# Nightly: pg_dump the paperless DB + mirror the media PVC into the scoped
# `paperless` MinIO bucket (see minio-provision-paperless-job.yaml). This is a
# BACKUP target, not live storage - paperless-ngx has no native S3 backend, it
# only ever reads/writes the local media PVC directly.
#
# Pinned to talos-cp-3, same as deployment.yaml: media is a ReadWriteOnce
# Longhorn volume with a single replica physically on that node's disk -
# mounting it read-only here from a different node would conflict with the
# live webserver's attachment.
apiVersion: batch/v1
kind: CronJob
metadata:
  name: paperless-backup
spec:
  schedule: "0 3 * * *"  # 03:00 daily, low-traffic window
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          restartPolicy: Never
          nodeSelector:
            kubernetes.io/hostname: talos-cp-3
          initContainers:
            - name: pg-dump
              image: postgres:16-alpine
              env:
                - name: PGHOST
                  value: paperless-db-rw
                - name: PGDATABASE
                  value: paperless
                - name: PGUSER
                  valueFrom:
                    secretKeyRef:
                      name: paperless-db-app
                      key: username
                - name: PGPASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: paperless-db-app
                      key: password
              command:
                - sh
                - -c
                - pg_dump --format=custom --file=/backup/paperless-db.dump
              volumeMounts:
                - name: backup
                  mountPath: /backup
          containers:
            - name: mc-mirror
              image: minio/mc:latest
              env:
                - name: ACCESS_KEY
                  valueFrom:
                    secretKeyRef:
                      name: paperless-minio-creds
                      key: ACCESS_KEY
                - name: SECRET_KEY
                  valueFrom:
                    secretKeyRef:
                      name: paperless-minio-creds
                      key: SECRET_KEY
                - name: BUCKET
                  valueFrom:
                    secretKeyRef:
                      name: paperless-minio-creds
                      key: BUCKET
                - name: ENDPOINT
                  valueFrom:
                    secretKeyRef:
                      name: paperless-minio-creds
                      key: ENDPOINT
              command:
                - /bin/sh
                - -c
                - |
                  set -e
                  mc alias set b "$ENDPOINT" "$ACCESS_KEY" "$SECRET_KEY"
                  mc cp /backup/paperless-db.dump "b/$BUCKET/db/paperless-db-$(date +%Y%m%d).dump"
                  mc mirror --overwrite /media "b/$BUCKET/media"
                  echo "Backup done."
              volumeMounts:
                - name: backup
                  mountPath: /backup
                - name: media
                  mountPath: /media
                  readOnly: true
          volumes:
            - name: backup
              emptyDir: {}
            - name: media
              persistentVolumeClaim:
                claimName: paperless-media
                readOnly: true