93 lines
2.9 KiB
YAML
93 lines
2.9 KiB
YAML
|
---
|
||
|
|
# OpenCloud Backup CronJob
|
||
|
|
# Backs up Nextcloud data and database daily to Hetzner S3 bucket
|
||
|
|
apiVersion: batch/v1
|
||
|
|
kind: CronJob
|
||
|
|
metadata:
|
||
|
|
name: opencloud-backup
|
||
|
|
namespace: opencloud
|
||
|
|
spec:
|
||
|
|
# Run daily at 2 AM
|
||
|
|
schedule: "0 2 * * *"
|
||
|
|
successfulJobsHistoryLimit: 3
|
||
|
|
failedJobsHistoryLimit: 3
|
||
|
|
concurrencyPolicy: Forbid
|
||
|
|
jobTemplate:
|
||
|
|
spec:
|
||
|
|
template:
|
||
|
|
spec:
|
||
|
|
restartPolicy: OnFailure
|
||
|
|
containers:
|
||
|
|
- name: backup
|
||
|
|
image: ghcr.io/restic/restic:latest
|
||
|
|
env:
|
||
|
|
- name: RESTIC_REPOSITORY
|
||
|
|
value: "s3:https://fsn1.your-objectstorage.com/basicstack-backups/opencloud"
|
||
|
|
- name: RESTIC_PASSWORD
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef:
|
||
|
|
name: opencloud-backup-secret
|
||
|
|
key: restic-password
|
||
|
|
- name: AWS_ACCESS_KEY_ID
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef:
|
||
|
|
name: opencloud-backup-secret
|
||
|
|
key: access-key
|
||
|
|
- name: AWS_SECRET_ACCESS_KEY
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef:
|
||
|
|
name: opencloud-backup-secret
|
||
|
|
key: secret-key
|
||
|
|
- name: BACKUP_DATE
|
||
|
|
value: "$(date +%Y%m%d-%H%M%S)"
|
||
|
|
command:
|
||
|
|
- /bin/sh
|
||
|
|
- -c
|
||
|
|
- |
|
||
|
|
set -e
|
||
|
|
|
||
|
|
# Initialize repository if it doesn't exist
|
||
|
|
restic snapshots || restic init
|
||
|
|
|
||
|
|
# Backup PostgreSQL database
|
||
|
|
echo "Backing up PostgreSQL database..."
|
||
|
|
pg_dump -h postgres -U nextcloud nextcloud > /tmp/nextcloud-db-backup.sql
|
||
|
|
|
||
|
|
# Backup Nextcloud data
|
||
|
|
echo "Backing up Nextcloud data..."
|
||
|
|
restic backup /var/www/html /tmp/nextcloud-db-backup.sql \
|
||
|
|
--tag opencloud \
|
||
|
|
--tag daily \
|
||
|
|
--host opencloud.basicstack.de
|
||
|
|
|
||
|
|
# Clean up old backups (keep last 30 days, 12 months, 5 years)
|
||
|
|
echo "Pruning old backups..."
|
||
|
|
restic forget \
|
||
|
|
--keep-daily 30 \
|
||
|
|
--keep-monthly 12 \
|
||
|
|
--keep-yearly 5 \
|
||
|
|
--prune
|
||
|
|
|
||
|
|
# Check repository integrity (once a week)
|
||
|
|
if [ $(date +%u) -eq 1 ]; then
|
||
|
|
echo "Running weekly repository check..."
|
||
|
|
restic check
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "Backup completed successfully"
|
||
|
|
volumeMounts:
|
||
|
|
- name: nextcloud-data
|
||
|
|
mountPath: /var/www/html
|
||
|
|
readOnly: true
|
||
|
|
- name: pg-password
|
||
|
|
mountPath: /run/secrets/pg-password
|
||
|
|
subPath: postgres-password
|
||
|
|
readOnly: true
|
||
|
|
volumes:
|
||
|
|
- name: nextcloud-data
|
||
|
|
persistentVolumeClaim:
|
||
|
|
claimName: nextcloud-data
|
||
|
|
- name: pg-password
|
||
|
|
secret:
|
||
|
|
secretName: opencloud-db-secret
|