# Nightly Borg backup der Wiki.js-Postgres-DB auf die Hetzner Storage Box (#0048).
# Der Inhalt liegt bereits versioniert in git (git-storage -> Gitea -> git.lab); dieses
# Backup sichert den Laufzeit-Zustand, den git NICHT hält: Kommentare, lokale Konten,
# OIDC-Nutzer und den Suchindex. Muster: apps/authentik/authentik-backup.yaml (DB-only).
# Wiederverwendet die synapse-backup-Credentials (SSH-Key + Borg-Passphrase) und das
# -known-hosts (gleicher Namespace, gleiche Storage Box), aber einen EIGENEN Borg-Repo-
# Pfad (wikijs-backup) und einen versetzten Zeitplan.
apiVersion: batch/v1
kind: CronJob
metadata:
  name: wikijs-backup
  namespace: matrix
spec:
  schedule: "30 3 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        metadata:
          labels:
            app.kubernetes.io/name: wikijs-backup
            app.kubernetes.io/component: backup
        spec:
          restartPolicy: OnFailure
          containers:
            - name: backup
              image: rohana.axion1337.de/sorb/axion-backup:v2
              env:
                - name: BORG_REPO
                  value: "ssh://u641795@u641795.your-storagebox.de:23/./wikijs-backup"
                - name: BORG_PASSPHRASE
                  valueFrom:
                    secretKeyRef:
                      name: synapse-backup-credentials
                      key: borg-passphrase
                - name: SSH_PRIVATE_KEY_FILE
                  value: /secrets/ssh/ssh-private-key
                - name: SSH_KNOWN_HOSTS_FILE
                  value: /secrets/known-hosts/known_hosts
                - name: DB_HOSTS
                  value: "wiki:wikijs-postgres"
                - name: PGUSER
                  valueFrom:
                    secretKeyRef:
                      name: wikijs-postgres-secret
                      key: username
                - name: PGPASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: wikijs-postgres-secret
                      key: password
              volumeMounts:
                - name: ssh-key
                  mountPath: /secrets/ssh
                  readOnly: true
                - name: known-hosts
                  mountPath: /secrets/known-hosts
                  readOnly: true
                - name: scratch
                  mountPath: /scratch
              resources:
                requests:
                  cpu: 50m
                  memory: 128Mi
                limits:
                  memory: 256Mi
          volumes:
            - name: ssh-key
              secret:
                secretName: synapse-backup-credentials
                items:
                  - key: ssh-private-key
                    path: ssh-private-key
                    mode: 0400
            - name: known-hosts
              configMap:
                name: synapse-backup-known-hosts
            - name: scratch
              emptyDir: {}