Will Anderson
4d0cfb1bbf
Phase 1: Install External Secrets Operator via Argo CD app - apps/external-secrets.yaml — ESO Helm chart install - apps/external-secrets-config.yaml — ClusterSecretStore deployment - k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret Phase 2: Create k8s manifests for all services - k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress - k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress - k8s/github-runner/ — ExternalSecret (github-runner-secret) - k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret) - k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress - k8s/postgres/ — ExternalSecret (postgres-passwords) - k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault) - k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret - k8s/ollama/ — PVC, Ingress - k8s/headscale/ — PVC - k8s/packages/ — PVCs, ConfigMap, Ingresses - k8s/registry/ — PVC, Ingresses - k8s/backup/ — CronJob, ExternalSecret (backup-credentials) New Argo CD apps for Helm releases: - apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml - apps/postgres.yaml, redis.yaml, vault.yaml New Argo CD apps for k8s config paths: - apps/neuron-config, gitea-config, ci-config, gitea-runner-config - apps/monitoring-config, adguard-config, ollama-config, headscale-config - apps/packages-config, registry-config, postgres-config, vault-config, backup Phase 3: Strip Terraform to infrastructure-only - All kubernetes_* and helm_release resources removed from service .tf files - Each service .tf now contains only kubernetes_namespace (bootstrap dependency) - variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token - namespaces.tf gains external-secrets namespace - ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/) - cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)
96 lines
2.8 KiB
YAML
96 lines
2.8 KiB
YAML
---
|
|
# Nightly backup — dumps Postgres + Gitea data to Cloudflare R2 via restic
|
|
# Schedule: 2am daily. Retains 30 daily / 12 weekly / 6 monthly snapshots.
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: gitea-backup
|
|
namespace: git
|
|
spec:
|
|
schedule: "0 2 * * *"
|
|
concurrencyPolicy: Forbid
|
|
failedJobsHistoryLimit: 3
|
|
successfulJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
initContainers:
|
|
- name: pg-dump
|
|
image: postgres:18-alpine
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- >-
|
|
pg_dumpall
|
|
-h postgres-postgresql.platform.svc.cluster.local
|
|
-U postgres
|
|
--no-role-passwords
|
|
> /dump/all-databases.sql
|
|
&& echo 'DB dump complete, size:' $(du -sh /dump/all-databases.sql)
|
|
envFrom:
|
|
- secretRef:
|
|
name: backup-credentials
|
|
volumeMounts:
|
|
- name: dump
|
|
mountPath: /dump
|
|
resources:
|
|
requests:
|
|
memory: 128Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 256Mi
|
|
containers:
|
|
- name: backup
|
|
image: restic/restic:latest
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
|
|
# Init repo if first run
|
|
restic snapshots 2>/dev/null || restic init
|
|
|
|
# Back up Gitea data + full DB dump
|
|
echo "Running restic backup..."
|
|
restic backup \
|
|
/gitea-data \
|
|
/dump/all-databases.sql \
|
|
--tag legion \
|
|
--host legion
|
|
|
|
# Prune old snapshots
|
|
restic forget \
|
|
--keep-daily 30 \
|
|
--keep-weekly 12 \
|
|
--keep-monthly 6 \
|
|
--prune
|
|
|
|
echo "Backup complete."
|
|
restic snapshots --latest 3
|
|
envFrom:
|
|
- secretRef:
|
|
name: backup-credentials
|
|
volumeMounts:
|
|
- name: gitea-data
|
|
mountPath: /gitea-data
|
|
readOnly: true
|
|
- name: dump
|
|
mountPath: /dump
|
|
resources:
|
|
requests:
|
|
memory: 256Mi
|
|
cpu: 100m
|
|
limits:
|
|
memory: 512Mi
|
|
volumes:
|
|
- name: gitea-data
|
|
persistentVolumeClaim:
|
|
claimName: gitea-data
|
|
readOnly: true
|
|
- name: dump
|
|
emptyDir: {}
|