Forte/launchpad

feat(infra): forte-drop in-cluster postgres + nightly backup (prod) #17

Closed

jorgen.stensrud wants to merge 7 commits from feat/forte-drop-infra into main

Author	SHA1	Message	Date
Sten	94c7924e65	docs(infra): pg backup & restore runbook for forte-drop AI Code Review / ai-review (pull_request) Successful in 5s Details Covers: nightly backup mechanism, listing backups, manual trigger, full restore procedure (2-pod mc-download + psql-pipe), verification, object-data note, and a disaster-scenario recovery table.	2026-05-29 10:31:09 +02:00
Sten	dd9819bdbe	feat(infra): drop in-cluster minio, add pg backup + PVC protection AI Code Review / ai-review (pull_request) Successful in 7s Details PROD: object storage moves to UpCloud Managed Object Storage (existing drops bucket) instead of single-node in-cluster MinIO — durable, UpCloud-replicated, no PVC to back up. - Remove forte-drop-minio StatefulSet entirely. - Add forte-drop-pg-backup CronJob: nightly pg_dump -> gzip -> upload to s3://drops/_pgbackups/ (collision-proof prefix), 30-day retention. Reuses forte-drop-secrets S3 creds (app user has s3:* on drops). - PVC prune/delete protection on the postgres volumeClaimTemplate.	2026-05-29 09:28:51 +02:00
Sten	178bf8cc78	fix(infra): un-own forte-drop namespace from postgres app AI Code Review / ai-review (pull_request) Successful in 6s Details Follow-up to `47d1f1e` — the previous commit only updated postgres' securityContext; this drops the explicit Namespace resource as the Codex review flagged. Both apps still get the namespace created via syncOptions: CreateNamespace=true.	2026-05-28 16:13:31 +02:00
Sten	47d1f1ec39	fix(infra): drop bad postgres securityContext + un-own shared namespace AI Code Review / ai-review (pull_request) Successful in 6s Details Address Codex review on PR #17: [P1] Postgres official image's entrypoint requires root to chown a fresh PVC, then drops to the postgres user via gosu. Forcing runAsNonRoot+runAsUser=999 blocks the chown and initdb fails on a fresh volume. Drop the securityContext; matches the existing vaultwarden-postgresql pattern. [P2] The forte-drop namespace was declared as a managed resource in the postgres Application. Since minio lives in the same namespace from a separate Application, an Argo prune of the pg app would delete the namespace and cascade-delete minio. Remove the Namespace resource; rely on syncOptions: CreateNamespace=true on both apps (already set).	2026-05-28 16:13:08 +02:00
Sten	69848e42f0	fix(infra): pin minio/mc tags + add postgres securityContext + harden bootstrap script AI Code Review / ai-review (pull_request) Successful in 15s Details Address ai-review feedback on PR #17: - Pin quay.io/minio/minio and mc to specific RELEASE tags (Renovate will bump). 'latest' is unpredictable in GitOps. - Bootstrap script: set -e -> set -euo pipefail. - Postgres container: runAsNonRoot, uid/gid 999, drop ALL caps, no privilege escalation. Matches PSS restricted profile.	2026-05-28 16:05:48 +02:00
Sten	416615a9e0	feat(infra): add forte-drop sealed secrets AI Code Review / ai-review (pull_request) Successful in 5s Details Pg and minio credentials sealed against upc-dev sealed-secrets-controller.	2026-05-28 15:56:24 +02:00
Sten	3ce93017f9	feat(infra): forte-drop postgres + minio for upc-dev AI Code Review / ai-review (pull_request) Successful in 34s Details Two new ArgoCD Applications: - forte-drop-postgresql: in-cluster Postgres 16 StatefulSet, 5Gi PVC, POSTGRES_DB=drops, creds from forte-drop-pg-creds SealedSecret. - forte-drop-minio: in-cluster MinIO StatefulSet, 20Gi PVC, bootstrap Job creates the 'drops' bucket post-sync, creds from forte-drop-minio-creds SealedSecret. Both live in namespace 'forte-drop'. Mirrors the Vaultwarden pattern. Sealed secrets are added in a follow-up commit by the maintainer: kubeseal --fetch-cert > pub.pem kubeseal --cert pub.pem --format yaml < private/forte-drop-pg-creds.yaml > \ infra/overlays/upc-dev/forte-drop-postgresql/resources/forte-drop-pg-creds-sealed.yaml kubeseal --cert pub.pem --format yaml < private/forte-drop-minio-creds.yaml > \ infra/overlays/upc-dev/forte-drop-minio/resources/forte-drop-minio-creds-sealed.yaml	2026-05-28 14:33:19 +02:00