From 51aa72d5b67c62096a3e11cfac182016aaa2f23d Mon Sep 17 00:00:00 2001 From: klaatu Date: Sat, 4 Apr 2026 06:09:26 +0000 Subject: [PATCH 1/4] feat(hosea): add restic backup for AlbyHub with agenix secret --- hosts/unstable/hosea/default.nix | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/hosts/unstable/hosea/default.nix b/hosts/unstable/hosea/default.nix index 537be9c..505e918 100644 --- a/hosts/unstable/hosea/default.nix +++ b/hosts/unstable/hosea/default.nix @@ -26,6 +26,13 @@ in owner = "grafana"; }; + # NOTE: Before deploying, create the secret with: + # agenix -e secrets/albyhub-restic-password.age + age.secrets.albyhub-restic-password = { + file = ../../../secrets/albyhub-restic-password.age; + owner = "root"; + }; + # Bootloader boot = { loader = { @@ -103,6 +110,29 @@ in workDir = "/chain/alby"; }; }; + restic.backups.albyhub = { + # Backs up AlbyHub's LDK state directory to the nas1 Restic REST server. + # The service is stopped before backup to ensure LDK state consistency + # and restarted afterward. + repository = "rest:https://nas1.shire-zebra.ts.net:30248/albyhub"; + passwordFile = config.age.secrets.albyhub-restic-password.path; + paths = [ "/chain/alby" ]; + timerConfig = { + OnCalendar = "daily"; + RandomizedDelaySec = "1h"; + }; + backupPrepareCommand = '' + systemctl stop albyhub.service || true + ''; + backupCleanupCommand = '' + systemctl start albyhub.service || true + ''; + pruneOpts = [ + "--keep-daily 7" + "--keep-weekly 4" + "--keep-monthly 3" + ]; + }; jellyfin = { enable = true; openFirewall = true; -- 2.54.0 From 44f22e93e3fe45817fddbc898b0c2b0f70c99a74 Mon Sep 17 00:00:00 2001 From: klaatu Date: Sat, 4 Apr 2026 06:09:34 +0000 Subject: [PATCH 2/4] feat(gitea): add daily dump CronJob to NFS share on nas1 --- manifests/gitea/dump-cronjob.yaml | 44 +++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 manifests/gitea/dump-cronjob.yaml diff --git a/manifests/gitea/dump-cronjob.yaml b/manifests/gitea/dump-cronjob.yaml new file mode 100644 index 0000000..2bda2d3 --- /dev/null +++ b/manifests/gitea/dump-cronjob.yaml @@ -0,0 +1,44 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: gitea-dump + namespace: gitea +spec: + schedule: "0 2 * * *" # At 2am each day (offset from 4am Immich backup) + jobTemplate: + spec: + template: + spec: + restartPolicy: Never + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + fsGroup: 1000 + volumes: + - name: gitea-data + persistentVolumeClaim: + claimName: gitea-release-gitea + readOnly: true + - name: nas1-dumps + nfs: + server: nas1.shire-zebra.ts.net + path: /mnt/all/backups/gitea-dumps + containers: + - name: gitea-dump + image: "gitea/gitea:1.25.4" + command: + - /bin/sh + - "-c" + - | + set -e + DUMP_FILE="/nas1/gitea-dump-$(date +%Y%m%d-%H%M%S).zip" + gitea dump -c /data/gitea/conf/app.ini --type zip --file "$DUMP_FILE" + echo "Dump written to $DUMP_FILE" + find /nas1/ -name "*.zip" -mtime +30 -delete + echo "Old dumps cleaned up" + volumeMounts: + - name: gitea-data + mountPath: /data + readOnly: true + - name: nas1-dumps + mountPath: /nas1 -- 2.54.0 From c83d6b81d839236d9280f18fa227a6f6dd5ae3a7 Mon Sep 17 00:00:00 2001 From: klaatu Date: Sat, 4 Apr 2026 06:09:41 +0000 Subject: [PATCH 3/4] feat(gitea): add dump-cronjob.yaml to kustomization --- manifests/gitea/kustomization.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/manifests/gitea/kustomization.yaml b/manifests/gitea/kustomization.yaml index e48af02..a66546d 100644 --- a/manifests/gitea/kustomization.yaml +++ b/manifests/gitea/kustomization.yaml @@ -6,3 +6,4 @@ resources: - chart.yaml - ingress.yaml - secrets.yaml + - dump-cronjob.yaml -- 2.54.0 From 59b399671e7aba3ab56c16ba88f225ffb307a9e2 Mon Sep 17 00:00:00 2001 From: klaatu Date: Sat, 4 Apr 2026 06:09:48 +0000 Subject: [PATCH 4/4] feat(immich): add MinIO rclone sync stage to backup CronJob --- manifests/immich/backup.yaml | 71 ++++++++++++++++++++++++++++++++---- 1 file changed, 63 insertions(+), 8 deletions(-) diff --git a/manifests/immich/backup.yaml b/manifests/immich/backup.yaml index c5cfe5b..816e828 100644 --- a/manifests/immich/backup.yaml +++ b/manifests/immich/backup.yaml @@ -19,6 +19,32 @@ spec: key: "dd0de40c-9ad6-4034-9d5c-b311016ebf19" property: apikey --- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: immich-minio-creds +spec: + target: + name: immich-minio-creds + deletionPolicy: Delete + template: + type: Opaque + data: + minio_key: "{{ .minio_key }}" + minio_secret: "{{ .minio_secret }}" + secretStoreRef: + name: bitwarden-fields + kind: ClusterSecretStore + data: + - secretKey: minio_key + remoteRef: + key: "dcbcf704-7dce-48d7-bbd1-b3a801875b3d" + property: username + - secretKey: minio_secret + remoteRef: + key: "dcbcf704-7dce-48d7-bbd1-b3a801875b3d" + property: password +--- apiVersion: batch/v1 kind: CronJob metadata: @@ -31,11 +57,9 @@ spec: spec: restartPolicy: Never volumes: - - name: nas1 - nfs: - path: /mnt/all/backups/immich - server: nas1.shire-zebra.ts.net - containers: + - name: stage + emptyDir: {} + initContainers: - name: immich-go image: "src.thehellings.com/greg/immich:latest" imagePullPolicy: "Always" @@ -46,18 +70,49 @@ spec: immich-go archive "--write-to-folder" - /nas1 + /stage from-immich "--from-api-key" "$IMMICH_API_KEY" "--from-server" "http://immich-server:2283" volumeMounts: - - name: nas1 - mountPath: /nas1 + - name: stage + mountPath: /stage env: - name: IMMICH_API_KEY valueFrom: secretKeyRef: name: immich-login key: apikey + containers: + - name: rclone + image: "rclone/rclone:latest" + command: + - /bin/sh + - "-c" + - | + rclone sync --checksum \ + --s3-provider Minio \ + --s3-endpoint "$MINIO_ENDPOINT" \ + --s3-access-key-id "$MINIO_ACCESS_KEY" \ + --s3-secret-access-key "$MINIO_SECRET_KEY" \ + --s3-no-check-bucket \ + /stage \ + :s3:immich + volumeMounts: + - name: stage + mountPath: /stage + env: + - name: MINIO_ENDPOINT + value: "http://nas1.shire-zebra.ts.net:9000" + - name: MINIO_ACCESS_KEY + valueFrom: + secretKeyRef: + name: immich-minio-creds + key: minio_key + - name: MINIO_SECRET_KEY + valueFrom: + secretKeyRef: + name: immich-minio-creds + key: minio_secret -- 2.54.0