cnpg: flip all 4 DBs out of recovery -> initdb (post-nuke hygiene)

After the 2026-06-28 kopiur-only nuke, all four CNPG DBs recovered from their
prior lineage and write forward to the bumped target (gitea v10, immich v6,
paperless v6, temporal v8). Flip the root kustomizations overlays/recovery ->
overlays/initdb so a future PVC loss can't auto-restore the stale source
lineage; recovery is re-enabled per-DB only as an explicit DR action. No-op on
the running healthy clusters (CNPG reads bootstrap only at creation); serverName
unchanged. Also refresh the lineage table + mark the Barman-plugin migration
done in infrastructure/database/CLAUDE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mitchross

infrastructure/database/CLAUDE.md

@@ -56,10 +56,18 @@ The `serverName` values below live in each DB's `base/cluster.yaml` and
 
 | Database  | Current write target (base)  | Prior lineage (recovery source) |
 |-----------|------------------------------|---------------------------------|
-| gitea     | `gitea-database-v9`          | `gitea-database-v6`             |
-| immich    | `immich-database-v5`         | `immich-database-v4`            |
-| paperless | `paperless-database-v5`      | `paperless-database-v4`         |
-| temporal  | `temporal-database-v7`       | `temporal-database-v6`          |
+| gitea     | `gitea-database-v10`         | `gitea-database-v9`             |
+| immich    | `immich-database-v6`         | `immich-database-v5`            |
+| paperless | `paperless-database-v6`      | `paperless-database-v5`         |
+| temporal  | `temporal-database-v8`       | `temporal-database-v7`          |
+
+2026-06-28 (first kopiur-only full nuke): all four recovered from their prior
+lineage and write forward to the bumped target above (gitea v9→v10, immich
+v5→v6, paperless v5→v6, temporal v7→v8). After recovery completed and the
+primaries went healthy, all four root kustomizations were **flipped back
+`overlays/recovery` → `overlays/initdb`** (steady state) so a future PVC loss
+can't auto-restore a stale lineage. Recovery is re-enabled per-DB only as an
+explicit DR action.
 
 All four bumped TWICE on 2026-06-11: once for the Longhorn V2 rebuild nuke,
 and again for the same-day re-nuke (SPDK cpu-mask validation run) because the
@@ -129,9 +137,14 @@ See the full runbook in [`docs/domains/cnpg/disaster-recovery.md`](../../docs/do
 
 ## Deprecation warnings
 
-- **Native `spec.backup.barmanObjectStore`** — will be removed in CNPG 1.30.0.
-  Migrate to the Barman Cloud Plugin (already installed at
-  `infrastructure/database/cnpg-barman-plugin/`). Not urgent; track release notes.
+- **Native `spec.backup.barmanObjectStore` — MIGRATION DONE.** All four DBs use
+  the Barman Cloud Plugin (`infrastructure/database/cnpg-barman-plugin/`):
+  live backup config is `spec.plugins[]` (name `barman-cloud.cloudnative-pg.io`,
+  `isWALArchiver: true`, `parameters.barmanObjectName` → a sibling `ObjectStore`
+  CR + `parameters.serverName`), and recovery is `externalClusters[].plugin`.
+  The in-tree `barmanObjectStore` field is removed in CNPG 1.30.0 — do not
+  reintroduce it. (When adding a NEW DB, set serverName via the plugin
+  `parameters`, not `backup.barmanObjectStore`.)
 - **`spec.monitoring.enablePodMonitor`** — deprecated, replace with manually-
   managed `PodMonitor` resources per cluster.
 

infrastructure/database/cloudnative-pg/gitea/kustomization.yaml

@@ -20,10 +20,11 @@ commonLabels:
 commonAnnotations:
   argocd.argoproj.io/sync-wave: "-5"
 resources:
-  - overlays/recovery        # ← ACTIVE: restore gitea DB FROM v9 (current data,
-                             # pre-nuke). Writes forward to v10 (clean, unused
-                             # prefix) to pass barman-cloud-check-wal-archive.
-  # - overlays/initdb        # fresh empty DB (1 admin, 0 repos). Was active
-                             # while v5 was (wrongly) assumed unrestorable.
+  # - overlays/recovery      # DR-only: restore gitea DB FROM v9 → write v10.
+                             # Before a planned nuke, bump base serverName and
+                             # set this overlay's source, then re-enable.
+  - overlays/initdb          # ← ACTIVE (steady state; recovery completed
+                             # 2026-06-28). bootstrap.initdb is a no-op on the
+                             # existing cluster; writes forward to base v10.
   - externalsecret.yaml
   - scheduled-backup.yaml

infrastructure/database/cloudnative-pg/immich/kustomization.yaml

@@ -12,7 +12,7 @@ commonLabels:
 commonAnnotations:
   argocd.argoproj.io/sync-wave: "-5"
 resources:
-  - overlays/recovery        # ← ACTIVE: restore from Barman v5 → write v6 (nuke recovery)
-  # - overlays/initdb        # fresh DB / normal operation
+  # - overlays/recovery      # DR-only: restore from Barman v5 → write v6. Re-enable before a nuke.
+  - overlays/initdb          # ← ACTIVE (steady state; recovered 2026-06-28). No-op on existing cluster; writes v6.
   - externalsecret.yaml
   - scheduled-backup.yaml

infrastructure/database/cloudnative-pg/paperless/kustomization.yaml

@@ -11,7 +11,7 @@ commonLabels:
 commonAnnotations:
   argocd.argoproj.io/sync-wave: "-5"
 resources:
-  - overlays/recovery        # ← ACTIVE: restore from Barman v5 → write v6 (nuke recovery)
-  # - overlays/initdb        # fresh DB / normal operation
+  # - overlays/recovery      # DR-only: restore from Barman v5 → write v6. Re-enable before a nuke.
+  - overlays/initdb          # ← ACTIVE (steady state; recovered 2026-06-28). No-op on existing cluster; writes v6.
   - externalsecret.yaml
   - scheduled-backup.yaml

infrastructure/database/cloudnative-pg/temporal/kustomization.yaml

@@ -11,7 +11,7 @@ commonLabels:
 commonAnnotations:
   argocd.argoproj.io/sync-wave: "-5"
 resources:
-  - overlays/recovery        # ← ACTIVE: restore from Barman v7 → write v8 (nuke recovery)
- # - overlays/initdb         # steady state. bootstrap.initdb is a no-op on existing Cluster.
+  # - overlays/recovery      # DR-only: restore from Barman v7 → write v8. Re-enable before a nuke.
+  - overlays/initdb          # ← ACTIVE (steady state; recovered 2026-06-28). bootstrap.initdb is a no-op on existing Cluster; writes v8.
   - externalsecret.yaml
   - scheduled-backup.yaml