@leverege/build-tools 2.45.0 → 2.46.0-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.45.0",
+  "version": "2.46.0-beta.1",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -60,9 +60,12 @@
     "enquirer": "^2.4.1",
     "execa": "^8.0.1",
     "glob": "^10.3.10",
+    "handlebars": "^4.7.8",
+    "inquirer": "^9.2.14",
     "js-yaml": "^4.1.0",
     "ms": "^2.1.3",
     "npm-registry-fetch": "^16.1.0",
+    "package-up": "^5.0.0",
     "parse-gitignore": "^2.0.0",
     "read-pkg": "^9.0.1",
     "readline-sync": "^1.4.10",

package/src/Docker.mjs

@@ -0,0 +1,252 @@
+import fs from 'node:fs'
+
+import chalk from 'chalk'
+import handlebars from 'handlebars'
+
+import { errorExit, log, shellCmd, warning } from './Utils.mjs'
+
+// The contents of these variables were initially located in files that live in
+// the build-tools repository, but it just became simpler to pull the contents
+// directly into these variables and forego the file loading.
+//
+const dockerfileTemplate = `
+# Version {{regvers}} @ {{date}}
+#
+# The FROM directive sets the Base Image for subsequent instructions
+FROM node:{{nodeimage}} as intermediate
+ENV NODE_ENV production
+
+RUN mkdir -p /usr/src/app
+WORKDIR /usr/src/app
+
+# Install app dependencies
+COPY ./workspace/ /usr/src/app/
+ENV GRPC_VERBOSITY ERROR
+
+# --------------------------------------------------------------
+# copy the ssh keys into place, npm install, and remove them
+# --------------------------------------------------------------
+
+# Install packages to install private repos with ssh keys
+COPY ./.npmrc /usr/src/app/.npmrc
+RUN apk --no-cache add openssh-client && \
+    apk --update add --no-cache --virtual build-dep g++ gcc libgcc \\
+      libstdc++ linux-headers make {{apkadds}} && \
+    npm install -g npm@10 && \
+    npm ci --only=production --ignore-scripts --no-optional {{npmlogging}} && \
+    rm -f /usr/src/app/.npmrc /root/.ssh/*
+
+# --------------------------------------------------------------
+# On to the real build now, the thing before was just an intermediate container
+# --------------------------------------------------------------
+
+FROM node:{{nodeimage}}
+
+# Install tini for PID 1 and replace shell with bash so we can source files
+RUN apk update && \
+    apk add --no-cache bash curl tini vim {{apkadds}} && \
+    npm install -g npm@10 && \
+    rm /bin/sh && ln -s /bin/bash /bin/sh && \
+    mkdir -p /usr/src/app /tmp/levlog && \
+    chown node:node /usr/src/app
+
+{{pluginfile}}
+
+ENTRYPOINT [ "/sbin/tini", "--" ]
+WORKDIR /usr/src/app
+
+COPY --chown=node:node --from=intermediate /usr/src/app /usr/src/app
+
+USER {{runuser}}
+COPY ./bashrc /home/node/.bashrc
+CMD [ "/bin/bash", "-c", "node index.js" ]`
+
+const pluginTemplate = `
+# Dockerfile.plugin - optionally extend the service Docker image
+#
+# This file may be used to run additional docker commands during the image
+# build process without needing to maintain a local custom Dockerfile. For
+# example, uncommenting the following docker RUN command will cause the
+# curl and vim packages to be added to the deployed image thus making them
+# available from the pod's command line on k8s:
+#
+# RUN apk update && apk add --no-cache curl vim
+#
+# Keep in mind that the Alpine Linux base image is used to keep image
+# footprints small, so adding packages "just because" is not considered
+# a best practice.
+`
+
+const bashrcTemplate = `
+#!/bin/bash
+#
+alias h=history
+
+alias ls='ls -CF --color=auto'
+alias ll='ls -lh'
+alias lla='ls -lha'
+alias glep='grep -l -s'
+alias m=less
+alias menv='env | sort | less'
+
+alias whatsmyip='wget -qO- ifconfig.co'
+
+alias err='wget -q -O- localhost:5111/logLevel/error'
+alias wrn='wget -q -O- localhost:5111/logLevel/warn'
+alias inf='wget -q -O- localhost:5111/logLevel/info'
+alias dbg='wget -q -O- localhost:5111/logLevel/debug'
+alias trc='wget -q -O- localhost:5111/logLevel/trace'
+
+socks()
+{
+  netstat -ant | awk '{print }' | sort | uniq -c | sort -n
+}
+
+cmetrics()
+{
+  wget -qO- localhost:5111/metrics
+}
+
+cmstat()
+{
+  wget -qO- localhost:5111${1}
+}
+
+cmclear()
+{
+  cmstat /status/clear
+}
+`
+
+// Just uses the old dockreate of formatting the date.
+const dateTimestamp = await shellCmd( 'date +%Y%m%d-%H%M' )
+
+const defaultSettings = {
+  apkadds : '',
+  date : dateTimestamp,
+  nodeimage : 'iron-alpine',
+  npmlogging : '--silent',
