Restructure: servers/legion/ layout, rename repo to infrastructure

2026-03-23 07:38:42 -05:00
parent 7751eddd73
commit 0b4a236a88
22 changed files with 4 additions and 4 deletions
@@ -0,0 +1,137 @@
+# Legion backup — restic to Cloudflare R2
+# Dumps all Postgres databases + Gitea data nightly at 2am
+# Retains 30 daily / 12 weekly / 6 monthly snapshots
+
+resource "kubernetes_secret" "backup_credentials" {
+  metadata {
+    name      = "backup-credentials"
+    namespace = "git"
+  }
+
+  data = {
+    RESTIC_PASSWORD          = "gitea-restic-2026"
+    AWS_ACCESS_KEY_ID        = var.r2_access_key_id
+    AWS_SECRET_ACCESS_KEY    = var.r2_secret_access_key
+    RESTIC_REPOSITORY        = "s3:${var.r2_endpoint}/legion-gitea-backup"
+    POSTGRES_PASSWORD        = var.postgres_password
+  }
+}
+
+resource "kubernetes_cron_job_v1" "gitea_backup" {
+  metadata {
+    name      = "gitea-backup"
+    namespace = "git"
+  }
+
+  spec {
+    schedule                      = "0 2 * * *"
+    concurrency_policy            = "Forbid"
+    failed_jobs_history_limit     = 3
+    successful_jobs_history_limit = 3
+
+    job_template {
+      metadata {}
+      spec {
+        backoff_limit = 2
+        template {
+          metadata {}
+          spec {
+            restart_policy = "OnFailure"
+
+            # Dump all Postgres databases before restic runs
+            init_container {
+              name  = "pg-dump"
+              image = "postgres:18-alpine"
+
+              command = ["/bin/sh", "-c",
+                "pg_dumpall -h postgres-postgresql.platform.svc.cluster.local -U postgres --no-role-passwords > /dump/all-databases.sql && echo 'DB dump complete, size:' $(du -sh /dump/all-databases.sql)"
+              ]
+
+              env_from {
+                secret_ref {
+                  name = kubernetes_secret.backup_credentials.metadata[0].name
+                }
+              }
+
+              volume_mount {
+                name       = "dump"
+                mount_path = "/dump"
+              }
+
+              resources {
+                requests = { memory = "128Mi", cpu = "100m" }
+                limits   = { memory = "256Mi" }
+              }
+            }
+
+            container {
+              name  = "backup"
+              image = "restic/restic:latest"
+
+              command = ["/bin/sh", "-c", <<-EOT
+                set -e
+
+                # Init repo if first run
+                restic snapshots 2>/dev/null || restic init
+
+                # Back up Gitea data + full DB dump
+                echo "Running restic backup..."
+                restic backup \
+                  /gitea-data \
+                  /dump/all-databases.sql \
+                  --tag legion \
+                  --host legion
+
+                # Prune old snapshots
+                restic forget \
+                  --keep-daily 30 \
+                  --keep-weekly 12 \
+                  --keep-monthly 6 \
+                  --prune
+
+                echo "Backup complete."
+                restic snapshots --latest 3
+              EOT
+              ]
+
+              env_from {
+                secret_ref {
+                  name = kubernetes_secret.backup_credentials.metadata[0].name
+                }
+              }
+
+              volume_mount {
+                name       = "gitea-data"
+                mount_path = "/gitea-data"
+                read_only  = true
+              }
+
+              volume_mount {
+                name       = "dump"
+                mount_path = "/dump"
+              }
+
+              resources {
+                requests = { memory = "256Mi", cpu = "100m" }
+                limits   = { memory = "512Mi" }
+              }
+            }
+
+            volume {
+              name = "gitea-data"
+              persistent_volume_claim {
+                claim_name = "gitea-data"
+                read_only  = true
+              }
+            }
+
+            volume {
+              name = "dump"
+              empty_dir {}
+            }
+          }
+        }
+      }
+    }
+  }
+}