From cc189d3e15c90adf91d015c1967f25b6fc4e7c12 Mon Sep 17 00:00:00 2001 From: Thore Cimbal Date: Thu, 13 Aug 2026 12:00:00 +0000 Subject: [PATCH] feat(wiki): nightly postgres backup + TOC on the right (#0048/#0050) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add wikijs-backup, a nightly Borg CronJob (03:30) that dumps the Wiki.js postgres DB to the Storage Box — the content lives in git-storage, but comments, local accounts and the search index do not, so the runtime state gets its own backup. Mirrors authentik-backup (DB-only), reusing synapse-backup-credentials and -known-hosts with a separate repo path; NetworkPolicy lets the backup pod reach wikijs-postgres. Also flip tocPosition to right so the page TOC sits beside the content instead of in the left rail. --- apps/production/kustomization.yaml | 1 + apps/production/networkpolicy.yaml | 4 + apps/production/wikijs-config.py | 2 +- apps/production/wikijs-postgres-backup.yaml | 82 +++++++++++++++++++++ 4 files changed, 88 insertions(+), 1 deletion(-) create mode 100644 apps/production/wikijs-postgres-backup.yaml diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml index d73b1df..ce630f0 100644 --- a/apps/production/kustomization.yaml +++ b/apps/production/kustomization.yaml @@ -62,6 +62,7 @@ resources: - wikijs.yaml - wiki-ingress.yaml - wikijs-config.yaml # Konfig-Job (headless Setup + OIDC + Rollen) + - wikijs-postgres-backup.yaml # Nächtliches Borg-Backup der Wiki-DB (#0048) # Synapse-Modul als eigene Datei gepflegt (lintbar/testbar), aber als ConfigMap gemounted - # disableNameSuffixHash, da der Name in synapse-values.yaml's eingebettetem values.yaml diff --git a/apps/production/networkpolicy.yaml b/apps/production/networkpolicy.yaml index 5917fa4..3a15d5d 100644 --- a/apps/production/networkpolicy.yaml +++ b/apps/production/networkpolicy.yaml @@ -401,6 +401,10 @@ spec: - podSelector: matchLabels: app.kubernetes.io/name: wikijs + # Nächtliches Backup (wikijs-postgres-backup.yaml) braucht denselben DB-Zugang. + - podSelector: + matchLabels: + app.kubernetes.io/name: wikijs-backup ports: - protocol: TCP port: postgres diff --git a/apps/production/wikijs-config.py b/apps/production/wikijs-config.py index 02c67c0..f29c629 100644 --- a/apps/production/wikijs-config.py +++ b/apps/production/wikijs-config.py @@ -205,7 +205,7 @@ def ensure_theming(jwt: str): gql('mutation($t:String!,$i:String!,$d:Boolean!,$tp:String,$c:String,$h:String,$b:String){' 'theming{setConfig(theme:$t,iconset:$i,darkMode:$d,tocPosition:$tp,injectCSS:$c,injectHead:$h,' 'injectBody:$b){responseResult{succeeded message}}}}', - jwt, {"t": tc["theme"], "i": tc["iconset"], "d": True, "tp": tc["tocPosition"], + jwt, {"t": tc["theme"], "i": tc["iconset"], "d": True, "tp": "right", "c": ACCENT_CSS, "h": tc["injectHead"], "b": tc["injectBody"]}) # Site-Titel (oben links / Browser-Tab) aus der Deployment-Variable — nicht mehr # das hartkodierte "Wiki.js". Reproduzierbar über WIKI_SITE_TITLE. diff --git a/apps/production/wikijs-postgres-backup.yaml b/apps/production/wikijs-postgres-backup.yaml new file mode 100644 index 0000000..303f457 --- /dev/null +++ b/apps/production/wikijs-postgres-backup.yaml @@ -0,0 +1,82 @@ +# Nightly Borg backup der Wiki.js-Postgres-DB auf die Hetzner Storage Box (#0048). +# Der Inhalt liegt bereits versioniert in git (git-storage -> Gitea -> git.lab); dieses +# Backup sichert den Laufzeit-Zustand, den git NICHT hält: Kommentare, lokale Konten, +# OIDC-Nutzer und den Suchindex. Muster: apps/authentik/authentik-backup.yaml (DB-only). +# Wiederverwendet die synapse-backup-Credentials (SSH-Key + Borg-Passphrase) und das +# -known-hosts (gleicher Namespace, gleiche Storage Box), aber einen EIGENEN Borg-Repo- +# Pfad (wikijs-backup) und einen versetzten Zeitplan. +apiVersion: batch/v1 +kind: CronJob +metadata: + name: wikijs-backup + namespace: matrix +spec: + schedule: "30 3 * * *" + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 3 + failedJobsHistoryLimit: 3 + jobTemplate: + spec: + backoffLimit: 2 + template: + metadata: + labels: + app.kubernetes.io/name: wikijs-backup + app.kubernetes.io/component: backup + spec: + restartPolicy: OnFailure + containers: + - name: backup + image: rohana.axion1337.de/sorb/axion-backup:v2 + env: + - name: BORG_REPO + value: "ssh://u641795@u641795.your-storagebox.de:23/./wikijs-backup" + - name: BORG_PASSPHRASE + valueFrom: + secretKeyRef: + name: synapse-backup-credentials + key: borg-passphrase + - name: SSH_PRIVATE_KEY_FILE + value: /secrets/ssh/ssh-private-key + - name: SSH_KNOWN_HOSTS_FILE + value: /secrets/known-hosts/known_hosts + - name: DB_HOSTS + value: "wiki:wikijs-postgres" + - name: PGUSER + valueFrom: + secretKeyRef: + name: wikijs-postgres-secret + key: username + - name: PGPASSWORD + valueFrom: + secretKeyRef: + name: wikijs-postgres-secret + key: password + volumeMounts: + - name: ssh-key + mountPath: /secrets/ssh + readOnly: true + - name: known-hosts + mountPath: /secrets/known-hosts + readOnly: true + - name: scratch + mountPath: /scratch + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + memory: 256Mi + volumes: + - name: ssh-key + secret: + secretName: synapse-backup-credentials + items: + - key: ssh-private-key + path: ssh-private-key + mode: 0400 + - name: known-hosts + configMap: + name: synapse-backup-known-hosts + - name: scratch + emptyDir: {}