feat(backup): add nightly Borg backups to Hetzner Storage Box

Closes issues #6 and #15 (treated jointly, per combined analysis in their
comments). Two CronJobs, one per namespace, each pushing to its own Borg
repo on the newly booked Storage Box (u641795.your-storagebox.de:23, BX11
1TB) with its own repo passphrase - a leaked passphrase for one doesn't
expose the other:

- matrix: synapse-backup dumps the synapse + matrixauthenticationservice
  DBs (shared postgres, existing chart-generated POSTGRES_ADMIN_PASSWORD)
  and the Synapse media_store PVC (read-only mount)
- authentik: authentik-backup dumps the authentik DB (existing
  authentik-credentials pg-password)

Custom image (rohana.axion1337.de/sorb/axion-backup:v1, postgres:17-alpine
+ borgbackup + openssh-client - matches the live Postgres major version
exactly, unlike Alpine's stock postgresql16-client) pushed as a public
package, same pattern as the existing threadnet-web image (no
imagePullSecret needed).

SSH host key pinned via known_hosts ConfigMap (captured via ssh-keyscan
ahead of time) rather than trusting on first connect in an unattended job.
Retention: 7 daily / 4 weekly / 6 monthly via borg prune. Schedule: 03:00
and 03:15, offset to avoid resource contention.

NetworkPolicy: added each backup job's pod as an allowed source to its
namespace's existing postgres ingress rule (matrix's allow-ingress-postgres,
authentik's allow-ingress-authentik-postgresql from #37). Egress already
unrestricted in both namespaces, so no change needed for the outbound SSH
connection to the Storage Box.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

This commit is contained in:

Thore Cimbal

2026-07-28 12:00:00 +00:00

co-authored by

Claude Sonnet 5

parent 2c5f77686d

commit ba270bce71

8 changed files with 240 additions and 1 deletions

									
										apps/production/kustomization.yaml
									
		+4
		-1
	
												View File
												
				@@ -30,4 +30,7 @@ resources:

				  - element-server-suite.yaml

				  # Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat

				  - apex-ingress.yaml  # Custom Apex Ingress für Element Web + Well-Known auf axion1337.chat

				  - networkpolicy.yaml

				  - networkpolicy.yaml

				  # Backup zur Hetzner Storage Box (Issues #6 + #15)

				  - synapse-backup-secret.yaml

				  - synapse-backup.yaml