apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: immich-login
spec:
  target:
    name: immich-login
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        apikey: "{{ .apikey }}"
  secretStoreRef:
    name: bitwarden-fields
    kind: ClusterSecretStore
  data:
    - secretKey: apikey
      remoteRef:
        key: "dd0de40c-9ad6-4034-9d5c-b311016ebf19"
        property: apikey
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: immich-minio-creds
spec:
  target:
    name: immich-minio-creds
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        minio_key: "{{ .minio_key }}"
        minio_secret: "{{ .minio_secret }}"
  secretStoreRef:
    name: bitwarden-fields
    kind: ClusterSecretStore
  data:
    - secretKey: minio_key
      remoteRef:
        key: "dcbcf704-7dce-48d7-bbd1-b3a801875b3d"
        property: username
    - secretKey: minio_secret
      remoteRef:
        key: "dcbcf704-7dce-48d7-bbd1-b3a801875b3d"
        property: password
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup
spec:
  schedule: "0 4 * * *" # At 4am each day
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          volumes:
            - name: stage
              emptyDir: {}
          initContainers:
            - name: immich-go
              image: "src.thehellings.com/greg/immich:latest"
              imagePullPolicy: "Always"
              command:
                - /bin/sh
                - "-c"
                - >-
                  immich-go
                  archive
                  "--write-to-folder"
                  /stage
                  from-immich
                  "--from-api-key"
                  "$IMMICH_API_KEY"
                  "--from-server"
                  "http://immich-server:2283"
              volumeMounts:
                - name: stage
                  mountPath: /stage
              env:
                - name: IMMICH_API_KEY
                  valueFrom:
                    secretKeyRef:
                      name: immich-login
                      key: apikey
          containers:
            - name: rclone
              image: "rclone/rclone:latest"
              command:
                - /bin/sh
                - "-c"
                - |
                  rclone sync --checksum \
                    --s3-provider Minio \
                    --s3-endpoint "$MINIO_ENDPOINT" \
                    --s3-access-key-id "$MINIO_ACCESS_KEY" \
                    --s3-secret-access-key "$MINIO_SECRET_KEY" \
                    --s3-no-check-bucket \
                    /stage \
                    :s3:immich
              volumeMounts:
                - name: stage
                  mountPath: /stage
              env:
                - name: MINIO_ENDPOINT
                  value: "http://nas1.shire-zebra.ts.net:9000"
                - name: MINIO_ACCESS_KEY
                  valueFrom:
                    secretKeyRef:
                      name: immich-minio-creds
                      key: minio_key
                - name: MINIO_SECRET_KEY
                  valueFrom:
                    secretKeyRef:
                      name: immich-minio-creds
                      key: minio_secret