chore(deploy): rework k8s pipeline, monitoring and postgres 17

Deploy workflow uses git-tracked manifests, DISABLED flag and kustomize overlays; add webinar-checker metrics with ServiceMonitor and alerts; upgrade shared postgres to 17 with statuspage DB and probes/resources.

postgres/.env.example

@@ -3,3 +3,4 @@ AUTHENTIK_DB_PASSWORD=
 GITEA_DB_PASSWORD=
 NETRONOME_DB_PASSWORD=
 PENPOT_DB_PASSWORD=
+STATUSPAGE_DB_PASSWORD=

postgres/README.md

@@ -1,23 +1,22 @@
 # Shared PostgreSQL
 
-This directory contains a PostgreSQL 15 deployment draft for Authentik, Gitea,
-Netronome, and Penpot. It creates one database and one login role per service;
-it does not migrate existing data or change application connection settings.
+This directory contains the shared PostgreSQL 17 deployment for Authentik,
+Gitea, Netronome, and Statuspage. It creates one database and one login role
+per service. Per-service standalone databases were removed after the
+migration (Sep 2026); Penpot stays on its own compose PostgreSQL (archived,
+not part of the shared instance).
 
 ## Compatibility baseline
 
-| Service   | Current application | Current standalone PostgreSQL | Common PostgreSQL 15                                                                 |
-| --------- | ------------------- | ----------------------------: | ------------------------------------------------------------------------------------ |
-| Authentik | 2025.10.2           |                            15 | Supported (Authentik requires 14+)                                                   |
-| Gitea     | 1.27.3              |                            14 | Supported (Gitea requires 12+)                                                       |
-| Netronome | 0.14.0              |                            17 | Validate in staging; upstream's example uses 17 but no 17-only feature is documented |
-| Penpot    | 2.17.2              |                            15 | Supported by the official deployment                                                 |
+| Service   | Current application | Shared PostgreSQL 17 |
+| --------- | ------------------- | -------------------- |
+| Authentik | 2025.10.x           | Supported (Authentik requires 14+) |
+| Gitea     | 1.27.3              | Supported (Gitea requires 12+) |
+| Netronome | 0.14.0              | Supported (upstream's example uses 17) |
+| Statuspage| custom              | Supported |
 
-PostgreSQL 15 is the conservative common major. A major-version downgrade or
-change must use a logical dump/restore; changing only the image tag while
-keeping a data directory is not supported. Back up and migrate one application
-at a time, starting with Netronome because its current standalone deployment
-uses PostgreSQL 17.
+A major-version change must use a logical dump/restore; changing only the
+image tag while keeping a data directory is not supported.
 
 For Compose, copy `.env.example` to `.env`, set all passwords, and start it with
 `docker compose -f shared-compose.yaml up -d`. This file is intentionally not

postgres/initdb/01-create-databases.sh

@@ -5,12 +5,12 @@ set -euo pipefail
 : "${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD is required}"
 : "${NETRONOME_DB_PASSWORD:?NETRONOME_DB_PASSWORD is required}"
 : "${PENPOT_DB_PASSWORD:?PENPOT_DB_PASSWORD is required}"
+: "${STATUSPAGE_DB_PASSWORD:?STATUSPAGE_DB_PASSWORD is required}"
 
 create_role_and_database() {
   local role="$1"
   local database="$2"
   local password="$3"
-
   psql --username "$POSTGRES_USER" --dbname postgres \
     -v role="$role" -v database="$database" -v password="$password" \
     <<'SQL'
@@ -25,3 +25,4 @@ create_role_and_database authentik authentik "$AUTHENTIK_DB_PASSWORD"
 create_role_and_database gitea gitea "$GITEA_DB_PASSWORD"
 create_role_and_database netronome netronome "$NETRONOME_DB_PASSWORD"
 create_role_and_database penpot penpot "$PENPOT_DB_PASSWORD"
+create_role_and_database statuspage statuspage "$STATUSPAGE_DB_PASSWORD"

postgres/k8s/postgres.yaml

@@ -60,11 +60,23 @@ spec:
               command: ["pg_isready", "-U", "postgres", "-d", "postgres"]
             initialDelaySeconds: 10
             periodSeconds: 10
+          startupProbe:
+            exec:
+              command: ["pg_isready", "-U", "postgres", "-d", "postgres"]
+            failureThreshold: 30
+            periodSeconds: 10
           livenessProbe:
             exec:
               command: ["pg_isready", "-U", "postgres", "-d", "postgres"]
             initialDelaySeconds: 30
             periodSeconds: 20
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "500m"
+            limits:
+              memory: "2Gi"
+              cpu: "2000m"
       volumes:
         - name: postgres-data
           persistentVolumeClaim:

postgres/shared-compose.yaml

@@ -1,6 +1,6 @@
 services:
   postgres:
-    image: postgres:15.19-alpine
+    image: postgres:17.11-alpine
     container_name: homelab-postgres
     restart: unless-stopped
     env_file: