alasio 6.0.0 → 8.0.0

package/dist/cli/src/manifests/neon.js

@@ -1,6 +1,10 @@
-import { computeId, MAIN } from "../../../neon/control/branches.js";
+import { COMPUTE_CTL_PORT, COMPUTE_PORT, computeId, MAIN, REPLICA_SUFFIX, replicaId } from "../../../neon/control/branches.js";
+import { SUSPEND_AFTER } from "../../../neon/control/endpoints.js";
+import { DATABASE, PAGESERVER_ZONE, ROLE } from "../../../neon/control/secrets.js";
 import { imageReference } from "../images.js";
-import { claimSpec, collectorRuns, databaseSecret, given, helperResources, imagePullSecrets, MAIN_ENVIRONMENT, NAMESPACE, neonName, ONE, otelEnv, RELEASE, replicasOf, restrictedContainer, s3Endpoint, script, selectorLabels, stackLabels, stackPodSpec, waitFor, waitForObjectStore, } from "./common.js";
+import { computeRestartPolicy } from "./admission.js";
+import { claimSpec, collectorRuns, databaseSecret, given, helperResources, imagePullSecrets, lakeRuns, MAIN_ENVIRONMENT, NAMESPACE, neonName, ONE, otelEnv, RELEASE, replicasOf, restrictedContainer, s3Endpoint, sandboxSnapshots, script, selectorLabels, stackLabels, stackPodSpec, waitFor, waitForObjectStore, } from "./common.js";
+import { durationSeconds } from "./config.js";
 import { replicaBudget, spread } from "./disruption.js";
 import { VOLUME_DRIVER } from "./juicefs-csi.js";
 import { priority } from "./priorities.js";
@@ -20,9 +24,12 @@ function secretVariable(secret, key) {
     return { name: key, valueFrom: { secretKeyRef: { name: secret, key } } };
 }
 /**
- * The stack's secrets, made once and kept, and each service's rendered from them, workspace
- * storage's among them when it is on, by neon/control/kube-setup.ts: a Job, which applying alasio runs to completion before
- * anything else of alasio starts (../kube/apply.ts).
+ * The stack's secrets, made once and kept, and each service's rendered from them, by
+ * neon/control/kube-setup.ts: the log's and the webhook intake's; and where Neon runs,
+ * Neon's, the object store's, workspace storage's when it is on, and the snapshots
+ * bucket's and the node agents' when sandboxes are snapshotted: a Job, which applying
+ * alasio runs to completion before anything else of alasio starts (../kube/apply.ts), with
+ * Neon or without it.
  */
 function setup(config) {
     const name = neonName("setup");
@@ -64,15 +71,20 @@ function setup(config) {
                             env: [
                                 { name: "NAMESPACE", valueFrom: { fieldRef: { fieldPath: "metadata.namespace" } } },
                                 { name: "SECRET_PREFIX", value: RELEASE },
-                                { name: "NEON_BROKER_URL", value: `http://${neonName("storage-broker")}:50051` },
-                                { name: "NEON_CONTROLLER_URL", value: `http://${neonName("storage-controller")}:1234` },
-                                { name: "NEON_PAGESERVER_HOST", value: neonName("pageserver") },
-                                { name: "NEON_COMPUTE_HOST", value: neonName("compute") },
-                                { name: "NEON_CONTROLLER_DB_HOST", value: neonName("controller-db") },
+                                ...(config.neon.enabled
+                                    ? [
+                                        { name: "NEON_BROKER_URL", value: `http://${neonName("storage-broker")}:50051` },
+                                        { name: "NEON_CONTROLLER_URL", value: `http://${neonName("storage-controller")}:1234` },
+                                        { name: "NEON_PROXY_HOST", value: PROXY_HOST },
+                                        { name: "NEON_CONTROLLER_DB_HOST", value: neonName("controller-db") },
+                                    ]
+                                    : []),
                                 { name: "S3_ENDPOINT", value: s3Endpoint(config) },
                                 { name: "S3_REGION", value: objectStore.external.region },
                                 { name: "S3_BUCKET_NEON", value: objectStore.buckets.neon },
                                 { name: "S3_BUCKET_LAKE", value: objectStore.buckets.lake },
+                                { name: "S3_BUCKET_BACKUPS", value: objectStore.buckets.backups },
+                                { name: "WEBHOOK_ADDRESS", value: config.webhook.publicAddress },
                                 ...(workspaceStorage.enabled
                                     ? [
                                         { name: "WORKSPACES_NAME", value: workspaceStorage.name },
@@ -83,10 +95,17 @@ function setup(config) {
                                         { name: "WORKSPACES_SECRET_LABELS", value: JSON.stringify(VOLUME_DRIVER) },
                                     ]
                                     : []),
+                                ...(sandboxSnapshots(config) ? [{ name: "SNAPSHOTS_BUCKET", value: objectStore.buckets.snapshots }] : []),
                                 ...(objectStore.bundled.enabled ? [] : [
                                     { name: "S3_EXTERNAL", value: "1" },
                                     { name: "S3_ACCESS_KEY", valueFrom: { secretKeyRef: { name: objectStore.external.existingSecret, key: "accessKey" } } },
                                     { name: "S3_SECRET_KEY", valueFrom: { secretKeyRef: { name: objectStore.external.existingSecret, key: "secretKey" } } },
+                                    ...(sandboxSnapshots(config)
+                                        ? [
+                                            { name: "S3_SNAPSHOTS_ACCESS_KEY", valueFrom: { secretKeyRef: { name: objectStore.external.snapshotsSecret, key: "accessKey" } } },
+                                            { name: "S3_SNAPSHOTS_SECRET_KEY", valueFrom: { secretKeyRef: { name: objectStore.external.snapshotsSecret, key: "secretKey" } } },
+                                        ]
+                                        : []),
                                 ]),
                             ],
                             securityContext: restrictedContainer(),
@@ -113,7 +132,7 @@ function controllerDb(config) {
             template: {
                 metadata: { labels: stackLabels(component) },
                 spec: {
-                    ...priority("floor"),
+                    ...priority("bound"),
                     ...stackPodSpec(config),
                     containers: [{
                             name: "postgres",
@@ -253,7 +272,7 @@ function safekeepers(config) {
             template: {
                 metadata: { labels: stackLabels(component) },
                 spec: {
-                    ...priority("floor"),
+                    ...priority("bound"),
                     ...stackPodSpec(config),
                     terminationGracePeriodSeconds: 30,
                     ...given("initContainers", waitForObjectStore(config)),
@@ -315,35 +334,80 @@ function safekeepers(config) {
     };
     return [headless, statefulSet, ...replicaBudget(component, NAMESPACE, config.neon.safekeepers.scaling), verticalPodAutoscaler(statefulSet, "Recommended")];
 }
+/** The name of the pageserver of ordinal `index`, its Service's, which it registers itself at: its pod's. */
+export const pageserverName = (index) => `${neonName("pageserver")}-${index}`;
+/** The pageservers' governing Service, headless, which their StatefulSet names: of no one pageserver, as pageserverName is. */
+export const PAGESERVERS_NAME = neonName("pageservers");
 /**
- * The pageserver: pages served from layers it keeps in the object store, its volume a
- * cache. It registers itself with the controller by the name in its metadata.
+ * The pageservers: pages served from layers each keeps in the object store, its volume a
+ * cache, as many as their scale fixes. Each registers itself with the storage controller
+ * as its ordinal plus one, at a Service of its own alone (pageserverName), which resolves
+ * before it is ready, as registration needs; the controller places the tenant's shards on
+ * them, and computes reach each shard's pageserver at that name (neon-control's specs),
+ * never through one address that would balance them. They start at once, none waiting for
+ * another to be ready, which waits for the storage controller: so a restore that starts what
+ * its volumes hold to a node before the rest (../commands/restore-filer-store.ts) finds
+ * every pageserver's pod made. Their StatefulSet's governing Service (PAGESERVERS_NAME) is
+ * headless, giving each pod its DNS identity, which no address uses: a pod's own Service
+ * keeps its address while it is not ready, as registration needs, and alone resolves to it.
  */
 function pageserver(config) {
     const name = neonName("pageserver");
     const component = "neon-pageserver";
     const image = imageReference(config.neon.image);
+    const { scaling, storage, resources } = config.neon.pageserver;
+    const services = Array.from({ length: scaling.min }, (_, index) => ({
+        apiVersion: "v1",
+        kind: "Service",
+        metadata: { name: pageserverName(index), namespace: NAMESPACE, labels: stackLabels(component) },
+        spec: {
+            selector: { ...selectorLabels(component), "statefulset.kubernetes.io/pod-name": `${name}-${index}` },
+            publishNotReadyAddresses: true,
+            ports: [{ name: "pg", port: 6400 }, { name: "http", port: 9898 }],
+        },
+    }));
+    const governing = {
+        apiVersion: "v1",
+        kind: "Service",
+        metadata: { name: PAGESERVERS_NAME, namespace: NAMESPACE, labels: stackLabels(component) },
+        spec: { clusterIP: "None", publishNotReadyAddresses: true, selector: selectorLabels(component), ports: [{ name: "pg", port: 6400 }, { name: "http", port: 9898 }] },
+    };
     const statefulSet = {
         apiVersion: "apps/v1",
         kind: "StatefulSet",
         metadata: { name, namespace: NAMESPACE, labels: stackLabels(component) },
         spec: {
-            serviceName: name,
-            ...replicasOf(ONE),
+            serviceName: PAGESERVERS_NAME,
+            ...replicasOf(scaling),
+            podManagementPolicy: "Parallel",
             selector: { matchLabels: selectorLabels(component) },
             template: {
                 metadata: { labels: stackLabels(component) },
                 spec: {
-                    ...priority("floor"),
+                    ...priority("bound"),
                     ...stackPodSpec(config),
+                    ...spread(component, scaling, true),
                     terminationGracePeriodSeconds: 30,
                     initContainers: [
                         {
                             name: "config",
                             image,
                             imagePullPolicy: "IfNotPresent",
-                            // Its configuration, rendered by the stack's setup, into its working directory.
-                            command: ["/bin/sh", "-c", "cp /config/pageserver.toml /config/identity.toml /config/metadata.json /config/auth_public_key.pem /data/.neon/"],
+                            // Its configuration, the stack's setup's, into its working directory, and its
+                            // identity, its own: its ordinal plus one, at its own Service's name, its pod's.
+                            // The ordinal is its pod's name's last part, as the StatefulSet names its pods,
+                            // on any Kubernetes (the pod-index label is 1.28's).
+                            command: [
+                                "/bin/sh",
+                                "-c",
+                                [
+                                    'POD_INDEX="${POD_NAME##*-}" &&',
+                                    "cp /config/pageserver.toml /config/auth_public_key.pem /data/.neon/ &&",
+                                    'echo "id=$((POD_INDEX + 1))" > /data/.neon/identity.toml &&',
+                                    `printf '{"host":"%s","port":6400,"http_host":"%s","http_port":9898,"availability_zone_id":"${PAGESERVER_ZONE}"}\\n' "$POD_NAME" "$POD_NAME" > /data/.neon/metadata.json`,
+                                ].join(" "),
+                            ],
+                            env: [{ name: "POD_NAME", valueFrom: { fieldRef: { fieldPath: "metadata.name" } } }],
                             securityContext: restrictedContainer(),
                             ...helperResources(),
                             volumeMounts: [{ name: "data", mountPath: "/data/.neon" }, { name: "config", mountPath: "/config", readOnly: true }],
@@ -360,53 +424,83 @@ function pageserver(config) {
                             ports: [{ name: "pg", containerPort: 6400 }, { name: "http", containerPort: 9898 }],
                             readinessProbe: { httpGet: { path: "/v1/status", port: "http" }, periodSeconds: 5 },
                             securityContext: restrictedContainer(),
-                            resources: config.neon.pageserver.resources,
+                            resources,
                             volumeMounts: [{ name: "data", mountPath: "/data/.neon" }],
                         }],
                     volumes: [{
                             name: "config",
-                            secret: {
-                                secretName: name,
-                                items: ["pageserver.toml", "identity.toml", "metadata.json", "auth_public_key.pem"].map((key) => ({ key, path: key })),
-                            },
+                            secret: { secretName: name, items: ["pageserver.toml", "auth_public_key.pem"].map((key) => ({ key, path: key })) },
                         }],
                 },
             },
-            volumeClaimTemplates: [{ metadata: { name: "data" }, spec: claimSpec(config.neon.pageserver.storage) }],
+            volumeClaimTemplates: [{ metadata: { name: "data" }, spec: claimSpec(storage) }],
         },
     };
-    return [service(name, component, [{ name: "pg", port: 6400 }, { name: "http", port: 9898 }]), statefulSet, verticalPodAutoscaler(statefulSet, "Recommended")];
+    return [governing, ...services, statefulSet, ...replicaBudget(component, NAMESPACE, scaling), verticalPodAutoscaler(statefulSet, "Recommended")];
+}
+/** Where every client reaches Neon's proxy, from main's namespace or a branch environment's. */
+export const PROXY_HOST = `${neonName("proxy")}.${NAMESPACE}.svc`;
+/** The port the proxy takes clients on, Postgres's own. */
+export const PROXY_PORT = 5432;
+/**
+ * What neon-control may do to the compute of `namespace`, main's or a branch
+ * environment's, and to its read replica: read its Deployment, and restart it, to start on
+ * a spec anew, and scale it, waking it and putting it to sleep, and list its pods, to see
+ * one put to sleep gone before it wakes it; a Role there, bound to neon-control's
+ * ServiceAccount in main's. Of a Deployment it patches, it may change the restart's
+ * annotation alone (./admission.ts's computeRestartPolicy).
+ */
+export function computeScaling(namespace) {
+    const name = neonName("control");
+    const metadata = { name, namespace, labels: stackLabels("neon-control") };
+    const role = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "Role",
+        metadata,
+        rules: [
+            { apiGroups: ["apps"], resources: ["deployments"], resourceNames: [neonName("compute"), REPLICA_NAME], verbs: ["get", "patch"] },
+            { apiGroups: ["apps"], resources: ["deployments/scale"], resourceNames: [neonName("compute"), REPLICA_NAME], verbs: ["patch"] },
+            // A list is of a namespace's pods, as no name narrows it.
+            { apiGroups: [""], resources: ["pods"], verbs: ["list"] },
+        ],
+    };
+    const binding = {
+        apiVersion: "rbac.authorization.k8s.io/v1",
+        kind: "RoleBinding",
+        metadata,
+        subjects: [{ kind: "ServiceAccount", name, namespace: NAMESPACE }],
+        roleRef: { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name },
+    };
+    return [role, binding];
 }
 /**
  * neon-control: it bootstraps the tenant and main's timeline, makes and deletes branches,
- * serves each branch's compute its spec, answers the storage controller's hooks, and
- * repairs a safekeeper that lost its disk. Its record of the branches is on a volume of
- * its own.
+ * serves each branch's compute its spec, answers the storage controller's hooks and Neon's
+ * proxy, wakes computes and puts them to sleep, and repairs a safekeeper that lost its
+ * disk. Its record of the branches is in the storage controller's Postgres, so any of its
+ * replicas serves.
  */
 function control(config) {
     const name = neonName("control");
     const component = "neon-control";
+    const { scaling, resources } = config.neon.control;
     const safekeeper = neonName("safekeeper");
     const safekeeperHosts = Array.from({ length: config.neon.safekeepers.scaling.min }, (_, index) => `${safekeeper}-${index}.${safekeeper}.${NAMESPACE}.svc.cluster.local`);
-    const claim = {
-        apiVersion: "v1",
-        kind: "PersistentVolumeClaim",
-        metadata: { name, namespace: NAMESPACE, labels: stackLabels(component) },
-        spec: claimSpec(config.neon.control.storage),
-    };
+    const serviceAccount = { apiVersion: "v1", kind: "ServiceAccount", metadata: { name, namespace: NAMESPACE, labels: stackLabels(component) } };
     const deployment = {
         apiVersion: "apps/v1",
         kind: "Deployment",
         metadata: { name, namespace: NAMESPACE, labels: stackLabels(component) },
         spec: {
-            ...replicasOf(ONE),
-            strategy: { type: "Recreate" },
+            ...replicasOf(scaling),
             selector: { matchLabels: selectorLabels(component) },
             template: {
                 metadata: { labels: stackLabels(component) },
                 spec: {
+                    serviceAccountName: name,
                     ...priority("floor"),
                     ...stackPodSpec(config),
+                    ...spread(component, scaling),
                     containers: [{
                             name: "neon-control",
                             image: imageReference(config.images.alasio),
@@ -415,21 +509,22 @@ function control(config) {
                             env: [
                                 { name: "CONTROLLER_URL", value: `http://${neonName("storage-controller")}:1234` },
                                 { name: "NEON_SAFEKEEPER_HOSTS", value: safekeeperHosts.join(",") },
-                                // As every compute reaches it, a branch environment's in its own namespace too.
-                                { name: "NEON_PAGESERVER_HOST", value: `${neonName("pageserver")}.${NAMESPACE}.svc` },
+                                { name: "NEON_PAGESERVERS", value: String(config.neon.pageserver.scaling.min) },
+                                { name: "NEON_SHARDS", value: String(config.neon.shards) },
+                                { name: "NEON_CONTROLLER_DB_HOST", value: neonName("controller-db") },
+                                { name: "NAMESPACE", valueFrom: { fieldRef: { fieldPath: "metadata.namespace" } } },
+                                { name: "NEON_COMPUTE_NAME", value: neonName("compute") },
                             ],
                             ports: [{ name: "http", containerPort: 8080 }],
                             readinessProbe: { httpGet: { path: "/healthz", port: "http" }, periodSeconds: 3 },
                             securityContext: { ...restrictedContainer(), readOnlyRootFilesystem: true },
-                            resources: config.neon.control.resources,
+                            resources,
                             volumeMounts: [
-                                { name: "state", mountPath: "/state" },
                                 { name: "root", mountPath: "/secrets", readOnly: true },
                                 { name: "keys", mountPath: "/keys", readOnly: true },
                             ],
                         }],
                     volumes: [
-                        { name: "state", persistentVolumeClaim: { claimName: name } },
                         {
                             name: "root",
                             secret: {
@@ -444,7 +539,76 @@ function control(config) {
             },
         },
     };
-    return [service(name, component, [{ name: "http", port: 8080 }]), claim, deployment, verticalPodAutoscaler(deployment, "Recommended")];
+    return [
+        service(name, component, [{ name: "http", port: 8080 }]),
+        serviceAccount,
+        ...computeScaling(NAMESPACE),
+        ...computeRestartPolicy(),
+        deployment,
+        ...replicaBudget(component, NAMESPACE, scaling),
+        verticalPodAutoscaler(deployment, "Recommended"),
+    ];
+}
+/**
+ * Neon's proxy, from Neon's image: every client of a compute, main's or a branch
+ * environment's, connects to it, naming the compute by `options=endpoint=<id>` (the
+ * compute's id, as its spec is served under), without TLS, which would turn that option
+ * off. It asks neon-control, its control plane, for the role's verifier, authenticates the
+ * client against it, has neon-control wake the compute if it sleeps, and then passes the
+ * session through, whole, so session state such as advisory locks holds. It keeps where
+ * each compute is for four minutes, and asks again when a connection there fails, as one
+ * to a compute that has gone to sleep since does. It cancels no query: that needs a Redis
+ * of its own, and alasio cancels none.
+ */
+function proxy(config) {
+    const name = neonName("proxy");
+    const component = "neon-proxy";
+    const { scaling, resources } = config.neon.proxy;
+    const deployment = {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { name, namespace: NAMESPACE, labels: stackLabels(component) },
+        spec: {
+            ...replicasOf(scaling),
+            selector: { matchLabels: selectorLabels(component) },
+            template: {
+                metadata: { labels: stackLabels(component) },
+                spec: {
+                    ...priority("floor"),
+                    ...stackPodSpec(config),
+                    ...spread(component, scaling),
+                    containers: [{
+                            name: "proxy",
+                            image: imageReference(config.neon.image),
+                            imagePullPolicy: "IfNotPresent",
+                            command: [
+                                "proxy",
+                                "--proxy", `0.0.0.0:${PROXY_PORT}`,
+                                "--http", "0.0.0.0:7001",
+                                "--auth-backend", "control-plane",
+                                "--auth-endpoint", `http://${neonName("control")}:8080`,
+                                "--wake-compute-cache", "size=4000,ttl=4m",
+                                // A role's secret is kept ten seconds, not its four minutes: no Redis tells it of a
+                                // branch deleted and made again under its name, with new passwords.
+                                "--project-info-cache", "size=10000,ttl=10s,max_roles=10,gc_interval=60m",
+                            ],
+                            // Its token for neon-control, of the scope that answers it alone.
+                            env: [secretVariable(name, "NEON_PROXY_TO_CONTROLPLANE_TOKEN")],
+                            ports: [{ name: "postgres", containerPort: PROXY_PORT }, { name: "http", containerPort: 7001 }],
+                            readinessProbe: { tcpSocket: { port: "postgres" }, periodSeconds: 5 },
+                            securityContext: { ...restrictedContainer(), readOnlyRootFilesystem: true },
+                            resources,
+                        }],
+                },
+            },
+        },
+    };
+    return [
+        service(name, component, [{ name: "postgres", port: PROXY_PORT }, { name: "http", port: 7001 }]),
+        deployment,
+        ...replicaBudget(component, NAMESPACE, scaling),
+        verticalPodAutoscaler(deployment, "InPlace"),
+    ];
 }
 /**
  * The compute: Postgres on alasio's timeline, one primary (never two on one timeline),
@@ -453,24 +617,49 @@ function control(config) {
  * scrapes, and exports compute_ctl's traces to the collector, when it runs. A branch
  * environment's is on the branch's timeline, in its namespace, reaching the stack's
  * storage and neon-control in main's.
+ *
+ * neon-control wakes it and puts it to sleep, scaling its Deployment between one replica
+ * and none: so applying alasio gives it none, as it would take the count back, and a
+ * compute made anew starts at one. Its Service takes connections before its pod is ready,
+ * so a wake is answered as soon as Postgres takes them.
+ *
+ * Beside it, where the lake runs, its read replica (REPLICA_NAME), which the lake loads
+ * from: a compute of its own, on the same timeline, streaming its WAL from the
+ * safekeepers, as neon-control specifies it, smaller, woken and put to sleep as the
+ * primary is, of the class of what sleeps, as it serves the loader alone.
  */
 export function compute(config, environment = MAIN_ENVIRONMENT) {
-    const name = neonName("compute");
-    const component = "neon-compute";
+    return [...computeObjects(config, environment, false), ...(lakeRuns(config) ? computeObjects(config, environment, true) : [])];
+}
+/** The name of a read replica's Deployment and Service, beside its primary's in each environment. */
+export const REPLICA_NAME = `${neonName("compute")}${REPLICA_SUFFIX}`;
+/** The objects of the environment's primary compute, or with `replica` its read replica's. */
+function computeObjects(config, environment, replica) {
+    const name = replica ? REPLICA_NAME : neonName("compute");
+    const component = replica ? "neon-compute-ro" : "neon-compute";
     const control = `http://${neonName("control")}.${NAMESPACE}.svc:8080`;
+    const { suspendAfter } = config.neon.compute;
+    const resources = replica ? config.neon.readReplica.resources : config.neon.compute.resources;
+    const branch = environment.branch ?? MAIN;
     const deployment = {
         apiVersion: "apps/v1",
         kind: "Deployment",
-        metadata: { name, namespace: environment.namespace, labels: stackLabels(component) },
+        metadata: {
+            name,
+            namespace: environment.namespace,
+            labels: stackLabels(component),
+            // A valid duration, as the configuration checks.
+            annotations: { [SUSPEND_AFTER]: String(durationSeconds(suspendAfter)) },
+        },
         spec: {
-            ...replicasOf(ONE),
             strategy: { type: "Recreate" },
             selector: { matchLabels: selectorLabels(component) },
             template: {
                 metadata: { labels: stackLabels(component) },
                 spec: {
-                    // Main's is alasio's database, which every turn needs; a branch's sleeps.
-                    ...priority(environment.branch === null ? "floor" : "component"),
+                    // Main's primary is alasio's database, which every turn needs; a branch's, and every
+                    // read replica, serve what may wait.
+                    ...priority(environment.branch === null && !replica ? "floor" : "component"),
                     ...imagePullSecrets(config),
                     // The compute image runs as its own postgres user.
                     securityContext: { fsGroup: config.neon.runAsGroup, seccompProfile: { type: "RuntimeDefault" } },
@@ -486,24 +675,25 @@ export function compute(config, environment = MAIN_ENVIRONMENT) {
                                 "--pgdata",
                                 "/var/db/postgres/compute",
                                 "--connstr",
-                                "postgresql://cloud_admin@localhost:55433/postgres",
+                                `postgresql://cloud_admin@localhost:${COMPUTE_PORT}/postgres`,
                                 "--pgbin",
                                 "/usr/local/bin/postgres",
                                 "--compute-id",
-                                computeId(environment.branch ?? MAIN),
+                                replica ? replicaId(branch) : computeId(branch),
                                 "--control-plane-uri",
                                 control,
                             ],
                             env: [
-                                secretVariable(name, "NEON_CONTROL_PLANE_TOKEN"),
+                                // The primary's token, which fetches its replica's spec too.
+                                secretVariable(neonName("compute"), "NEON_CONTROL_PLANE_TOKEN"),
                                 ...(collectorRuns(config)
                                     ? [{ name: "OTEL_SERVICE_NAME", value: "compute_ctl" }, ...otelEnv(config, environment)]
                                     : [{ name: "OTEL_SDK_DISABLED", value: "true" }]),
                             ],
-                            ports: [{ name: "postgres", containerPort: 55433 }, { name: "http", containerPort: 3080 }],
-                            readinessProbe: { exec: { command: ["pg_isready", "-h", "127.0.0.1", "-p", "55433", "-U", "cloud_admin", "-d", "postgres"] }, periodSeconds: 5 },
+                            ports: [{ name: "postgres", containerPort: COMPUTE_PORT }, { name: "http", containerPort: COMPUTE_CTL_PORT }],
+                            readinessProbe: { exec: { command: ["pg_isready", "-h", "127.0.0.1", "-p", String(COMPUTE_PORT), "-U", "cloud_admin", "-d", "postgres"] }, periodSeconds: 5 },
                             securityContext: restrictedContainer(),
-                            resources: config.neon.compute.resources,
+                            resources,
                             volumeMounts: [{ name: "pgdata", mountPath: "/var/db/postgres" }],
                         }],
                     volumes: [{ name: "pgdata", emptyDir: {} }],
@@ -511,7 +701,13 @@ export function compute(config, environment = MAIN_ENVIRONMENT) {
             },
         },
     };
-    return [service(name, component, [{ name: "postgres", port: 55433 }, { name: "http", port: 3080 }], environment), deployment, verticalPodAutoscaler(deployment, "Recommended")];
+    const service = {
+        apiVersion: "v1",
+        kind: "Service",
+        metadata: { name, namespace: environment.namespace, labels: stackLabels(component) },
+        spec: { selector: selectorLabels(component), publishNotReadyAddresses: true, ports: [{ name: "postgres", port: COMPUTE_PORT }, { name: "http", port: COMPUTE_CTL_PORT }] },
+    };
+    return [service, deployment, verticalPodAutoscaler(deployment, "Recommended")];
 }
 /**
  * A logical dump of alasio's database, restorable into any Postgres whatever becomes of
@@ -529,12 +725,18 @@ function backup(config) {
         command: [
             "/bin/sh",
             "-c",
-            // A new pod's NetworkPolicy may apply a moment after it starts, so the compute is
+            // A new pod's NetworkPolicy may apply a moment after it starts, so the proxy is
             // waited for rather than given up on at the first refusal.
-            'until pg_isready --quiet --host="$0" --port=55433; do sleep 2; done && pg_dump --host="$0" --port=55433 --username=alasio --dbname=alasio --format=custom --file=/backup/alasio.dump',
-            neonName("compute"),
+            `until pg_isready --quiet; do sleep 2; done && pg_dump --username=${ROLE} --dbname=${DATABASE} --format=custom --file=/backup/alasio.dump`,
+        ],
+        env: [
+            { name: "PGHOST", value: PROXY_HOST },
+            { name: "PGPORT", value: String(PROXY_PORT) },
+            // Main's compute, through the proxy, which wakes it if it sleeps.
+            { name: "PGOPTIONS", value: `endpoint=${computeId(MAIN)}` },
+            { name: "PGCONNECT_TIMEOUT", value: "60" },
+            { name: "PGPASSWORD", valueFrom: { secretKeyRef: { name: databaseSecret(config), key: "password" } } },
         ],
-        env: [{ name: "PGPASSWORD", valueFrom: { secretKeyRef: { name: databaseSecret(config), key: "password" } } }],
         securityContext: restrictedContainer(),
         resources: { requests: { cpu: "100m", memory: "128Mi" }, limits: { memory: "1Gi" } },
         volumeMounts: [{ name: "backup", mountPath: "/backup" }],
@@ -548,12 +750,22 @@ function backup(config) {
             "-c",
             script("set -eu", 's3() { aws s3 --endpoint-url "$S3_ENDPOINT" "$@"; }', 
             // Deletes all but the newest KEEP of the backups whose names match $1, which sort by when they were made.
-            "prune() { s3 ls \"s3://$BUCKET/\" | awk '{print $4}' | grep \"$1\" | sort -r | tail -n +$((KEEP + 1)) \\", '  | while read -r old; do s3 rm "s3://$BUCKET/$old"; done; }', "stamp=$(date -u +%Y%m%dT%H%M%SZ)", 's3 cp /backup/alasio.dump "s3://$BUCKET/alasio-$stamp.dump"', "prune '^alasio-.*\\.dump$'", ...(workspaceStorage.enabled
+            "prune() { s3 ls \"s3://$BUCKET/\" | awk '{print $4}' | grep \"$1\" | sort -r | tail -n +$((KEEP + 1)) \\", '  | while read -r old; do s3 rm "s3://$BUCKET/$old"; done; }', "stamp=$(date -u +%Y%m%dT%H%M%SZ)", 's3 cp "$BACKUP_DIR/alasio.dump" "s3://$BUCKET/alasio-$stamp.dump"', "prune '^alasio-.*\\.dump$'", ...(workspaceStorage.enabled
                 ? [
                     'meta="s3://$WORKSPACES_BUCKET/$WORKSPACES_NAME/meta/"',
                     "dump=$(s3 ls \"$meta\" | awk '{print $4}' | grep '^dump-.*\\.json\\.gz$' | sort -r | head -n 1)",
-                    // None until a workspace's volume has been mounted for a while.
-                    'if [ -n "$dump" ]; then s3 cp "$meta$dump" "s3://$BUCKET/$WORKSPACES_NAME-$dump"; else echo "JuiceFS has dumped no metadata of $WORKSPACES_NAME yet"; fi',
+                    // Copied by its bytes, read and written as every object is, not by the object store's
+                    // own copy (CopyObject), which SeaweedFS failed for a dump, all of the job's tries;
+                    // checked as the gzip it is, and read back the same once written. None until a
+                    // workspace's volume has been mounted for a while.
+                    'copied="s3://$BUCKET/$WORKSPACES_NAME-$dump"',
+                    'if [ -n "$dump" ]; then',
+                    '  s3 cp "$meta$dump" "$BACKUP_DIR/workspaces.json.gz"',
+                    '  gzip -t "$BACKUP_DIR/workspaces.json.gz" 2>/dev/null || { echo "$dump is no whole gzip" >&2; exit 1; }',
+                    '  s3 cp "$BACKUP_DIR/workspaces.json.gz" "$copied"',
+                    '  s3 cp "$copied" "$BACKUP_DIR/workspaces.copied"',
+                    '  cmp -s "$BACKUP_DIR/workspaces.json.gz" "$BACKUP_DIR/workspaces.copied" || { echo "the copy of $dump in $BUCKET is not the dump read" >&2; exit 1; }',
+                    'else echo "JuiceFS has dumped no metadata of $WORKSPACES_NAME yet"; fi',
                     'prune "^$WORKSPACES_NAME-dump-.*\\.json\\.gz$"',
                 ]
                 : [])),
@@ -562,13 +774,16 @@ function backup(config) {
             { name: "S3_ENDPOINT", value: s3Endpoint(config) },
             { name: "BUCKET", value: objectStore.buckets.backups },
             { name: "KEEP", value: String(config.neon.backup.keep) },
+            // Where the database's dump is, which the backup's own reads of JuiceFS's are put beside.
+            { name: "BACKUP_DIR", value: "/backup" },
             ...(workspaceStorage.enabled
                 ? [{ name: "WORKSPACES_BUCKET", value: objectStore.buckets.workspaces }, { name: "WORKSPACES_NAME", value: workspaceStorage.name }]
                 : []),
             { name: "AWS_DEFAULT_REGION", value: objectStore.external.region },
             { name: "HOME", value: "/tmp" },
         ],
-        envFrom: [{ secretRef: { name: neonName("s3-admin") } }],
+        // Its own identity: it writes the backups' bucket and reads what it backs up, and no more.
+        envFrom: [{ secretRef: { name: neonName("s3-backups") } }],
         securityContext: restrictedContainer(),
         resources: { requests: { cpu: "50m", memory: "128Mi" }, limits: { memory: "512Mi" } },
         volumeMounts: [{ name: "backup", mountPath: "/backup" }, { name: "tmp", mountPath: "/tmp" }],
@@ -602,11 +817,11 @@ function backup(config) {
         },
     };
 }
-/** Neon's objects, when it runs. */
+/** The stack's setup, which runs with Neon or without it, and Neon's objects, when it runs. */
 export function neonObjects(config) {
     const { neon } = config;
     if (!neon.enabled)
-        return [];
+        return setup(config);
     return [
         ...setup(config),
         ...controllerDb(config),
@@ -615,6 +830,7 @@ export function neonObjects(config) {
         ...safekeepers(config),
         ...pageserver(config),
         ...control(config),
+        ...proxy(config),
         ...compute(config),
         ...(neon.backup.enabled ? [backup(config)] : []),
     ];