A lowly tech priest's attempt to please Mars
feat: set up remote backups for postgres
+129
-98
-18
kubernetes/apps/storage/postgres/clusters/auth/backup.yaml
-18
kubernetes/apps/storage/postgres/clusters/auth/backup.yaml
···
1
-
apiVersion: barmancloud.cnpg.io/v1
2
-
kind: ObjectStore
3
-
metadata:
4
-
name: auth-backup-store
5
-
spec:
6
-
configuration:
7
-
destinationPath: s3://postgresql-backup/auth/
8
-
endpointURL: ${S3_HOST}
9
-
s3Credentials:
10
-
accessKeyId:
11
-
name: postgres-backup-secrets
12
-
key: S3_ACCESS_KEY
13
-
secretAccessKey:
14
-
name: postgres-backup-secrets
15
-
key: S3_SECRET_KEY
16
-
wal:
17
-
compression: bzip2
18
-
maxParallel: 8
+1
-1
kubernetes/apps/storage/postgres/clusters/auth/cluster.yaml
+1
-1
kubernetes/apps/storage/postgres/clusters/auth/cluster.yaml
+87
kubernetes/apps/storage/postgres/clusters/backup.yaml
+87
kubernetes/apps/storage/postgres/clusters/backup.yaml
···
1
+
apiVersion: apps/v1
2
+
kind: Deployment
3
+
metadata:
4
+
name: backup-s3proxy
5
+
spec:
6
+
replicas: 1
7
+
selector:
8
+
matchLabels:
9
+
app: backup-s3proxy
10
+
template:
11
+
metadata:
12
+
labels:
13
+
app: backup-s3proxy
14
+
spec:
15
+
securityContext:
16
+
fsGroup: 2000
17
+
containers:
18
+
- name: s3proxy
19
+
securityContext:
20
+
capabilities:
21
+
drop:
22
+
- ALL
23
+
readOnlyRootFilesystem: true
24
+
runAsNonRoot: true
25
+
runAsUser: 1000
26
+
image: ghcr.io/intrinsec/s3proxy:1.7.0
27
+
imagePullPolicy: IfNotPresent
28
+
args:
29
+
- '--level=4'
30
+
- '--no-tls'
31
+
envFrom:
32
+
- secretRef:
33
+
name: s3proxy
34
+
ports:
35
+
- name: http
36
+
containerPort: 4433
37
+
protocol: TCP
38
+
livenessProbe:
39
+
httpGet:
40
+
path: /healthz # Liveness endpoint
41
+
port: 4433
42
+
scheme: HTTP
43
+
readinessProbe:
44
+
httpGet:
45
+
path: /readyz # Readiness endpoint
46
+
port: 4433
47
+
scheme: HTTP
48
+
resources:
49
+
limits:
50
+
cpu: 500m
51
+
memory: 256Mi
52
+
requests:
53
+
cpu: 250m
54
+
memory: 128Mi
55
+
---
56
+
apiVersion: v1
57
+
kind: Service
58
+
metadata:
59
+
name: backup-s3proxy
60
+
spec:
61
+
ports:
62
+
- name: http
63
+
port: 80
64
+
protocol: TCP
65
+
targetPort: http
66
+
selector:
67
+
app: backup-s3proxy
68
+
type: ClusterIP
69
+
---
70
+
apiVersion: barmancloud.cnpg.io/v1
71
+
kind: ObjectStore
72
+
metadata:
73
+
name: offsite-backup
74
+
spec:
75
+
configuration:
76
+
destinationPath: s3://proteus-postgres/
77
+
endpointURL: http://backup-s3proxy/
78
+
s3Credentials:
79
+
accessKeyId:
80
+
name: postgres-backup-secrets
81
+
key: S3_ACCESS_KEY
82
+
secretAccessKey:
83
+
name: postgres-backup-secrets
84
+
key: S3_SECRET_KEY
85
+
wal:
86
+
compression: bzip2
87
+
maxParallel: 8
-18
kubernetes/apps/storage/postgres/clusters/immich-2/backup.yaml
-18
kubernetes/apps/storage/postgres/clusters/immich-2/backup.yaml
···
1
-
apiVersion: barmancloud.cnpg.io/v1
2
-
kind: ObjectStore
3
-
metadata:
4
-
name: immich-2-backup-store
5
-
spec:
6
-
configuration:
7
-
destinationPath: s3://postgresql-backup/immich-2/
8
-
endpointURL: ${S3_HOST}
9
-
s3Credentials:
10
-
accessKeyId:
11
-
name: postgres-backup-secrets
12
-
key: S3_ACCESS_KEY
13
-
secretAccessKey:
14
-
name: postgres-backup-secrets
15
-
key: S3_SECRET_KEY
16
-
wal:
17
-
compression: bzip2
18
-
maxParallel: 8
+1
-1
kubernetes/apps/storage/postgres/clusters/immich-2/cluster.yaml
+1
-1
kubernetes/apps/storage/postgres/clusters/immich-2/cluster.yaml
-18
kubernetes/apps/storage/postgres/clusters/media/backup.yaml
-18
kubernetes/apps/storage/postgres/clusters/media/backup.yaml
···
1
-
apiVersion: barmancloud.cnpg.io/v1
2
-
kind: ObjectStore
3
-
metadata:
4
-
name: media-backup-store
5
-
spec:
6
-
configuration:
7
-
destinationPath: s3://postgresql-backup/media/
8
-
endpointURL: ${S3_HOST}
9
-
s3Credentials:
10
-
accessKeyId:
11
-
name: postgres-backup-secrets
12
-
key: S3_ACCESS_KEY
13
-
secretAccessKey:
14
-
name: postgres-backup-secrets
15
-
key: S3_SECRET_KEY
16
-
wal:
17
-
compression: bzip2
18
-
maxParallel: 8
+1
-1
kubernetes/apps/storage/postgres/clusters/media/cluster.yaml
+1
-1
kubernetes/apps/storage/postgres/clusters/media/cluster.yaml
-18
kubernetes/apps/storage/postgres/clusters/office/backup.yaml
-18
kubernetes/apps/storage/postgres/clusters/office/backup.yaml
···
1
-
apiVersion: barmancloud.cnpg.io/v1
2
-
kind: ObjectStore
3
-
metadata:
4
-
name: office-backup-store
5
-
spec:
6
-
configuration:
7
-
destinationPath: s3://postgresql-backup/office/
8
-
endpointURL: ${S3_HOST}
9
-
s3Credentials:
10
-
accessKeyId:
11
-
name: postgres-backup-secrets
12
-
key: S3_ACCESS_KEY
13
-
secretAccessKey:
14
-
name: postgres-backup-secrets
15
-
key: S3_SECRET_KEY
16
-
wal:
17
-
compression: bzip2
18
-
maxParallel: 8
+1
-1
kubernetes/apps/storage/postgres/clusters/office/cluster.yaml
+1
-1
kubernetes/apps/storage/postgres/clusters/office/cluster.yaml
+37
-3
kubernetes/apps/storage/postgres/clusters/secrets.yaml
+37
-3
kubernetes/apps/storage/postgres/clusters/secrets.yaml
···
1
+
apiVersion: v1
2
+
kind: Secret
3
+
metadata:
4
+
name: s3proxy
5
+
stringData:
6
+
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:YBD7DclbfYxcdZNmcg99WUnm/BM=,iv:P1yXu0tLPoXlSUHJP27BjSS4zQe+vjuU9QXfgPXrO0Q=,tag:xzY10mtFxlbTOxpNX7BTwA==,type:str]
7
+
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:AtN6zJ9Ujv73KbmmIe7Lb7G9SrhpRQvcc+wMddBqjIzoyapARWCQfA==,iv:qjsjxChwAGBcM/MuMrRdqKtcUC8bASs+FQSNsVNf9es=,tag:4tt7UQkdLcPUhErKWJKvRQ==,type:str]
8
+
S3PROXY_ENCRYPT_KEY: ENC[AES256_GCM,data:RWlJD5bJ1z6X9PyYVpTrARcI6CLLdWfDcDAXg1mq/V4cFL/8+18ooscbGiynbJ+5Nj6eCBenA0Dc3yIGYZVXm+293ZCMu7YNjVKyXDwJqXwwXexbboPR02/KAGHzVjweYseOgkCuskT9I+KXca/pVf3O+spL9kTZrzwUqv/jXWhEvxsaRLrAM3v8B5KQJWCc327LghLx/0okdHd9w26WKFHmbGbEDf1guD03Rg==,iv:KINK5Y3852TVNLzOuOqqntMlE3Au3Pjdq0TBFktsegY=,tag:DT/ANIJga7D7aqjVtrkdLA==,type:str]
9
+
S3PROXY_HOST: ENC[AES256_GCM,data:mwkePhCMXEv0rY3e3lUPNn+EmA==,iv:nJoFLsBQiWS5qxTF3vFI5nPbjAuXa7GDhOeiBiWv8Og=,tag:G5n4LqrZbfft2N8N36AJ4A==,type:str]
10
+
sops:
11
+
age:
12
+
- recipient: age13u6nqs8jgp268mya8rht9gyhu86cc53j74f5va65077rsrvkr9gsjeqk88
13
+
enc: |
14
+
-----BEGIN AGE ENCRYPTED FILE-----
15
+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqaGxDOGtyNkZZT0M3NmRU
16
+
dVdIakV2cHRydk9SOS9LcWZMM2VJNCtOQ1FZCjBCMDIwZ1kvWE5uUjdSQ1ZPVXdP
17
+
YlA5Z0hYcHkyS29UQ2MwbU1FRVZPR3cKLS0tIHYwTkx4aEJCQ3FNeGViTEwybUJY
18
+
S1Z2KytLTjVkeEc5alNPbmI4RGQ3TEUKxP0cG1293hBbBBug6HmDZfWI6/n/RR3D
19
+
8ksg4LmS3BIAEirND/wt2zyUc9/zOKr3Jr6oxeMitbHGG1a2cYvSOg==
20
+
-----END AGE ENCRYPTED FILE-----
21
+
- recipient: age16tv9zf54wf4txwjx39wz9phw7zggtxe7k0p2lkhtx59u4he72erq4d9xh9
22
+
enc: |
23
+
-----BEGIN AGE ENCRYPTED FILE-----
24
+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLeGhXREZjZ2lleVZteGlt
25
+
TnlHT1JIMG1mNVZOMTBBSE1yays0c1Jtd1JVClJta0ptVkhyMkY5NjVGVEZhTXBE
26
+
TUk1RWhpYS96SnZmMWp2NnNENnhoVm8KLS0tIGdmTjVpTmNkMHVET2UvaUVOSXdE
27
+
dHJCMDhJTlNLM1VYZ2RRUFR2TXZNZVEKHHCj6Bvx8vF8oCQPHe7HCaBpOZA6TH1u
28
+
UYEq9TP21bGlW1f5r9Itu4zIY4M+9d/zf015K57DZOgXrGULk36ypw==
29
+
-----END AGE ENCRYPTED FILE-----
30
+
lastmodified: "2026-02-13T00:37:28Z"
31
+
mac: ENC[AES256_GCM,data:js/kvf5CnKj1lKzqlVjMu7rQN1WgcaYvFc29yG4LoqNNwz9Rpe01xqRuv5YJu1MRSgJXSKquKXbeT9AczBhOOY1EDJoeGTHbOj5gTT5OK/njgKLRSh+XWmEkuaEjh8SY1BzqoLmKGGgNixvYaJTE+kRVbwfIILZQzYrFN9DFW04=,iv:I2xe9mwMTWQazhWt8Rr60VnYd/2cMSDKro0NQoJJ2sA=,tag:QdLFYybx0XOF5RMdx0nirw==,type:str]
32
+
encrypted_regex: ^(data|stringData)$
33
+
version: 3.11.0
34
+
---
1
35
apiVersion: v1
2
36
kind: Secret
3
37
metadata:
···
25
59
dHJCMDhJTlNLM1VYZ2RRUFR2TXZNZVEKHHCj6Bvx8vF8oCQPHe7HCaBpOZA6TH1u
26
60
UYEq9TP21bGlW1f5r9Itu4zIY4M+9d/zf015K57DZOgXrGULk36ypw==
27
61
-----END AGE ENCRYPTED FILE-----
28
-
lastmodified: "2025-09-28T16:10:21Z"
29
-
mac: ENC[AES256_GCM,data:0uqkT0ShhXB4DP4b32oAhNCP/n9N+LeISJ2N22H2i2vHiaMSiV0FowreTo75tcnz9IOJ6y0edIvywinO5DmbN6SN70HmmuEc8cVQic64jyedhKFpRGinXaGWBOjzfrZL2DBQOp+gAsJI/lHm9sAq/rXRlzgwMxOs/Um4h1rpx0g=,iv:DCl8RvLI/8KUqveJp5RXPXIj0fbjehpUHYhBN+2Wn3g=,tag:GhhHMAs48eC2A5kUFsn3ow==,type:str]
62
+
lastmodified: "2026-02-13T00:37:28Z"
63
+
mac: ENC[AES256_GCM,data:js/kvf5CnKj1lKzqlVjMu7rQN1WgcaYvFc29yG4LoqNNwz9Rpe01xqRuv5YJu1MRSgJXSKquKXbeT9AczBhOOY1EDJoeGTHbOj5gTT5OK/njgKLRSh+XWmEkuaEjh8SY1BzqoLmKGGgNixvYaJTE+kRVbwfIILZQzYrFN9DFW04=,iv:I2xe9mwMTWQazhWt8Rr60VnYd/2cMSDKro0NQoJJ2sA=,tag:QdLFYybx0XOF5RMdx0nirw==,type:str]
30
64
encrypted_regex: ^(data|stringData)$
31
-
version: 3.10.2
65
+
version: 3.11.0
-18
kubernetes/apps/storage/postgres/clusters/varia/backup.yaml
-18
kubernetes/apps/storage/postgres/clusters/varia/backup.yaml
···
1
-
apiVersion: barmancloud.cnpg.io/v1
2
-
kind: ObjectStore
3
-
metadata:
4
-
name: varia-backup-store
5
-
spec:
6
-
configuration:
7
-
destinationPath: s3://postgresql-backup/varia/
8
-
endpointURL: ${S3_HOST}
9
-
s3Credentials:
10
-
accessKeyId:
11
-
name: postgres-backup-secrets
12
-
key: S3_ACCESS_KEY
13
-
secretAccessKey:
14
-
name: postgres-backup-secrets
15
-
key: S3_SECRET_KEY
16
-
wal:
17
-
compression: bzip2
18
-
maxParallel: 8