apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: postgres
  namespace: postgres
spec:
  enablePDB: false
  imageName: ghcr.io/cloudnative-pg/postgresql:18
  instances: 1
  managed:
    roles:
      - ensure: present
        login: true
        name: authentik
        passwordSecret:
          name: authentik-db
      - ensure: present
        login: true
        name: grafana
        passwordSecret:
          name: grafana-db
      - ensure: present
        login: true
        name: legislative
        passwordSecret:
          name: legislative-db
      - ensure: present
        inRoles:
          - pg_read_all_data
        login: true
        name: pgweb
        passwordSecret:
          name: pgweb-db
      - ensure: present
        login: true
        name: redoost
        passwordSecret:
          name: redoost-db
  postgresql:
    # Each app role may only connect to its own database; pgweb to all but authentik.
    pg_hba:
      - host sameuser all all scram-sha-256
      - host authentik pgweb all reject
      - host all pgweb all scram-sha-256
      - host all all all reject
  resources:
    limits:
      memory: 1Gi
    requests:
      cpu: 100m
      memory: 256Mi
  storage:
    size: 5Gi