkey-data
              mountPath: /data
            - name: valkey-acl
              mountPath: /etc/valkey
      volumes:
        - name: scripts
          configMap:
            name: postiz-valkey-init-scripts
            defaultMode: 0555
        - name: valkey-acl
          emptyDir:
            medium: Memory
        - name: valkey-users-secret
          secret:
            secretName: postiz-valkey-config
            defaultMode: 0400