Migrate k8s config from Terraform to Argo CD + ESO

Phase 1: Install External Secrets Operator via Argo CD app - apps/external-secrets.yaml — ESO Helm chart install - apps/external-secrets-config.yaml — ClusterSecretStore deployment - k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret Phase 2: Create k8s manifests for all services - k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress - k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress - k8s/github-runner/ — ExternalSecret (github-runner-secret) - k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret) - k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress - k8s/postgres/ — ExternalSecret (postgres-passwords) - k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault) - k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret - k8s/ollama/ — PVC, Ingress - k8s/headscale/ — PVC - k8s/packages/ — PVCs, ConfigMap, Ingresses - k8s/registry/ — PVC, Ingresses - k8s/backup/ — CronJob, ExternalSecret (backup-credentials) New Argo CD apps for Helm releases: - apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml - apps/postgres.yaml, redis.yaml, vault.yaml New Argo CD apps for k8s config paths: - apps/neuron-config, gitea-config, ci-config, gitea-runner-config - apps/monitoring-config, adguard-config, ollama-config, headscale-config - apps/packages-config, registry-config, postgres-config, vault-config, backup Phase 3: Strip Terraform to infrastructure-only - All kubernetes_* and helm_release resources removed from service .tf files - Each service .tf now contains only kubernetes_namespace (bootstrap dependency) - variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token - namespaces.tf gains external-secrets namespace - ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/) - cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)
2026-03-25 10:29:14 -05:00
parent dd0f8a49a3
commit 4d0cfb1bbf
74 changed files with 1895 additions and 1726 deletions
@@ -0,0 +1,95 @@
+---
+# Nightly backup — dumps Postgres + Gitea data to Cloudflare R2 via restic
+# Schedule: 2am daily. Retains 30 daily / 12 weekly / 6 monthly snapshots.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: gitea-backup
+  namespace: git
+spec:
+  schedule: "0 2 * * *"
+  concurrencyPolicy: Forbid
+  failedJobsHistoryLimit: 3
+  successfulJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      template:
+        spec:
+          restartPolicy: OnFailure
+          initContainers:
+            - name: pg-dump
+              image: postgres:18-alpine
+              command:
+                - /bin/sh
+                - -c
+                - >-
+                  pg_dumpall
+                  -h postgres-postgresql.platform.svc.cluster.local
+                  -U postgres
+                  --no-role-passwords
+                  > /dump/all-databases.sql
+                  && echo 'DB dump complete, size:' $(du -sh /dump/all-databases.sql)
+              envFrom:
+                - secretRef:
+                    name: backup-credentials
+              volumeMounts:
+                - name: dump
+                  mountPath: /dump
+              resources:
+                requests:
+                  memory: 128Mi
+                  cpu: 100m
+                limits:
+                  memory: 256Mi
+          containers:
+            - name: backup
+              image: restic/restic:latest
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  set -e
+
+                  # Init repo if first run
+                  restic snapshots 2>/dev/null || restic init
+
+                  # Back up Gitea data + full DB dump
+                  echo "Running restic backup..."
+                  restic backup \
+                    /gitea-data \
+                    /dump/all-databases.sql \
+                    --tag legion \
+                    --host legion
+
+                  # Prune old snapshots
+                  restic forget \
+                    --keep-daily 30 \
+                    --keep-weekly 12 \
+                    --keep-monthly 6 \
+                    --prune
+
+                  echo "Backup complete."
+                  restic snapshots --latest 3
+              envFrom:
+                - secretRef:
+                    name: backup-credentials
+              volumeMounts:
+                - name: gitea-data
+                  mountPath: /gitea-data
+                  readOnly: true
+                - name: dump
+                  mountPath: /dump
+              resources:
+                requests:
+                  memory: 256Mi
+                  cpu: 100m
+                limits:
+                  memory: 512Mi
+          volumes:
+            - name: gitea-data
+              persistentVolumeClaim:
+                claimName: gitea-data
+                readOnly: true
+            - name: dump
+              emptyDir: {}
@@ -0,0 +1,35 @@
+---
+# backup-credentials — R2 access keys + restic password + Postgres password for nightly backup
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: backup-credentials
+  namespace: git
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: backup-credentials
+    creationPolicy: Owner
+    template:
+      data:
+        RESTIC_PASSWORD: "gitea-restic-2026"
+        AWS_ACCESS_KEY_ID: "{{ .r2_access_key_id }}"
+        AWS_SECRET_ACCESS_KEY: "{{ .r2_secret_access_key }}"
+        RESTIC_REPOSITORY: "s3:https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com/legion-gitea-backup"
+        PGPASSWORD: "{{ .postgres_password }}"
+  data:
+    - secretKey: r2_access_key_id
+      remoteRef:
+        key: secret/data/r2
+        property: access_key_id
+    - secretKey: r2_secret_access_key
+      remoteRef:
+        key: secret/data/r2
+        property: secret_access_key
+    - secretKey: postgres_password
+      remoteRef:
+        key: secret/data/legion-db
+        property: postgres_password