Thore CimbalandClaude Sonnet 5
f5e9fc5d2b
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Closes issues #6 and #15 (treated jointly, per combined analysis in their comments). Two CronJobs, one per namespace, each pushing to its own Borg repo on the newly booked Storage Box (u641795.your-storagebox.de:23, BX11 1TB) with its own repo passphrase - a leaked passphrase for one doesn't expose the other: - matrix: synapse-backup dumps the synapse + matrixauthenticationservice DBs (shared postgres, existing chart-generated POSTGRES_ADMIN_PASSWORD) and the Synapse media_store PVC (read-only mount) - authentik: authentik-backup dumps the authentik DB (existing authentik-credentials pg-password) Custom image (rohana.axion1337.de/sorb/axion-backup:v1, postgres:17-alpine + borgbackup + openssh-client - matches the live Postgres major version exactly, unlike Alpine's stock postgresql16-client) pushed as a public package, same pattern as the existing threadnet-web image (no imagePullSecret needed). SSH host key pinned via known_hosts ConfigMap (captured via ssh-keyscan ahead of time) rather than trusting on first connect in an unattended job. Retention: 7 daily / 4 weekly / 6 monthly via borg prune. Schedule: 03:00 and 03:15, offset to avoid resource contention. NetworkPolicy: added each backup job's pod as an allowed source to its namespace's existing postgres ingress rule (matrix's allow-ingress-postgres, authentik's allow-ingress-authentik-postgresql from #37). Egress already unrestricted in both namespaces, so no change needed for the outbound SSH connection to the Storage Box. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
24 lines
1.9 KiB
YAML
24 lines
1.9 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: authentik-backup-credentials
|
|
namespace: authentik
|
|
stringData:
|
|
borg-passphrase: ENC[AES256_GCM,data:5PApz4TqSNN2vVXeFSuomd051nl+cYk+a+STViwddG/Hj7XWQ099vvTlKSE=,iv:MFG04/66YqtOjZWsLpy236MYwR05z91ngOQ0BmLNxzA=,tag:gxD5prW8Ted3Q2ZY3sYSYQ==,type:str]
|
|
ssh-private-key: ENC[AES256_GCM,data:87PrkqAIH2xRCu3jlAK3Ts24XKRDoXNCWLomRhizCY43hwLeY5fNzfsGnMTKBt5IxL2bIljx+pbh/Y8IO38ISUUbUAczfi1KeN1gg69wKgqNAlckcmD0dkA2N2F0ZnEFX/rkad68YR8Hw1/A5h3qGUd5FwoVWzIFD/diY86s/LiQBYzwD4bYLUACHqIL7+QyJ6jEsFzA3tLwDySpUpM9OAjFQF0EazObChNYqe/qrc8i1gI8CptWOFkqiZ8Pen1E79gg/zgleOBqSmlcefgZk+JFPAfvORTHkDrHW9X/bLygaTQvskmGNzaKHpe2s/bVafWb7G60ROrpdjYIJfS7c0baRCSrd9kwdM4JQC2gSsMkI4v6oeFSvkTrb684B10zacZdiTKfySDV+Ry4hCZofF2RhAnsTbOpo0XANoOi4InoxUqGPfctVfUCVb6X+HIR5XYxpLrNwWqRpscMP2P3RJsaUZOinmQUKrHX/nMtPZ/ltpwjhQeAXZTtdyPxTCjHAh6fzouuHk66vlCdukXsMQDBdIfdA/3jjGbW,iv:yFNKkdegLLq8jq1Ya6v67urSJTdG3Ge4ZbmKizqQhmk=,tag:6l/qMb1d1oD8sfVEebW6gQ==,type:str]
|
|
sops:
|
|
age:
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWMllTL2hRcEhCT2MxcWZy
|
|
dkxndmlZRW5FZ2NiWWdFckxqYTFKS1B6SXlvCjJySXRsZThvczNnWjlyM0N2Snha
|
|
eitvWUhhdmU4U0V3OG55WjdLbU9KcUEKLS0tIEM3MStzNUJhaGg4M0hKMVF1bnBB
|
|
RWVqVDRBNmJ0b1Bwd0l3dWxPT3Q0SU0KOEoyejkH4RC0p8ka3FjI7MyzRJg+uu7h
|
|
j3wf1q+Hgg73djDBSPYJkrB6Bdl4YMwo8SzbtW8O9elDE0qAioR0bQ==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age14l0hwfqylwpemz5y2ghh2yxk0phszlnj3qlejhue0fw0kz3tmfgqdsjzdh
|
|
encrypted_regex: ^(data|stringData)$
|
|
lastmodified: "2026-07-28T18:20:58Z"
|
|
mac: ENC[AES256_GCM,data:lwwNbxSxtgDTDmaWMU1uf7TBOEw8gFBFKb982VIsGMeM0fIPHvX12Qts90MNgYIJliOWgAWrwyvAgfXWKuE37RNo+BtyfHCWi4IESKSN/RJrd/yMpRKx+02rifH3nl26ZCAQT1Pa0fjI1SfMhbVzfnD9a/AMARXZMhLRc0OqczY=,iv:SgP2iMtENRtZfw6I9EaOsmvecFNYCIZWqVj+cZ+T7EI=,tag:s4oEyxqyUx6ibqsk4g9xpw==,type:str]
|
|
version: 3.13.3
|