Thore CimbalandClaude Sonnet 5
bccd265302
Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s
Live testing showed pg_dump got "Connection refused" immediately at job start, but a manual pg_isready/psql from an identically-labeled pod a few seconds later succeeded fine every time. The cluster's NetworkPolicy controller needs a brief moment to program a brand-new pod's IP into the target's allowed ingress rules; a job that starts dumping instantly can race that window. backup.sh now waits for pg_isready before each pg_dump (up to 15 tries / ~30s) instead of assuming connectivity is ready at container start. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
97 lines
3.4 KiB
YAML
97 lines
3.4 KiB
YAML
# Nightly Borg backup of the shared Postgres instance (synapse + MAS databases) and the
|
|
# Synapse media_store PVC to a Hetzner Storage Box (issues #6 + #15). See
|
|
# apps/production/synapse-backup-secret.yaml for the SSH key + Borg repo passphrase, and
|
|
# apps/authentik/authentik-backup.yaml for the equivalent authentik-side job.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: synapse-backup-known-hosts
|
|
namespace: matrix
|
|
data:
|
|
# Pinned via `ssh-keyscan -p 23 u641795.your-storagebox.de` (2026-07-28) rather than
|
|
# trusting the host key on first connect in an unattended job.
|
|
known_hosts: |
|
|
[u641795.your-storagebox.de]:23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: synapse-backup
|
|
namespace: matrix
|
|
spec:
|
|
schedule: "0 3 * * *"
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: synapse-backup
|
|
app.kubernetes.io/component: backup
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: backup
|
|
image: rohana.axion1337.de/sorb/axion-backup:v2
|
|
env:
|
|
- name: BORG_REPO
|
|
value: "ssh://u641795@u641795.your-storagebox.de:23/./synapse-backup"
|
|
- name: BORG_PASSPHRASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: synapse-backup-credentials
|
|
key: borg-passphrase
|
|
- name: SSH_PRIVATE_KEY_FILE
|
|
value: /secrets/ssh/ssh-private-key
|
|
- name: SSH_KNOWN_HOSTS_FILE
|
|
value: /secrets/known-hosts/known_hosts
|
|
- name: DB_HOSTS
|
|
value: "synapse:matrix-stack-postgres matrixauthenticationservice:matrix-stack-postgres"
|
|
- name: PGUSER
|
|
value: postgres
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: matrix-stack-generated
|
|
key: POSTGRES_ADMIN_PASSWORD
|
|
- name: MEDIA_PATH
|
|
value: /media/media_store
|
|
volumeMounts:
|
|
- name: ssh-key
|
|
mountPath: /secrets/ssh
|
|
readOnly: true
|
|
- name: known-hosts
|
|
mountPath: /secrets/known-hosts
|
|
readOnly: true
|
|
- name: media
|
|
mountPath: /media
|
|
readOnly: true
|
|
- name: scratch
|
|
mountPath: /scratch
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 256Mi
|
|
volumes:
|
|
- name: ssh-key
|
|
secret:
|
|
secretName: synapse-backup-credentials
|
|
items:
|
|
- key: ssh-private-key
|
|
path: ssh-private-key
|
|
mode: 0400
|
|
- name: known-hosts
|
|
configMap:
|
|
name: synapse-backup-known-hosts
|
|
- name: media
|
|
persistentVolumeClaim:
|
|
claimName: matrix-stack-synapse-media
|
|
readOnly: true
|
|
- name: scratch
|
|
emptyDir: {}
|