From 4e5320847bc4d2fc0f6fb0746807b3ddca77934f Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Sat, 25 Oct 2025 01:06:31 -0500
Subject: [PATCH] Add backups for Immich

Add a nightly cron backup to push Immich backups onto the NAS
---
 manifests/immich/backup.yaml        | 61 +++++++++++++++++++++++++++++
 manifests/immich/kustomization.yaml |  1 +
 2 files changed, 62 insertions(+)
 create mode 100644 manifests/immich/backup.yaml

diff --git a/manifests/immich/backup.yaml b/manifests/immich/backup.yaml
new file mode 100644
index 0000000..7b93b91
--- /dev/null
+++ b/manifests/immich/backup.yaml
@@ -0,0 +1,61 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: immich-login
+spec:
+  target:
+    name: immich-login
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        apikey: "{{ .apikey }}"
+  secretStoreRef:
+    name: bitwarden-fields
+    kind: ClusterSecretStore
+  data:
+    - secretKey: apikey
+      remoteRef:
+        key: "dd0de40c-9ad6-4034-9d5c-b311016ebf19"
+        property: apikey
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: backup
+spec:
+  schedule: "0 4 * * *" # At 4am each day
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          volumes:
+            - name: nas1
+              nfs:
+                path: /mnt/all/backups/immich
+                server: nas1.shire-zebra.ts.net
+          containers:
+            - name: immich-go
+              image: "nixos/nix:latest"
+              imagePullPolicy: "Always"
+              command:
+                - nix-shell
+                - "-p"
+                - immich-go
+                - "--run"
+                - >-
+                  immich-go archive
+                  --write-to-folder /nas1
+                  from-immich
+                  --from-api-key "$IMMICH_API_KEY"
+                  --from-server http://immich-server:2283
+              volumeMounts:
+                - name: nas1
+                  mountPath: /nas1
+              env:
+                - name: IMMICH_API_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: immich-login
+                      key: apikey
diff --git a/manifests/immich/kustomization.yaml b/manifests/immich/kustomization.yaml
index 03bc10d..40ec1ea 100644
--- a/manifests/immich/kustomization.yaml
+++ b/manifests/immich/kustomization.yaml
@@ -6,3 +6,4 @@ resources:
   - postgres-user-secret.yaml
   - pvc.yaml
   - ingress.yaml
+  - backup.yaml