+  pluginfile : '# NO PLUGIN',
+  regvers : 'package.version',
+  runuser : 'node',
+}
+
+const previousFile = './docker/.previous'
+
+const getPreviousBuild = () => {
+  return fs.existsSync( previousFile ) ? fs.readFileSync( previousFile ) : 'FIRST BUILD'
+}
+
+const setPreviousBuild = ( version ) => {
+  fs.writeFileSync( previousFile, version )
+}
+
+const generateDockerfile = ( settings = defaultSettings ) => {
+
+  log( chalk.green.bold( 'Validating the docker structure\n' ) )
+
+  // Ensure the presence of the docker dir with plugin and bashrc - this code
+  // could probably be tightened up a little.
+  try {
+    fs.readdirSync( './docker' )
+  } catch ( err ) {
+    warning( 'creating the missing ./docker directory' )
+    fs.mkdirSync( './docker' ) // TODO: blindly assumes the mkdir succeeds
+  }
+
+  const bashrcFile = './docker/bashrc'
+  if ( !fs.existsSync( bashrcFile ) ) {
+    warning( `creating the missing ${bashrcFile} file in the docker directory` )
+    fs.writeFileSync( bashrcFile, bashrcTemplate )
+  }
+
+  const dockerfilePlugin = './docker/Dockerfile.plugin'
+  if ( !fs.existsSync( dockerfilePlugin ) ) {
+    warning( `creating the missing ${dockerfilePlugin} file in the docker directory` )
+    fs.writeFileSync( dockerfilePlugin, pluginTemplate )
+  }
+
+  try {
+    const build = fs.readdirSync( './build' )
+    if ( build.length === 0 ) {
+      errorExit( `***ERROR: the build dir is empty - ${chalk.yellow( 'run npm build' )}` )
+    }
+  } catch ( err ) {
+    errorExit( `***ERROR: expected the ./build directory to exist - ${chalk.yellow( 'run npm build' )}` )
+  }
+
+  // At this point the plugin template better exist.
+  if ( fs.existsSync( dockerfilePlugin ) ) {
+    defaultSettings.pluginfile = fs.readFileSync( dockerfilePlugin )
+  } else {
+    errorExit( `***ERROR: something went wrong with ${dockerfilePlugin} plugin creation` )
+  }
+
+  const compiled = handlebars.compile( dockerfileTemplate )
+  const replaced = compiled( settings )
+  const dockerfile = './docker/Dockerfile'
+  try {
+    fs.writeFileSync( dockerfile, replaced )
+  } catch ( err ) {
+    errorExit( `***ERROR: failed to write ${dockerfile}\n${err}` )
+  }
+
+  const previousBuild = getPreviousBuild()
+  const dockerInfo = { dockerfile, previousBuild, ...defaultSettings }
+  delete dockerInfo.pluginfile
+  return dockerInfo
+}
+
+const formCloudBuildBucketName = ( artifactProject ) => {
+  return `gs://${artifactProject}_cloudbuild`
+}
+
+const validateCloudBuildBucket = async ( artifactProject ) => {
+  const bucketName = formCloudBuildBucketName( artifactProject )
+  log( chalk.green.bold( `Verifying the build bucket exists => ${bucketName}\n` ) )
+  try {
+    await shellCmd( `gsutil ls -p ${artifactProject} -b ${bucketName}` )
+  } catch ( error ) {
+    errorExit( `***Error: from Docker.validateCloudBuildBucket\n\n${chalk.bold.yellow( error )}` )
+  }
+}
+
+const buildContainerImage = async ( { artifactProject, artifactRegistry, containerName, imageVersion } ) => {
+  const cloudBuildWorkspace = './docker/workspace'
+
+  if ( fs.existsSync( cloudBuildWorkspace ) ) {
+    fs.renameSync( cloudBuildWorkspace, `${cloudBuildWorkspace}-junk` )
+    fs.rm( `${cloudBuildWorkspace}-junk`, { recursive : true }, ( err ) => {} ) // fire and forget
+  }
+
+  fs.mkdirSync( cloudBuildWorkspace )
+
+  fs.cpSync( './build', './docker/workspace', { recursive : true } )
+  fs.cpSync( `${process.env.HOME}/.npmrc`, './docker/.npmrc' )
+  fs.cpSync( './package.json', './docker/workspace/package.json' )
+  fs.renameSync( './package-lock.json', './docker/workspace/package-lock.json' )
+
+  setPreviousBuild( imageVersion ) // update docker/.previous file
+
+  const gcloudBuild = `time gcloud builds submit --project ${artifactProject}`
+  const gcloudLogs = `--gcs-log-dir ${formCloudBuildBucketName( artifactProject )}/log`
+  const gcloudTags = `--tag ${artifactRegistry}/images/${containerName}:${imageVersion}`
+
+  log( chalk.green.bold( `
+  *** Submitting Build ***
+      ${gcloudBuild} \\
+           ${gcloudLogs}  \\
+           ${gcloudTags}
+  ` ) )
+
+  await shellCmd( `${gcloudBuild} ${gcloudLogs} ${gcloudTags} ./docker`, { stdio : 'inherit' } )
+}
+
+export default {
+  getPreviousBuild,
+  setPreviousBuild,
+  generateDockerfile,
+  formCloudBuildBucketName,
+  validateCloudBuildBucket,
+  buildContainerImage,
+}

