add nightly Vault raft snapshot backup to R2

Snapshot via vault operator raft snapshot save using a least-privilege periodic token. Stored in legion-vault-backup R2 bucket via restic. Retains 30 daily / 12 weekly / 6 monthly snapshots. Runs at 3am, offset from the Gitea backup at 2am.
2026-04-24 01:36:30 -05:00
parent 816d79760d
commit b1867a542d
2 changed files with 129 additions and 0 deletions
@@ -0,0 +1,35 @@
+---
+# vault-backup-credentials — R2 keys + restic password + Vault snapshot token
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: vault-backup-credentials
+  namespace: vault
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: vault-backup-credentials
+    creationPolicy: Owner
+    template:
+      data:
+        VAULT_SNAPSHOT_TOKEN: "{{ .snapshot_token }}"
+        RESTIC_PASSWORD: "vault-restic-2026"
+        AWS_ACCESS_KEY_ID: "{{ .r2_access_key_id }}"
+        AWS_SECRET_ACCESS_KEY: "{{ .r2_secret_access_key }}"
+        RESTIC_REPOSITORY: "s3:https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com/legion-vault-backup"
+  data:
+    - secretKey: snapshot_token
+      remoteRef:
+        key: secret/data/vault/snapshot-token
+        property: token
+    - secretKey: r2_access_key_id
+      remoteRef:
+        key: secret/data/r2
+        property: access_key_id
+    - secretKey: r2_secret_access_key
+      remoteRef:
+        key: secret/data/r2
+        property: secret_access_key