Description

Provisions a managed Postgres instance using each cloud's native service -- RDS on AWS, Cloud SQL on GCP, Flexible Server on Azure. The blueprint picks the right Terraform module based on your environment's cloud provider, so your other installations reference the same outputs regardless of where they run.

Instances get encryption at rest (with your own KMS or Key Vault key if you supply one) and automated backups. You choose the Postgres version (14--17), instance size (small maps to db.t3.medium on AWS, medium to db.r7g.large, large to db.r7g.xlarge -- with equivalent tiers on GCP and Azure), and backup retention. High availability adds a standby replica with automatic failover.

Outputs include host, port, connectionString, and credentials. Other installations in the same environment can reference these outputs to connect without manual configuration.

To use your own encryption key, the key must already exist in the environment's region and the database service must be able to use it: on AWS the KMS key policy must allow the provisioning role kms:DescribeKey and kms:CreateGrant; on GCP the Cloud SQL service agent needs roles/cloudkms.cryptoKeyEncrypterDecrypter on the key; on Azure a user-assigned identity with the Key Vault Crypto Service Encryption User role is required. The key is fixed at creation time and changing it later replaces the instance.

Configuration Inputs

This blueprint accepts 23 configurable inputs to customize the installation for your environment.

nodeGroupstring

Value of the `ryvn.app/node-group-name` label for the database user provisioner and metrics exporter pods. Leave blank to omit this node selector. Does not affect the managed database or Tailscale proxies.

tolerationsstring

YAML list of Kubernetes tolerations for the database user provisioner and metrics exporter pods. Leave blank to retain chart defaults. Does not affect the managed database or Tailscale proxies.

versionstring

Postgres major version.

sizestring

Instance size. Small is suitable for development and low-traffic workloads, medium for most production workloads, and large for higher-throughput or memory-intensive workloads.

storageGBnumber

Initial storage in GB. Storage scales up automatically as needed but cannot be decreased. Azure values below 32 GiB are set to 32.

highAvailabilityboolean

Deploy a standby replica with automatic failover. Recommended for production workloads.

databaseNamestring

Name of the database to create.

usernamestring

Username for the database.

passwordstring

Master password for the database. Minimum 8 characters.

backupRetentionDaysnumber

Number of days to retain automated backups. Set to 0 to disable automated backups on AWS and GCP. Azure requires 7-35 days and will reject 0.

deletionProtectionboolean

Protects the database from accidental destruction. Disable before tearing down an environment.

encryptionKeyIdstring

Customer-managed encryption key for data at rest (KMS key ARN on AWS, Cloud KMS key on GCP, Key Vault key on Azure). Leave blank to use the cloud provider's managed keys.

encryptionKeyIdentityIdstring

User-assigned managed identity the server uses to access the Key Vault key. Required with an encryption key on Azure.

enableReadOnlyUserboolean

Provision an additional Postgres role with SELECT on all tables in the public schema, including future tables created by the master user. Useful for analytics and BI tools.

readOnlyUsernamestring

Username for the read-only role. Lowercase letters, digits, and underscores only.

readOnlyPasswordstring

Password for the read-only user. Minimum 8 characters.

enableReadWriteUserboolean

Provision an additional Postgres role with SELECT/INSERT/UPDATE/DELETE on all tables in the public schema, plus matching default privileges so future tables are covered. Useful for application services that should not run with master credentials.

readWriteUsernamestring

Username for the read-write role. Lowercase letters, digits, and underscores only.

readWritePasswordstring

Password for the read-write user. Minimum 8 characters.

enableMetricsboolean

Collect Postgres engine metrics such as connections, transaction and tuple rates, cache hit ratio, locks and database size. Provisions a dedicated monitoring role, which can read Postgres statistics only, never your data, and runs a small exporter pod in your cluster that scrapes the database.

monitorUsernamestring

Username for the monitoring role. Lowercase letters, digits, and underscores only.

monitorPasswordstring

Password for the monitoring role. Minimum 8 characters.

exposeToTailnetboolean

Expose the Postgres host to your Tailnet using Tailscale. Where the database has a DNS endpoint (AWS, Azure) it becomes reachable under a hostname derived from the installation and environment name; where it has only a private IP (GCP Cloud SQL) a subnet router advertises the host and the advertised route must be approved in your Tailnet. Requires the Tailscale operator to already be installed in the environment.

Outputs

This blueprint exposes 13 outputs that other services can reference.

hoststring

Hostname for connecting to the database from other services.

portnumber

Port number for database connections (typically 5432).

endpointstring

Connection endpoint in host:port format.

databaseNamestring

Name of the created database.

usernamestring

Username for database authentication.

passwordstring

Master password for database authentication.

connectionStringstring

Full connection string in postgresql://user:pass@host:port/db?sslmode=require format. SSL is required for connections.

readOnlyUsernamestring

Username of the read-only role.

readOnlyPasswordstring

Password for the read-only role.

readOnlyConnectionStringstring

Connection string for the read-only role.

readWriteUsernamestring

Username of the read-write role.

readWritePasswordstring

Password for the read-write role.

readWriteConnectionStringstring

Connection string for the read-write role.