feat(roswell): despliegue GitOps del corpus — bot+scheduler, backup pg_dump diario, postgres adoptado

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-13 16:29:19 +00:00
parent ad3716bf80
commit 6416c6c3af
5 changed files with 334 additions and 0 deletions
@@ -0,0 +1,78 @@
+# Backup diario de la BD del corpus con retención 7 (PLAN §Fase 6).
+# pg_dump en formato custom (-Fc, comprimido) verificado con pg_restore --list.
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  annotations:
+    # ArgoCD no debe podar este PVC: contiene los backups de la BD.
+    argocd.argoproj.io/sync-options: Prune=false
+  name: roswell-backups
+  namespace: roswell
+spec:
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 5Gi
+
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: roswell-db-backup
+  namespace: roswell
+  labels:
+    app: roswell
+spec:
+  schedule: "30 3 * * *"
+  timeZone: "Europe/Madrid"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      activeDeadlineSeconds: 900
+      template:
+        metadata:
+          labels:
+            app: roswell-db-backup
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: backup
+              # Misma imagen que el postgres del corpus: pg_dump 16 garantizado
+              # y ya está en la caché del nodo.
+              image: pgvector/pgvector:pg16
+              env:
+                - name: PGPASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: roswell-pg-secret
+                      key: password
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  set -eu
+                  STAMP=$(date +%Y%m%d)
+                  DEST="/backups/roswell-${STAMP}.dump"
+                  echo "pg_dump roswell -> ${DEST}"
+                  pg_dump -h postgres.roswell.svc.cluster.local -U roswell \
+                    -d roswell -Fc -f "${DEST}"
+                  # Verificación: un dump corrupto no lista su TOC.
+                  pg_restore --list "${DEST}" > /dev/null
+                  echo "Dump verificado ($(du -h ${DEST} | cut -f1))"
+                  # Retención: conservar los 7 más recientes
+                  for f in $(ls -1t /backups/roswell-*.dump | tail -n +8); do
+                    echo "Podando backup antiguo ${f}"
+                    rm -f "${f}"
+                  done
+                  ls -lh /backups/
+              volumeMounts:
+                - name: backups
+                  mountPath: /backups
+          volumes:
+            - name: backups
+              persistentVolumeClaim:
+                claimName: roswell-backups