# Backup diario de la BD del corpus con retención 7 (PLAN §Fase 6).
# pg_dump en formato custom (-Fc, comprimido) verificado con pg_restore --list.
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    # ArgoCD no debe podar este PVC: contiene los backups de la BD.
    argocd.argoproj.io/sync-options: Prune=false
  name: roswell-backups
  namespace: roswell
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 5Gi

---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: roswell-db-backup
  namespace: roswell
  labels:
    app: roswell
spec:
  schedule: "30 3 * * *"
  timeZone: "Europe/Madrid"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 900
      template:
        metadata:
          labels:
            app: roswell-db-backup
        spec:
          restartPolicy: Never
          containers:
            - name: backup
              # Misma imagen que el postgres del corpus: pg_dump 16 garantizado
              # y ya está en la caché del nodo.
              image: pgvector/pgvector:pg16
              env:
                - name: PGPASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: roswell-pg-secret
                      key: password
              command:
                - /bin/sh
                - -c
                - |
                  set -eu
                  STAMP=$(date +%Y%m%d)
                  DEST="/backups/roswell-${STAMP}.dump"
                  echo "pg_dump roswell -> ${DEST}"
                  pg_dump -h postgres.roswell.svc.cluster.local -U roswell \
                    -d roswell -Fc -f "${DEST}"
                  # Verificación: un dump corrupto no lista su TOC.
                  pg_restore --list "${DEST}" > /dev/null
                  echo "Dump verificado ($(du -h ${DEST} | cut -f1))"
                  # Retención: conservar los 7 más recientes
                  for f in $(ls -1t /backups/roswell-*.dump | tail -n +8); do
                    echo "Podando backup antiguo ${f}"
                    rm -f "${f}"
                  done
                  ls -lh /backups/
              volumeMounts:
                - name: backups
                  mountPath: /backups
          volumes:
            - name: backups
              persistentVolumeClaim:
                claimName: roswell-backups