T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 00:08:31 -05:00
1 parent bd8de96456
commit af4f6c07ae
@@ -0,0 +1,22 @@
+# platform/velero
+
+**Velero** — off-cluster backup and DR of volumes + Kubernetes resource state.
+
+- **Governing ADR:** [ADR-0003 — Longhorn (+ bulk tier + Velero)](../../../home-network-k3s/decisions/adr-0003-storage-longhorn.md)
+- **Spec:** [docs/04 — Storage & State](../../../home-network-k3s/docs/04-storage-and-state.md)
+- **Serves:** R-STATE-03
+- **Owner:** WS-STORAGE
+
+## What this stub is
+
+Flux `HelmRelease` with a placeholder off-cluster backup target (S3-compatible/NFS) and scheduled
+backups whose cadence/retention are overlay knobs (`${VELERO_*}`, R-ENV-02). Backup credentials are
+referenced **by name** (`velero-backup-credentials`), **SOPS-encrypted** (WS-SEC). Works with Longhorn
+volume backups.
+
+## TODO (later phases)
+
+- **OQ-2 (human):** concrete off-cluster target (endpoint, bucket, resilience) is a prerequisite.
+- **Phase 4 (WS-STORAGE):** wire the target + Longhorn backups; prove a **DR drill** — restore a
+  namespace + volumes from off-cluster backup (R-STATE-03, Phase-4 exit gate).
+- **DR-critical services** (Gitea, Keycloak, Nextcloud) get off-cluster backup + mirror per docs/05.
@@ -0,0 +1,46 @@
+---
+# Velero — off-cluster backup/DR of volumes + resource state (ADR-0003, R-STATE-03). Phase 0 STUB.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: velero
+  namespace: velero
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: velero
+      version: ">=8.0.0 <9.0.0"   # TODO(WS-STORAGE): pin at bring-up; Renovate maintains
+      sourceRef:
+        kind: HelmRepository
+        name: vmware-tanzu
+        namespace: velero
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    # Off-cluster backup target — S3-compatible/NFS (ADR-0003). STUB: concrete target + creds are
+    # OQ-2 / prerequisites. Credentials referenced BY NAME only, SOPS-encrypted (WS-SEC).
+    configuration:
+      backupStorageLocation:
+        - name: default
+          provider: aws                 # TODO(WS-STORAGE): S3-compatible endpoint per OQ-2
+          bucket: REPLACE-ME
+          config:
+            region: REPLACE-ME
+            s3Url: REPLACE-ME
+            s3ForcePathStyle: "true"
+      volumeSnapshotLocation:
+        - name: default
+          provider: REPLACE-ME          # Longhorn CSI snapshots / Velero fs-backup
+    credentials:
+      existingSecret: velero-backup-credentials   # SOPS-encrypted (WS-SEC) — name only
+    schedules:
+      daily:
+        schedule: "${VELERO_BACKUP_SCHEDULE}"      # overlay knob (cron)
+        template:
+          ttl: "${VELERO_RETENTION}"               # overlay knob (dev short / prod long)
+    # TODO(WS-STORAGE, Phase 4): tested restore path (DR drill) is an acceptance gate (R-STATE-03).
@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: vmware-tanzu
+  namespace: velero
+spec:
+  interval: 1h
+  url: https://vmware-tanzu.github.io/helm-charts
@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helmrepository.yaml
+  - helmrelease.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: velero
@@ -0,0 +1,7 @@
+# Velero Helm values — PLACEHOLDER (Phase 0). Authoritative values inline in helmrelease.yaml.
+#
+# backupStorageLocation: off-cluster S3-compatible/NFS (ADR-0003; concrete target = OQ-2)
+# volumeSnapshotLocation: Longhorn CSI snapshots / Velero fs-backup
+# credentials.existingSecret: velero-backup-credentials  (SOPS-encrypted, WS-SEC — name only)
+# schedules.daily: ${VELERO_BACKUP_SCHEDULE} / ttl ${VELERO_RETENTION}   (overlay knobs)
+# DR drill (tested restore) is a Phase-4 acceptance gate (R-STATE-03).