package/src/Utils.mjs

@@ -2,6 +2,9 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs'
 
 import chalk from 'chalk'
 import { $ } from 'execa'
+import inquirer from 'inquirer'
+import { glob } from 'glob'
+import { packageUp } from 'package-up'
 import YAML from 'js-yaml'
 
 const debugEnabled = process.env.BUILD_TOOLS_DEBUG === '1'
@@ -19,12 +22,34 @@ export const condir = ( obj, text = '' ) => {
 export const debug = ( obj, text ) => {
   if ( debugEnabled ) { condir( obj, text ) }
 }
+export const warning = ( warningText ) => {
+  const fullWarning = `***WARNING: ${warningText}`
+  console.error( `\n${chalk.yellow.bold( fullWarning )}` )
+}
+
 export const errorExit = ( error, opts = { errorCode : 1 } ) => {
   console.error( `\n${chalk.red.bold( error )}\n` )
   if ( opts?.errorCode ) { process.exit( opts.errorCode ) }
 }
 /* eslint-enable no-console */
 
+/**
+ * General "yes" to proceed function.
+ */
+export const proceed = async ( query = 'Do you wish to proceed?' ) => {
+  await inquirer.prompt( [
+    {
+      type : 'confirm',
+      name : 'proceed',
+      message : query,
+      default : true,
+    }
+  ]
+  ).then( ( answer ) => {
+    if ( !answer.proceed ) { process.exit( 0 ) }
+  } )
+}
+
 export const shellCmd = async ( cmdstr, opts = {} ) => {
   try {
     // due to the escaping rules we pull apart the cmdstr and invoke $ using
@@ -85,42 +110,165 @@ export const parseJsonFile = async ( jsonFile ) => {
       throw new Error( `${error} in ${jsonFile}` )
     }
   } 
-  throw new Error( `File ${jsonFile} does not exist` )
+  throw new Error( `Utils.parseJsonFile: file ${jsonFile} does not exist in ${process.cwd()}` )
   /* eslint-enable security/detect-non-literal-fs-filename */
 }
 
 // Parses the ./package.json file and verifies there is a properly formatted
 // leverege.registry section present.
+const deprecated = ( opts ) => {
+  log( chalk.red.bold( `\n  ***DEPRECATED: ${opts.deprecationError}` ) )
+  log( chalk.white( opts.deprecationInfo ) )
+  process.exit( 1 )
+}
+
 export const parsePackageJson = async ( packageFileName ) => {
   const packageJson = await parseJsonFile( packageFileName )
 
