Skip to content

postgresql

Field Value
ID postgresql
Class host
Role database-server
Status active
Primary IP 192.168.6.252
On host prox (LXC 102)
Tags prod, proxmox-lxc, database, community-script
Ansible yes (proxmox-guests → ansible_user: root)
Inventory inventory/hosts/postgresql.yaml

Overview

Community-scripts PostgreSQL LXC on Prox (Debian 13 / trixie). Created after Wave A destroyed the prior aiproject guest that used VMID 102 — same VMID, different workload.

Attribute Live
Hostname postgresql
IP 192.168.6.252 (Servers VLAN)
MAC bc:24:11:10:55:d9
Cores / RAM 4 / 4 GiB
rootfs 8G local-lvm
Postgres listening :5432 (service active)
LXC nameserver 192.168.6.17 (AdGuard)

Ansible groups: proxmox-guests, patching_targets, patching_wave1_guests, wazuh-agents, debian. Patch-controller can SSH as root@192.168.6.252.

Access

Method Target
From infra-services sudo ssh -i /etc/homelab/patch-controller/id_ed25519 root@192.168.6.252
Via prox pct enter 102
Postgres 192.168.6.252:5432 (confirm pg_hba before opening clients)

Ansible / operator shell

ansible-pull + common role apply (patch metrics, node_exporter, wazuh). Golden operator-shell is disabled for this host (host_vars/postgresql.yml) — 8G rootfs and no someone user; installing mise/rustup filled the disk and broke pull.

Backup (design)

In-guest restic to Whrrr NFS is not supported on unprivileged Prox LXCs (same constraint as phoenix/sonarqube — see site.yml backup-client play).

Preferred stack when implementing:

  1. Primary — logical dumps into restic (via C&C): scheduled pg_dumpall (or per-DB pg_dump -Fc) on the LXC, stage under /var/backups/postgresql/, pull to infra-services (same pattern as backups/external/fetch-authentik-db.sh), then restic repo under /mnt/infra-backups/homelab-restic/… with textfile metrics. Restores are consistent and app-aware.
  2. Secondary — Prox vzdump of LXC 102: whole-guest DR only. Crash-consistent at best unless dump uses guest freeze; not a substitute for pg_dump. Prox currently has no cluster vzdump schedule (jobs.cfg empty) — add a job to infra-backups if you want guest-level recovery.
  3. Avoid: relying on vzdump alone, or mounting Whrrr restic from inside the CT.

Runbooks