feat: add siriusdevops CNPG cluster + waitlist API K8s manifests (#112)

- New CNPG PostgreSQL cluster (siriusdevops-pgdb) in customer1 namespace
- Single-instance, 20Gi storage, GCS backups to siriusdevops-backups/
- Waitlist database definition (waitlist-db.yaml)
- Scheduled backup manifest
- Waitlist API deployment, service, HTTPRoute, and Telegram secret placeholder
- Kustomization wiring for both siriusdevops-db and waitlist-api

apps/base/customer1/siriusdevops-db/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - pg-cluster-siriusdevops.yaml
+  - waitlist-db-credentials.yaml
+  - waitlist-db.yaml
+  - siriusdevops-scheduled-backup.yaml

apps/base/customer1/siriusdevops-db/pg-cluster-siriusdevops.yaml

@@ -0,0 +1,45 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: siriusdevops-pgdb
+  namespace: customer1
+
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:15.2
+  storage:
+    size: 20Gi
+
+  managed:
+    roles:
+      - name: waitlist
+        ensure: present
+        login: true
+        passwordSecret:
+          name: waitlist-db-credentials
+
+  bootstrap:
+    initdb:
+      database: waitlist
+      owner: waitlist
+      secret:
+        name: waitlist-db-credentials
+
+  serviceAccountTemplate:
+    metadata:
+      name: cnpg-backup-sa
+      annotations:
+        iam.gke.io/gcp-service-account: cnpg-backup-sa@devops-lab-cluster.iam.gserviceaccount.com
+
+  backup:
+    barmanObjectStore:
+      destinationPath: "gs://customer1_db_backup/siriusdevops-backups/"
+      googleCredentials:
+        gkeEnvironment: true
+      wal:
+        compression: gzip
+      data:
+        compression: gzip
+        jobs: 2
+    retentionPolicy: "30d"
+    target: primary

apps/base/customer1/siriusdevops-db/siriusdevops-scheduled-backup.yaml

@@ -0,0 +1,12 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: siriusdevops-daily-backup
+  namespace: customer1
+spec:
+  schedule: "0 4 * * *"           # Daily at 04:00 UTC
+  suspend: false
+  immediate: false
+  backupOwnerReference: self
+  cluster:
+    name: siriusdevops-pgdb

apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: waitlist-db-credentials
+    namespace: customer1
+type: Opaque
+stringData:
+    username: waitlist
+    password: CHANGEME
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+    encrypted_regex: ^(data|stringData)$

apps/base/customer1/siriusdevops-db/waitlist-db.yaml

@@ -0,0 +1,10 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: waitlist-db
+  namespace: customer1
+spec:
+  cluster:
+    name: siriusdevops-pgdb
+  name: waitlist
+  owner: waitlist

apps/base/customer1/waitlist-api/deployment.yaml

@@ -0,0 +1,104 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: waitlist-api
+  namespace: customer1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: waitlist-api
+  template:
+    metadata:
+      labels:
+        app: waitlist-api
+    spec:
+      containers:
+      - name: api
+        image: ghcr.io/sirius0xdev/waitlist-api:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+        env:
+        - name: DB_HOST
+          value: "siriusdevops-pgdb-rw.customer1.svc.cluster.local"
+        - name: DB_PORT
+          value: "5432"
+        - name: DB_NAME
+          value: "waitlist"
+        - name: DB_USER
+          valueFrom:
+            secretKeyRef:
+              name: waitlist-db-credentials
+              key: username
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: waitlist-db-credentials
+              key: password
+        - name: TELEGRAM_BOT_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: waitlist-telegram-secret
+              key: bot_token
+        - name: TELEGRAM_CHAT_ID
+          valueFrom:
+            secretKeyRef:
+              name: waitlist-telegram-secret
+              key: chat_id
+        resources:
+          requests:
+            cpu: 50m
+            memory: 128Mi
+          limits:
+            cpu: 200m
+            memory: 256Mi
+
+        startupProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          timeoutSeconds: 5
+          failureThreshold: 30
+          successThreshold: 1
+
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 3
+          periodSeconds: 5
+          timeoutSeconds: 5
+          failureThreshold: 3
+          successThreshold: 1
+
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+          successThreshold: 1
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: waitlist-api-svc
+  namespace: customer1
+spec:
+  selector:
+    app: waitlist-api
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 8080
+  type: ClusterIP

apps/base/customer1/waitlist-api/http-route.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: waitlist-api-route
+  namespace: customer1
+spec:
+  parentRefs:
+  - name: external-http-gateway
+  hostnames:
+  - "sirius-sec.com"
+  - "www.sirius-sec.com"
+  - "agentforge.ai"
+  - "www.agentforge.ai"
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /api/waitlist
+      backendRefs:
+      - name: waitlist-api-svc
+        port: 80

apps/base/customer1/waitlist-api/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - waitlist-telegram-secret.yaml
+  - http-route.yaml

apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: waitlist-telegram-secret
+    namespace: customer1
+type: Opaque
+stringData:
+    bot_token: CHANGEME
+    chat_id: CHANGEME
+sops:
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+    encrypted_regex: ^(data|stringData)$