+  // deprecation checks are here to ease the pain of upgrading older repos
   const leveregeClauseError = `leverege.registry statement, it should
        resemble something like:
 
     "leverege": {
-      "registry": "us-docker.pkg.dev/leverege-registry/<REPO NAME>"
+      "registry": "us-docker.pkg.dev/leverege-registry/<registry folder>"
     },
 
-`
 
-  if ( !packageJson?.leverege?.registry ) {
+Where <registry folder> should be an existing folder in the artifact-registry.
+`
+  const registry = packageJson?.leverege?.registry
+  if ( !registry ) {
     errorExit( `Error: package.json is missing a proper ${leveregeClauseError}` )
   }
 
-  const artifacts = packageJson.leverege.registry.split( '/' )
-  if ( artifacts.length !== 3 ) {
+  const registryComponents = registry.split( '/' )
+  if ( registryComponents.length !== 3 ) {
     errorExit( `Error: package.json has a malformed ${leveregeClauseError}` )
   }
 
-  return {
-    artifactRegistry : {
-      registry : packageJson.leverege.registry,
-      region : artifacts[0],
-      project : artifacts[1],
-      repository : artifacts[2],
-    },
-    ...packageJson,
+  const [ region, project, repository ] = registryComponents
+  const artifactRegistry = { region, project, repository }
+
+  // DEPRECATED: leverege.project
+  if ( packageJson?.leverege?.project ) {
+    const removeLine = `"project": "${packageJson.leverege.project}",`
+
+    const deprecationError = 'leverege.project is no longer supported'
+    const deprecationInfo = `
+  Setting the project in the package.json leverege section was used for builds
+  being stored in the deprecated GCP container registry. Remove the deprecated
+  leverege.project setting from package.json and try again.
+
+  "leverege": {
+    ${chalk.red.bold( removeLine )}
+    ...
+  }
+`
+    deprecated( { deprecationError, deprecationInfo } )
+  }
+
+  // DEPRECATED: leverege.container
+  if ( packageJson?.leverege?.container ) {
+    const removeLine = `"container": "${packageJson.leverege.container}",`
+
+    const deprecationError = 'leverege.container is no longer supported'
+    const deprecationInfo = `
+  Setting the container name explicitly from the package.json leverge block
+  is no longer supported. The container name will be automatically derived
+  from the git repository's remote root, which is the default behavior. Remove
+  the container line from the leverege section in package.json and try again.
+
+  "leverege": {
+    ${chalk.red.bold( removeLine )}
+    ...
+  }
+`
+    deprecated( { deprecationError, deprecationInfo } )
+  }
+
+  // DEPRECATED: leverege.nodeimg
+  if ( packageJson?.leverege?.nodeimg ) {
+    const removeLine = `"nodeimg": "${packageJson.leverege.nodeimg}",`
+
+    const deprecationError = 'leverege.nodeimg is no longer supported'
+    const deprecationInfo = `
+  Setting the node base image using the nodeimg statement in package.json is no
+  longer supported. By default the actual node image version will be defaulted
+  by this script and will rarely need to be a specific version.  Remove the
+  nodeimg line from the leverege section in package.json and try again.
+
+  "leverege": {
+    ${chalk.red.bold( removeLine )}
+    ...
+  }
+`
+    deprecated( { deprecationError, deprecationInfo } )
+  }
+
+  // DEPRECATED: leverege.artifact
+  if ( packageJson?.leverege?.artifact ) {
+    const removeLine = `"artifact": "${packageJson.leverege.artifact}",`
+    const replaceLine = `"registry": "us-docker.pkg.dev/leverege-registry/${packageJson.leverege.artifact}",`
+
+    const deprecationError = 'leverege.artifact is no longer supported'
+    const deprecationInfo = `
+  Setting the registry folder via the ${chalk.yellow.bold( 'artifact' )} statement is no longer supported.
+  Instead use the ${chalk.green.bold( 'leverege.registry' )} setting to specify the full artifact registry
+  and folder used for storing the docker image. Replace the artifact line with the
+  full registry path in package.json and try again.
+
+  "leverege": {
+    ${chalk.red.bold( removeLine )}
+    ${chalk.green.bold( replaceLine )}
+    ...
   }
+`
+    deprecated( { deprecationError, deprecationInfo } )
+  }
+
+  // DEPRECATED: leverege.nodeops
+  if ( packageJson?.leverege?.nodeops ) {
+    const removeLine = `"nodeops": "${packageJson.leverege.nodeops}",`
+
+    const deprecationError = 'leverege.nodeops is no longer supported'
+    const deprecationInfo = `
+  Setting the hard coded node options on the image is no longer supported. The
+  better approach is to add ${chalk.green.bold( 'NODE_OPTIONS' )} to the config section of the chart's
+  values.yaml to allow downstream users to easily tune the options as needed.
+  Remove the nodeops line from the leverege section in package.json and try again.
+
+  "leverege": {
+    ${chalk.red.bold( removeLine )}
+    ...
+  }
+`
+    deprecated( { deprecationError, deprecationInfo } )
+  }
+
+  // DEPRECATED: old reference to ./dist should be ./build
+  const { build, clean, dockerize, } = packageJson.scripts
+
+  if ( build.match( 'dist' ) || clean.match( 'dist' ) || dockerize.match( 'dockreate|cd docker' ) ) {
+    const deprecationError = `
+
+  Update the npm build, clean and dockerize scripts to use ./build instead of
+  the old ./dist directory, and docker-to-registry instead of the deprecated
+  dockreate script - note there is no longer a need to change dir into docker
+  in the dockerize script.
+    `
+    const deprecationInfo = `
+  "scripts": {
+    "build": "npm run clean && mkdir ./build && cp -r ./src/* ./build",
+    ...
+    "clean": "rm -fr coverage build",
+    "dockerize": "npm run build && docker-to-registry",
+    ...
+  },
+  `
+
+    deprecated( { deprecationError, deprecationInfo } )
+  }
+  return { artifactRegistry, ...packageJson }
 }
 
