138 lines
3.6 KiB
YAML
138 lines
3.6 KiB
YAML
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: immich-login
|
|
spec:
|
|
target:
|
|
name: immich-login
|
|
deletionPolicy: Delete
|
|
template:
|
|
type: Opaque
|
|
data:
|
|
apikey: "{{ .apikey }}"
|
|
secretStoreRef:
|
|
name: bitwarden-fields
|
|
kind: ClusterSecretStore
|
|
data:
|
|
- secretKey: apikey
|
|
remoteRef:
|
|
key: "dd0de40c-9ad6-4034-9d5c-b311016ebf19"
|
|
property: apikey
|
|
---
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: immich-minio-creds
|
|
spec:
|
|
target:
|
|
name: immich-minio-creds
|
|
deletionPolicy: Delete
|
|
template:
|
|
type: Opaque
|
|
data:
|
|
access-key: "{{ .minio_key }}"
|
|
secret-key: "{{ .minio_secret }}"
|
|
rclone.conf: |
|
|
[garage]
|
|
type = s3
|
|
provider = Minio
|
|
endpoint = http://nas1.shire-zebra.ts.net:30188
|
|
access_key_id = {{ .minio_key }}
|
|
secret_access_key = {{ .minio_secret }}
|
|
region = garage
|
|
secretStoreRef:
|
|
name: bitwarden-login
|
|
kind: ClusterSecretStore
|
|
data:
|
|
- secretKey: minio_key
|
|
remoteRef:
|
|
key: 8fce2750-aa62-4892-b90c-b49c001f494b
|
|
property: username
|
|
- secretKey: minio_secret
|
|
remoteRef:
|
|
key: 8fce2750-aa62-4892-b90c-b49c001f494b
|
|
property: password
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: immich-backup-staging
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
storageClassName: longhorn-default
|
|
resources:
|
|
requests:
|
|
storage: 400Gi
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: backup
|
|
spec:
|
|
schedule: "0 4 * * *" # At 4am each day
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
volumes:
|
|
- name: staging
|
|
persistentVolumeClaim:
|
|
claimName: immich-backup-staging
|
|
- name: rclone-config
|
|
secret:
|
|
secretName: immich-minio-creds
|
|
items:
|
|
- key: rclone.conf
|
|
path: rclone.conf
|
|
initContainers:
|
|
- name: immich-go
|
|
image: "src.thehellings.com/greg/immich:latest"
|
|
imagePullPolicy: "Always"
|
|
command:
|
|
- /bin/sh
|
|
- "-c"
|
|
- >-
|
|
rm -r /staging/*;
|
|
immich-go
|
|
archive
|
|
"--write-to-folder"
|
|
/staging
|
|
from-immich
|
|
"--from-api-key"
|
|
"$IMMICH_API_KEY"
|
|
"--from-server"
|
|
"http://immich-server:2283"
|
|
volumeMounts:
|
|
- name: staging
|
|
mountPath: /staging
|
|
env:
|
|
- name: IMMICH_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: immich-login
|
|
key: apikey
|
|
containers:
|
|
- name: rclone-sync
|
|
image: "rclone/rclone:1.68"
|
|
command:
|
|
- /bin/sh
|
|
- "-c"
|
|
- |
|
|
rclone sync \
|
|
--config /rclone-config/rclone.conf \
|
|
--checksum \
|
|
--progress \
|
|
--transfers 4 \
|
|
--checkers 8 \
|
|
/staging garage:immich
|
|
volumeMounts:
|
|
- name: staging
|
|
mountPath: /staging
|
|
- name: rclone-config
|
|
mountPath: /rclone-config
|
|
readOnly: true
|