homelab/postgres/k8s/postgres.yaml

apiVersion: v1
kind: Service
metadata:
  name: postgres
  namespace: database
  labels:
    app.kubernetes.io/name: postgres17
    app.kubernetes.io/part-of: homelab-database
spec:
  selector:
    app.kubernetes.io/name: postgres17
  ports:
    - name: postgres
      port: 5432
      targetPort: postgres
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres17
  namespace: database
spec:
  serviceName: postgres17
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: postgres17
  template:
    metadata:
      labels:
        app.kubernetes.io/name: postgres17
    spec:
      containers:
        - name: postgres
          image: postgres:17.6-alpine
          ports:
            - name: postgres
              containerPort: 5432
          env:
            - name: POSTGRES_DB
              value: postgres
            - name: POSTGRES_USER
              value: postgres
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-shared-secrets
                  key: POSTGRES_ADMIN_PASSWORD
          envFrom:
            - secretRef:
                name: postgres-shared-secrets
          volumeMounts:
            - name: postgres-data
              mountPath: /var/lib/postgresql/data
            - name: initdb
              mountPath: /docker-entrypoint-initdb.d/01-create-databases.sh
              subPath: 01-create-databases.sh
          readinessProbe:
            exec:
              command: ["pg_isready", "-U", "postgres", "-d", "postgres"]
            initialDelaySeconds: 10
            periodSeconds: 10
          livenessProbe:
            exec:
              command: ["pg_isready", "-U", "postgres", "-d", "postgres"]
            initialDelaySeconds: 30
            periodSeconds: 20
      volumes:
        - name: postgres-data
          persistentVolumeClaim:
            claimName: postgres17-data
        - name: initdb
          configMap:
            name: postgres-initdb
            defaultMode: 0755
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres17-data
  namespace: database
  labels:
    app.kubernetes.io/name: postgres17
    app.kubernetes.io/part-of: homelab-database
spec:
  accessModes: ["ReadWriteOnce"]
  storageClassName: local-path-retain
  resources:
    requests:
      storage: 20Gi
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: postgres-initdb
  namespace: database
data:
  01-create-databases.sh: |
    #!/usr/bin/env bash
    set -euo pipefail

    : "${AUTHENTIK_DB_PASSWORD:?AUTHENTIK_DB_PASSWORD is required}"
    : "${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD is required}"
    : "${NETRONOME_DB_PASSWORD:?NETRONOME_DB_PASSWORD is required}"
    : "${PENPOT_DB_PASSWORD:?PENPOT_DB_PASSWORD is required}"
    : "${STATUSPAGE_DB_PASSWORD:?STATUSPAGE_DB_PASSWORD is required}"

    create_role_and_database() {
      local role="$1"
      local database="$2"
      local password="$3"
      psql --username "$POSTGRES_USER" --dbname postgres \
        -v role="$role" -v database="$database" -v password="$password" \
        <<'SQL'
    SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'role', :'password')
    WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'role')\gexec
    SELECT format('CREATE DATABASE %I OWNER %I', :'database', :'role')
    WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = :'database')\gexec
    SQL
    }

    create_role_and_database authentik authentik "$AUTHENTIK_DB_PASSWORD"
    create_role_and_database gitea gitea "$GITEA_DB_PASSWORD"
    create_role_and_database netronome netronome "$NETRONOME_DB_PASSWORD"
    create_role_and_database penpot penpot "$PENPOT_DB_PASSWORD"
    create_role_and_database statuspage statuspage "$STATUSPAGE_DB_PASSWORD"