 export const parseHelmChart = async ( helmroot ) => {
@@ -137,3 +285,61 @@ export const parseHelmChart = async ( helmroot ) => {
     }
   } )
 }
+
+export const analyzeRepository = async () => {
+  const gitRoot = await getGitRootDirectory()
+  const subPkgs = await glob( `${gitRoot}/packages/**/package.json`, { ignore : '/**/node_modules/**' } )
+  const isMonoRepo = subPkgs?.length > 0
+
+  let rootPackageJson
+  try {
+    rootPackageJson = await parseJsonFile( `${gitRoot}/package.json` )
+  } catch ( error ) {
+    rootPackageJson = { invalid : true, error : 'invalid or non-existent root package.json file' }
+  }
+  const isNpmWorkspace = subPkgs?.length > 0
+
+  log( chalk.green.bold( '\nParsing and analyzing the package.json file\n' ) )
+  let closestPackageJson
+  try {
+    closestPackageJson = await parsePackageJson( './package.json' )
+  } catch ( error ) {
+    errorExit( error )
+  }
+  const containerName = closestPackageJson.name
+  const artifactProject = closestPackageJson.artifactRegistry.project
+  const artifactRegistry = closestPackageJson.leverege.registry
+
+  const currentDir = process.cwd()
+  const closestPkg = await packageUp()
+
+  // get the name of the current workspace, if we're in one
+  let wsName
+  try {
+    wsName = await shellCmd( 'npm exec -c pwd -ws' )
+  } catch ( err ) { }
+
+  let gitRemote
+  try {
+    gitRemote = await shellCmd( 'git config --get remote.origin.url' )
+  } catch ( err ) { }
+
+  // TODO: Add in Define VERBOSE_DOCKREATE_NPM="yes" for verbose build logging
+  // TODO: Validity check for version and package.json
+
+  return {
+    artifactProject,
+    artifactRegistry,
+    containerName,
+    currentDir,
+    closestPkg,
+    gitRoot,
+    gitRemote,
+    isMonoRepo,
+    isNpmWorkspace,
+    rootPackageJson,
+    closestPackageJson,
+    subPkgs,
+    wsName,
+  }
+}

