# Nightly Borg backup of the shared Postgres instance (synapse + MAS databases) and the
# Synapse media_store PVC to a Hetzner Storage Box (issues #6 + #15). See
# apps/production/synapse-backup-secret.yaml for the SSH key + Borg repo passphrase, and
# apps/authentik/authentik-backup.yaml for the equivalent authentik-side job.
apiVersion: v1
kind: ConfigMap
metadata:
  name: synapse-backup-known-hosts
  namespace: matrix
data:
  # Pinned via `ssh-keyscan -p 23 u641795.your-storagebox.de` (2026-07-28) rather than
  # trusting the host key on first connect in an unattended job.
  known_hosts: |
    [u641795.your-storagebox.de]:23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: synapse-backup
  namespace: matrix
spec:
  schedule: "0 3 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        metadata:
          labels:
            app.kubernetes.io/name: synapse-backup
            app.kubernetes.io/component: backup
        spec:
          restartPolicy: OnFailure
          containers:
            - name: backup
              image: rohana.axion1337.de/sorb/axion-backup:v2
              env:
                - name: BORG_REPO
                  value: "ssh://u641795@u641795.your-storagebox.de:23/./synapse-backup"
                - name: BORG_PASSPHRASE
                  valueFrom:
                    secretKeyRef:
                      name: synapse-backup-credentials
                      key: borg-passphrase
                - name: SSH_PRIVATE_KEY_FILE
                  value: /secrets/ssh/ssh-private-key
                - name: SSH_KNOWN_HOSTS_FILE
                  value: /secrets/known-hosts/known_hosts
                - name: DB_HOSTS
                  value: "synapse:matrix-stack-postgres matrixauthenticationservice:matrix-stack-postgres"
                - name: PGUSER
                  value: postgres
                - name: PGPASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: matrix-stack-generated
                      key: POSTGRES_ADMIN_PASSWORD
                - name: MEDIA_PATH
                  value: /media/media_store
              volumeMounts:
                - name: ssh-key
                  mountPath: /secrets/ssh
                  readOnly: true
                - name: known-hosts
                  mountPath: /secrets/known-hosts
                  readOnly: true
                - name: media
                  mountPath: /media
                  readOnly: true
                - name: scratch
                  mountPath: /scratch
              resources:
                requests:
                  cpu: 50m
                  memory: 128Mi
                limits:
                  memory: 256Mi
          volumes:
            - name: ssh-key
              secret:
                secretName: synapse-backup-credentials
                items:
                  - key: ssh-private-key
                    path: ssh-private-key
                    mode: 0400
            - name: known-hosts
              configMap:
                name: synapse-backup-known-hosts
            - name: media
              persistentVolumeClaim:
                claimName: matrix-stack-synapse-media
                readOnly: true
            - name: scratch
              emptyDir: {}