nixos/manifests/immich/backup.yaml

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: immich-login
spec:
  target:
    name: immich-login
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        apikey: "{{ .apikey }}"
  secretStoreRef:
    name: bitwarden-fields
    kind: ClusterSecretStore
  data:
    - secretKey: apikey
      remoteRef:
        key: "dd0de40c-9ad6-4034-9d5c-b311016ebf19"
        property: apikey
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: immich-minio-creds
spec:
  target:
    name: immich-minio-creds
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        access-key: "{{ .minio_key }}"
        secret-key: "{{ .minio_secret }}"
        rclone.conf: |
          [nas1minio]
          type = s3
          provider = Minio
          endpoint = http://nas1.shire-zebra.ts.net:9000
          access_key_id = {{ .minio_key }}
          secret_access_key = {{ .minio_secret }}
          region = us-east-1
  secretStoreRef:
    name: bitwarden-login
    kind: ClusterSecretStore
  data:
    - secretKey: minio_key
      remoteRef:
        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
        property: username
    - secretKey: minio_secret
      remoteRef:
        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
        property: password
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: immich-backup-staging
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: longhorn-default
  resources:
    requests:
      storage: 400Gi
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup
spec:
  schedule: "0 4 * * *" # At 4am each day
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          volumes:
            - name: staging
              persistentVolumeClaim:
                claimName: immich-backup-staging
            - name: rclone-config
              secret:
                secretName: immich-minio-creds
                items:
                  - key: rclone.conf
                    path: rclone.conf
          initContainers:
            - name: immich-go
              image: "src.thehellings.com/greg/immich:latest"
              imagePullPolicy: "Always"
              command:
                - /bin/sh
                - "-c"
                - >-
                  rm -r /staging/*;
                  immich-go
                  archive
                  "--write-to-folder"
                  /staging
                  from-immich
                  "--from-api-key"
                  "$IMMICH_API_KEY"
                  "--from-server"
                  "http://immich-server:2283"
              volumeMounts:
                - name: staging
                  mountPath: /staging
              env:
                - name: IMMICH_API_KEY
                  valueFrom:
                    secretKeyRef:
                      name: immich-login
                      key: apikey
          containers:
            - name: rclone-sync
              image: "rclone/rclone:1.68"
              command:
                - /bin/sh
                - "-c"
                - |
                  rclone sync \
                    --config /rclone-config/rclone.conf \
                    --checksum \
                    --progress \
                    --transfers 4 \
                    --checkers 8 \
                    /staging nas1minio:immich
              volumeMounts:
                - name: staging
                  mountPath: /staging
                - name: rclone-config
                  mountPath: /rclone-config
                  readOnly: true