feat(garage): configure backup

garage/backup/config/buckets

@@ -0,0 +1,11 @@
+forgejo
+zipline
+noco
+csi
+fider
+k3s
+hedgedoc
+obsidian
+linkwarden
+backup
+blog

garage/backup/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: garage
+
+images:
+  - name: rclone
+    newName: rclone/rclone
+    newTag: "1.66"
+
+resources:
+- resources/cronjob.yaml
+- resources/secret.rclone.yaml
+
+configMapGenerator:
+  - name: backup-config
+    files:
+      - config/buckets

garage/backup/resources/cronjob.yaml

@@ -0,0 +1,53 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: backup
+spec:
+  schedule: "42 */6 * * *"
+  jobTemplate:
+    spec:
+      completions: 11
+      parallelism: 3
+      completionMode: Indexed
+      ttlSecondsAfterFinished: 300
+      backoffLimitPerIndex: 3
+      template:
+        spec:
+          containers:
+          - name: rclone
+            image: rclone
+            command: ["/bin/ash", "-c"]
+            args:
+            - |
+              for bucket in $(cat /config/backup/buckets | head -n $JOB_COMPLETION_INDEX | tail -n 1);
+              do
+                  if [ -z "$bucket" ]; then exit 0; fi
+                  echo "Syncing bucket $bucket";
+                  rclone sync -P --update --no-update-modtime --no-update-dir-modtime --ignore-errors -v "garage:$bucket" "storagebox:garage/$bucket/";
+              done
+            volumeMounts:
+            - name: rclone-config
+              mountPath: /config/rclone
+            - name: backup-config
+              mountPath: /config/backup
+            securityContext:
+              capabilities:
+                drop:
+                  - ALL
+              readOnlyRootFilesystem: true
+          restartPolicy: OnFailure
+          volumes:
+            - name: rclone-config
+              secret:
+                secretName: rclone-backup-config
+                defaultMode: 420
+            - name: backup-config
+              configMap:
+                name: backup-config
+                defaultMode: 420
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsUser: 1000
+            runAsGroup: 1000
+            fsGroup: 1000
+            runAsNonRoot: true

garage/kustomization.yaml

@@ -24,6 +24,7 @@ resources:
   - resources/services.yaml
   - resources/api_routes.yaml
   - resources/web_routes.yaml
+  - backup/
 
 configMapGenerator:
 - name: garage-config