From 103e20645ee1c655fb4900e869e7ac4c175c18a5 Mon Sep 17 00:00:00 2001
From: jenkins <brad@bstein.dev>
Date: Sat, 3 Oct 2026 01:23:30 -0500
Subject: [PATCH] postgres: reserve database capacity and probe pinned runtime

---
 infrastructure/postgres/statefulset.yaml | 56 ++++++++++++++++++++----
 1 file changed, 47 insertions(+), 9 deletions(-)

diff --git a/infrastructure/postgres/statefulset.yaml b/infrastructure/postgres/statefulset.yaml
index 658aac01..0f6d1e92 100644
--- a/infrastructure/postgres/statefulset.yaml
+++ b/infrastructure/postgres/statefulset.yaml
@@ -25,7 +25,15 @@ spec:
       serviceAccountName: postgres-vault
       nodeSelector:
         node-role.kubernetes.io/worker: "true"
-        hardware: rpi5
+      tolerations:
+        - key: atlas.bstein.dev/spillover
+          operator: Equal
+          value: "true"
+          effect: PreferNoSchedule
+        - key: longhorn
+          operator: Equal
+          value: "true"
+          effect: PreferNoSchedule
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
@@ -36,24 +44,47 @@ spec:
                     values: ["true"]
                   - key: hardware
                     operator: In
-                    values: ["rpi5"]
-                  - key: kubernetes.io/hostname
-                    operator: NotIn
-                    values: ["titan-06"]
+                    values: ["rpi5", "rpi4"]
           preferredDuringSchedulingIgnoredDuringExecution:
             - weight: 100
               preference:
                 matchExpressions:
-                  - key: kubernetes.io/hostname
+                  - key: hardware
                     operator: In
-                    values: ["titan-05", "titan-07", "titan-08", "titan-11"]
+                    values: ["rpi5"]
+            - weight: 50
+              preference:
+                matchExpressions:
+                  - key: hardware
+                    operator: In
+                    values: ["rpi4"]
       containers:
         - name: postgres
-          image: postgres:15
+          image: postgres:15@sha256:6eb0add3b77c081df18aa518ce43df58fdcc40f2e6d868a6fd08038dc7acd425
           ports:
             - name: postgres
               containerPort: 5432
               protocol: TCP
+          # The namespace's 512 MiB default previously killed backend processes.
+          resources:
+            requests:
+              cpu: 250m
+              memory: 1Gi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+          startupProbe:
+            exec:
+              command: [pg_isready, -U, postgres, -d, postgres]
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 60
+          readinessProbe:
+            exec:
+              command: [pg_isready, -U, postgres, -d, postgres]
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 3
           env:
             - name: PGDATA
               value: /var/lib/postgresql/data/pgdata
@@ -70,7 +101,14 @@ spec:
               mountPath: /mnt/vault
               readOnly: true
         - name: postgres-exporter
-          image: quay.io/prometheuscommunity/postgres-exporter:v0.15.0
+          image: quay.io/prometheuscommunity/postgres-exporter:v0.15.0@sha256:386b12d19eab2a37d7cd8ca8b4c7491cc7a830d9581f49af6c98a393da9605e6
+          resources:
+            requests:
+              cpu: 20m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
           ports:
             - name: metrics
               containerPort: 9187