# PostgreSQL for toolshed's control plane.
#
# Deployed as shared infrastructure in its own namespace rather than inside
# the toolshed namespace, so it is addressed over cluster DNS like any other
# platform component and its lifecycle is independent of the application
# that happens to be its first consumer:
#
#   postgresql.postgres.svc.cluster.local:5432
#
# Credentials come from Vault through External Secrets — see
# devops-infra-argo-config/secretstores/toolshed-postgres-credentials.yaml.
# The Secret must exist before this pod can start; a missing Secret leaves it
# in CreateContainerConfigError rather than failing in a way that explains
# itself.

fullnameOverride: postgresql

image:
  repository: postgres
  tag: "16-alpine"
  pullPolicy: IfNotPresent

existingSecret: postgresql-credentials
database: toolshed

persistence:
  enabled: true
  # local-path-provisioner, this cluster's default StorageClass — installed
  # right after Cilium precisely because kubeadm ships no default (unlike
  # k3s). 5Gi is generous for control-plane metadata; the volume is not
  # resizable in place with this provisioner, so it is sized up front.
  storageClass: local-path
  size: 5Gi

config:
  # Deliberately far below PostgreSQL's 128MB default. The node has 8GB and
  # was already at its ceiling before this; the demo apps were scaled to zero
  # to make room. Revisit only if query performance actually suffers, which
  # for a handful of control-plane tables it will not.
  sharedBuffers: 32MB
  maxConnections: "50"

resources:
  requests:
    cpu: 50m
    memory: 64Mi
  limits:
    memory: 256Mi