apiVersion: batch/v1
kind: CronJob
metadata:
  name: rclone-b2-backup
  namespace: backup-system
spec:
  # Segunda copia offsite (crown jewels → Backblaze B2), tras el sync a Mega
  schedule: "0 4 * * *"
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 2
  successfulJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 1
      activeDeadlineSeconds: 3600
      template:
        spec:
          nodeSelector:
            kubernetes.io/hostname: chemavx-k8
          restartPolicy: Never
          securityContext:
            runAsUser: 0
          containers:
            - name: rclone
              # OJO: imagen BusyBox — el script debe evitar GNU-ismos
              image: docker.io/rclone/rclone:1.74.3
              command: ["/bin/sh", "/scripts/b2-crown-jewels.sh"]
              resources:
                requests:
                  cpu: 100m
                  memory: 128Mi
                limits:
                  cpu: 500m
                  memory: 512Mi
              volumeMounts:
                - mountPath: /data/backups/backups
                  name: backup-dir
                  readOnly: true
                - mountPath: /rclone
                  name: rclone-conf
                - mountPath: /scripts
                  name: scripts
          volumes:
            - name: backup-dir
              hostPath:
                path: /data/backups/backups
                type: Directory
            # RCLONE_CONF (Infisical /backup-system) contiene mega+b2 desde 2026-07-15
            - name: rclone-conf
              secret:
                secretName: rclone-conf-infisical
                items:
                  - key: RCLONE_CONF
                    path: rclone.conf
            - name: scripts
              configMap:
                name: backup-scripts
                defaultMode: 0755