# PostgreSQL for toolshed's control plane, on GKE.
#
# Its own namespace rather than toolshed's, so it is addressed over cluster
# DNS like any other platform component and outlives its first consumer:
#
#   postgresql.postgres.svc.cluster.local:5432
#
# Hand-written chart, not Bitnami's: that registry has been unstable, and
# PostgreSQL ships no official chart.
#
# Credentials come from Vault through External Secrets — see
# secretstores/toolshed-postgres-credentials.yaml. The Secret must exist
# before this pod starts; without it the pod sits in
# CreateContainerConfigError, which does not explain itself.

fullnameOverride: postgresql

image:
  repository: postgres
  tag: "16-alpine"
  pullPolicy: IfNotPresent

existingSecret: postgresql-credentials
database: toolshed

persistence:
  enabled: true
  storageClass: standard-rwo
  size: 5Gi

config:
  # Kept at the homelab's deliberately small values even though this
  # cluster has room to spare: for a handful of control-plane tables it
  # makes no measurable difference, and matching the homelab keeps one
  # fewer variable between the two deployments. Raise it if a real query
  # workload ever shows up here.
  sharedBuffers: 32MB
  maxConnections: "50"

resources:
  requests:
    cpu: 50m
    memory: 64Mi
  limits:
    memory: 256Mi