---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: pg-tls
  namespace: postgres-tls-test
spec:
  interval: 10m
  timeout: 15m
  chart:
    spec:
      chart: postgresql-contour
      version: "17.0.7"
      sourceRef:
        kind: HelmRepository
        name: yc-oci-charts
        namespace: flux-system
      interval: 10m
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    fullnameOverride: pg-tls
    global:
      security:
        allowInsecureImages: true
      defaultStorageClass: local-path
      imagePullSecrets:
        - regcred
    image:
      registry: cr.yandex/crp3ccidau046kdj8g9q
      repository: contour/postgresql
      tag: 17.0.7
    auth:
      username: notes
      database: notes
    metrics:
      enabled: false
    tls:
      enabled: true
      autoGenerated: true
    primary:
      persistence:
        storageClass: local-path
        size: 1Gi
      nodeSelector:
        dedicated: generic
      containerSecurityContext:
        readOnlyRootFilesystem: false
      args:
        - postgres
        - -c
        - ssl=on
        - -c
        - ssl_cert_file=/opt/bitnami/postgresql/certs/tls.crt
        - -c
        - ssl_key_file=/opt/bitnami/postgresql/certs/tls.key
        - -c
        - ssl_min_protocol_version=TLSv1.2
        - -c
        - hba_file=/bitnami/postgresql/conf/pg_hba.conf
      customLivenessProbe:
        exec:
          command:
            - /bin/sh
            - -c
            - exec pg_isready -U notes -d notes -h 127.0.0.1 -p 5432
        initialDelaySeconds: 30
        periodSeconds: 10
        timeoutSeconds: 5
        failureThreshold: 6
      customReadinessProbe:
        exec:
          command:
            - /bin/sh
            - -c
            - exec pg_isready -U notes -d notes -h 127.0.0.1 -p 5432
        initialDelaySeconds: 5
        periodSeconds: 10
        timeoutSeconds: 5
        failureThreshold: 6
      pgHbaConfiguration: |
        local all all scram-sha-256
        hostssl all all 0.0.0.0/0 scram-sha-256
        hostssl all all ::/0 scram-sha-256