From 59b399671e7aba3ab56c16ba88f225ffb307a9e2 Mon Sep 17 00:00:00 2001
From: klaatu <klaatu@thehellings.com>
Date: Sat, 4 Apr 2026 06:09:48 +0000
Subject: [PATCH] feat(immich): add MinIO rclone sync stage to backup CronJob

---
 manifests/immich/backup.yaml | 71 ++++++++++++++++++++++++++++++++----
 1 file changed, 63 insertions(+), 8 deletions(-)

diff --git a/manifests/immich/backup.yaml b/manifests/immich/backup.yaml
index c5cfe5b..816e828 100644
--- a/manifests/immich/backup.yaml
+++ b/manifests/immich/backup.yaml
@@ -19,6 +19,32 @@ spec:
         key: "dd0de40c-9ad6-4034-9d5c-b311016ebf19"
         property: apikey
 ---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: immich-minio-creds
+spec:
+  target:
+    name: immich-minio-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        minio_key: "{{ .minio_key }}"
+        minio_secret: "{{ .minio_secret }}"
+  secretStoreRef:
+    name: bitwarden-fields
+    kind: ClusterSecretStore
+  data:
+    - secretKey: minio_key
+      remoteRef:
+        key: "dcbcf704-7dce-48d7-bbd1-b3a801875b3d"
+        property: username
+    - secretKey: minio_secret
+      remoteRef:
+        key: "dcbcf704-7dce-48d7-bbd1-b3a801875b3d"
+        property: password
+---
 apiVersion: batch/v1
 kind: CronJob
 metadata:
@@ -31,11 +57,9 @@ spec:
         spec:
           restartPolicy: Never
           volumes:
-            - name: nas1
-              nfs:
-                path: /mnt/all/backups/immich
-                server: nas1.shire-zebra.ts.net
-          containers:
+            - name: stage
+              emptyDir: {}
+          initContainers:
             - name: immich-go
               image: "src.thehellings.com/greg/immich:latest"
               imagePullPolicy: "Always"
@@ -46,18 +70,49 @@ spec:
                   immich-go
                   archive
                   "--write-to-folder"
-                  /nas1
+                  /stage
                   from-immich
                   "--from-api-key"
                   "$IMMICH_API_KEY"
                   "--from-server"
                   "http://immich-server:2283"
               volumeMounts:
-                - name: nas1
-                  mountPath: /nas1
+                - name: stage
+                  mountPath: /stage
               env:
                 - name: IMMICH_API_KEY
                   valueFrom:
                     secretKeyRef:
                       name: immich-login
                       key: apikey
+          containers:
+            - name: rclone
+              image: "rclone/rclone:latest"
+              command:
+                - /bin/sh
+                - "-c"
+                - |
+                  rclone sync --checksum \
+                    --s3-provider Minio \
+                    --s3-endpoint "$MINIO_ENDPOINT" \
+                    --s3-access-key-id "$MINIO_ACCESS_KEY" \
+                    --s3-secret-access-key "$MINIO_SECRET_KEY" \
+                    --s3-no-check-bucket \
+                    /stage \
+                    :s3:immich
+              volumeMounts:
+                - name: stage
+                  mountPath: /stage
+              env:
+                - name: MINIO_ENDPOINT
+                  value: "http://nas1.shire-zebra.ts.net:9000"
+                - name: MINIO_ACCESS_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: immich-minio-creds
+                      key: minio_key
+                - name: MINIO_SECRET_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: immich-minio-creds
+                      key: minio_secret