package/src/docker-to-registry.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+/*
+ * docker-to-registry will...
+ */
+import chalk from 'chalk'
+
+import {
+  debug, log,
+  errorExit,
+  analyzeRepository,
+  proceed,
+  shellCmd } from './Utils.mjs'
+
+import docker from './Docker.mjs'
+
+// refresh-npm-token does not throw so no need to try, but it emits in debug
+const refreshErr = await shellCmd( 'refresh-npm-token' )
+if ( refreshErr && !process.env.BUILD_TOOLS_DEBUG ) {
+  errorExit( `***Error: npm token refresh failed\n\n${refreshErr}` )
+}
+
+// Expected to be invoked like docker-to-registry v1.2.3
+const imageVersion = process.argv[2]
+const willGitTag = imageVersion.match( /^v\d+\.\d+\.\d+$/ )
+const tagInfo = willGitTag ?
+  chalk.yellow.bold( 'will be git tagged' ) :
+  chalk.red( 'BETA RELEASE WILL NOT BE GIT TAGGED' )
+
+const repoDescr = await analyzeRepository()
+debug( { repoDescr }, '<==The Repo Description' )
+
+const dockerInfo = await docker.generateDockerfile()
+debug( { dockerInfo }, '<==The Docker Info' )
+
+const { artifactProject, artifactRegistry, containerName } = repoDescr
+
+await docker.validateCloudBuildBucket( artifactProject )
+
+const registryFolder = `${artifactRegistry}/images/${containerName}`
+
+// Update the dependencies...
+log( chalk.green.bold( 'Updating dependencies and workspace...' ) )
+await shellCmd( 'npm install', { stdio : 'inherit' } )
+
+// Give the summary and the user a chance to proceed or not
+log( `
+  ${chalk.green.bold( 'Build Information:' )}
+    Container:     ${chalk.green.bold( containerName )}
+    Version:       ${chalk.green.bold( imageVersion )}   ${tagInfo}
+    Registry:      ${chalk.green.bold( artifactRegistry )}
+    Image Folder:  ${chalk.yellow.bold( registryFolder )}
+    Monorepo:      ${chalk.green.bold( repoDescr.isMonoRepo )}
+    NPM Workspace: ${chalk.green.bold( repoDescr.isNpmWorkspace )}
+
+  ${chalk.green.bold( 'Docker Information:' )}
+    NodeImage:     ${chalk.green.bold( dockerInfo.nodeimage )}
+    AddedPkgs:     ${chalk.green.bold( dockerInfo.apkadds )}
+    Run User:      ${chalk.green.bold( dockerInfo.runuser )}
+    Previous:      ${chalk.yellow.bold( dockerInfo.previousBuild )}
+    DateStamp:     ${chalk.green.bold( dockerInfo.date )}
+    NPM Logs:      ${chalk.green.bold( dockerInfo.npmlogging )}
+` )
+
+await proceed()
+
+if ( repoDescr.isNpmWorkspace ) {
+  log( chalk.yellow.bold( 'Generating an NPM workspace package-lock.json file' ) )
+  await shellCmd( 'npm install --package-lock-only --workspaces false', { stdio : 'inherit' } )
+}
+
+await docker.buildContainerImage( { artifactProject, artifactRegistry, containerName, imageVersion } )

package/src/helm-charts/timescale-db/timescale-db-local.yaml

@@ -1,15 +1,15 @@
 postgresql:
   postgresqlExtendedConf:
-    maxWorkerProcesses: 8
-    maxParallelWorkers: 8
-    maxConnections: 500
-    sharedBuffers: 2GB
-    effectiveCacheSize: 6GB
-    maintenanceWorkMem: 1GB
-    workMem: 20MB
-    idle_in_transaction_session_timeout: 30000 # 30ms timeout
-    maxWalSize: 2GB
-    walKeepSegments: 64
+    effectiveCacheSize: 6GB  # 524288 8kB
+    idle_in_transaction_session_timeout: 30000 # 0 ms
+    maintenanceWorkMem: 1GB  # 65536 kB
+    maxConnections: 500      # 100
+    maxParallelWorkers: 8    # 32
+    maxWalSize: 2GB          # 80 MB
+    maxWorkerProcesses: 8    # 32
+    sharedBuffers: 2GB       # 16384 8kB
+    walKeepSegments: 64      # deprecated
+    workMem: 20MB            # 4096 kB
 
   resources:
     requests: