Story Crater Bot
e8e5acfb13
Fixes controlplane.tftpl's install.wipe:true (should be false, live CPs already run false) and syncs coredns Corefile back to what's actually deployed (drops an unrolled-out, stale Kong-era rewrite).
95 lines
3.3 KiB
YAML
95 lines
3.3 KiB
YAML
# Nightly: pg_dump the paperless DB + mirror the media PVC into the scoped
|
|
# `paperless` MinIO bucket (see minio-provision-paperless-job.yaml). This is a
|
|
# BACKUP target, not live storage - paperless-ngx has no native S3 backend, it
|
|
# only ever reads/writes the local media PVC directly.
|
|
#
|
|
# Pinned to talos-cp-3, same as deployment.yaml: media is a ReadWriteOnce
|
|
# Longhorn volume with a single replica physically on that node's disk -
|
|
# mounting it read-only here from a different node would conflict with the
|
|
# live webserver's attachment.
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: paperless-backup
|
|
spec:
|
|
schedule: "0 3 * * *" # 03:00 daily, low-traffic window
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
nodeSelector:
|
|
kubernetes.io/hostname: talos-cp-3
|
|
initContainers:
|
|
- name: pg-dump
|
|
image: postgres:16-alpine
|
|
env:
|
|
- name: PGHOST
|
|
value: paperless-db-rw
|
|
- name: PGDATABASE
|
|
value: paperless
|
|
- name: PGUSER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-db-app
|
|
key: username
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-db-app
|
|
key: password
|
|
command:
|
|
- sh
|
|
- -c
|
|
- pg_dump --format=custom --file=/backup/paperless-db.dump
|
|
volumeMounts:
|
|
- name: backup
|
|
mountPath: /backup
|
|
containers:
|
|
- name: mc-mirror
|
|
image: minio/mc:latest
|
|
env:
|
|
- name: ACCESS_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-minio-creds
|
|
key: ACCESS_KEY
|
|
- name: SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-minio-creds
|
|
key: SECRET_KEY
|
|
- name: BUCKET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-minio-creds
|
|
key: BUCKET
|
|
- name: ENDPOINT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: paperless-minio-creds
|
|
key: ENDPOINT
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
set -e
|
|
mc alias set b "$ENDPOINT" "$ACCESS_KEY" "$SECRET_KEY"
|
|
mc cp /backup/paperless-db.dump "b/$BUCKET/db/paperless-db-$(date +%Y%m%d).dump"
|
|
mc mirror --overwrite /media "b/$BUCKET/media"
|
|
echo "Backup done."
|
|
volumeMounts:
|
|
- name: backup
|
|
mountPath: /backup
|
|
- name: media
|
|
mountPath: /media
|
|
readOnly: true
|
|
volumes:
|
|
- name: backup
|
|
emptyDir: {}
|
|
- name: media
|
|
persistentVolumeClaim:
|
|
claimName: paperless-media
|
|
readOnly: true
|