jakman85andClaude Opus 4.8
d1248e6778
Author the GitOps side of off-cluster backups against the on-Proxmox MinIO (http://192.168.1.9:9000, path-style; buckets velero + cnpg). Velero (R-STATE-03): - HelmRelease (chart 8.x / Velero 1.15) + velero-plugin-for-aws init container + node-agent kopia File System Backup (deployNodeAgent, uploaderType=kopia, snapshotsEnabled=false). BSL default -> bucket velero, s3ForcePathStyle. - Two daily Schedules: `daily` backs up the whole cluster's resources+PVC data (defaultVolumesToFsBackup opt-out) EXCEPT monitoring+unifi; `daily-resources-only` captures monitoring+unifi RESOURCES only (Prometheus TSDB, Loki 72h logs, and the ~7.4GiB UniFi VM disk are reconstructable — excluded from volume backup). - velero-cloud-credentials SOPS Secret (cloud INI key, ns velero). - Own non-gating Flux tier clusters/base/backup.yaml (dependsOn platform-config, wait:false) + clusters/dev SOPS decryption patch — mirrors headlamp. CNPG native Barman PITR (R-IDP-05 / R-STATE-03): - keycloak-db, nextcloud-db, semaphore-db gain spec.backup.barmanObjectStore (s3://cnpg/<cluster>, endpointURL MinIO, gzip WAL+data, 30d retention) + a daily ScheduledBackup (6-field cron, immediate) each. - Per-namespace scoped-key SOPS Secrets (<db>-backup-credentials), same-ns only. - render.py: emit-waves now recognizes <svc>-db-backup-credentials.sops.yaml as a DB-wave sidecar (+ self-test); wave-0 kustomization regenerated. Creds mirror platform/backup/minio-credentials.sops.yaml (scoped key k3s-backup), SOPS round-trip verified with the cluster age key. gate: green. Co-Authored-By: Claude Opus 4.8 <[email protected]>
21 lines
747 B
YAML
21 lines
747 B
YAML
---
|
|
# Wave 0 of the app tier — GENERATED by `catalog/render.py --emit-waves`.
|
|
# Reconciled by the Flux Kustomization `apps-wave-0` (clusters/base/apps-wave-0.yaml), which dependsOn `platform-config` and health-gates
|
|
# (wait:true) ONLY this wave — a crashloop here cannot stall an earlier wave.
|
|
# DO NOT hand-edit: re-run `render.py --emit-waves` after onboarding a service.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- gitea-bootstrap-secret.sops.yaml
|
|
- gitea.yaml
|
|
- jackett.yaml
|
|
- nextcloud-db-app.sops.yaml
|
|
- nextcloud-db-backup-credentials.sops.yaml
|
|
- nextcloud-db.yaml
|
|
- pihole.yaml
|
|
- plex.yaml
|
|
- qbittorrent.yaml
|
|
- semaphore-db-app.sops.yaml
|
|
- semaphore-db-backup-credentials.sops.yaml
|
|
- semaphore-db.yaml
|