Will Anderson
409274ff54
Backs up all service config PVCs (Jellyfin, Radarr, Sonarr, Prowlarr, qBittorrent, Bazarr, Seerr) at 3am daily to legion-media-backup R2 bucket. Media files are excluded — they are re-downloadable.
30 lines
913 B
YAML
30 lines
913 B
YAML
# media-backup-credentials — R2 + restic credentials for nightly media config backup
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: media-backup-credentials
|
|
namespace: media
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: media-backup-credentials
|
|
creationPolicy: Owner
|
|
template:
|
|
data:
|
|
RESTIC_PASSWORD: "media-restic-2026"
|
|
AWS_ACCESS_KEY_ID: "{{ .r2_access_key_id }}"
|
|
AWS_SECRET_ACCESS_KEY: "{{ .r2_secret_access_key }}"
|
|
RESTIC_REPOSITORY: "s3:https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com/legion-media-backup"
|
|
data:
|
|
- secretKey: r2_access_key_id
|
|
remoteRef:
|
|
key: secret/data/r2
|
|
property: access_key_id
|
|
- secretKey: r2_secret_access_key
|
|
remoteRef:
|
|
key: secret/data/r2
|
|
property: secret_access_key
|