chemavxandClaude Fable 5
c364d46ac6
- b2-crown-jewels.sh: sync diario 04:00 de las 2 copias mas recientes de cada servicio irremplazable (todo menos uptime-kuma) a b2:chemavx-k3s-backups/crown-jewels/ (~2GB, tier gratuito). - reddit-intel.sh sube tambien a B2 (retencion 3d). - verify.sh comprueba Mega (completo) + B2 (crown jewels). - Config via Secret out-of-band rclone-conf-b2 (mega+b2, kubectl, NO git); consolidar en Infisical RCLONE_CONF cuando se anada [b2] por UI (la identity del operator es read-only por API). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
63 lines
2.1 KiB
YAML
63 lines
2.1 KiB
YAML
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: rclone-b2-backup
|
|
namespace: backup-system
|
|
spec:
|
|
# Segunda copia offsite (crown jewels → Backblaze B2), tras el sync a Mega
|
|
schedule: "0 4 * * *"
|
|
concurrencyPolicy: Forbid
|
|
failedJobsHistoryLimit: 2
|
|
successfulJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 1
|
|
activeDeadlineSeconds: 3600
|
|
template:
|
|
spec:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: chemavx-k8
|
|
restartPolicy: Never
|
|
securityContext:
|
|
runAsUser: 0
|
|
containers:
|
|
- name: rclone
|
|
# OJO: imagen BusyBox — el script debe evitar GNU-ismos
|
|
image: docker.io/rclone/rclone:1.74.3
|
|
command: ["/bin/sh", "/scripts/b2-crown-jewels.sh"]
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- mountPath: /data/backups/backups
|
|
name: backup-dir
|
|
readOnly: true
|
|
- mountPath: /rclone
|
|
name: rclone-conf
|
|
- mountPath: /scripts
|
|
name: scripts
|
|
volumes:
|
|
- name: backup-dir
|
|
hostPath:
|
|
path: /data/backups/backups
|
|
type: Directory
|
|
# Secret OUT-OF-BAND (kubectl, no en git): remotes mega + b2.
|
|
# Fuente de verdad deseada: Infisical /backup-system RCLONE_CONF —
|
|
# cuando se añada el bloque [b2] en la UI, volver a rclone-conf-infisical
|
|
# y borrar este secret (la identity del operator es read-only, no pudo
|
|
# escribirse por API el 2026-07-15).
|
|
- name: rclone-conf
|
|
secret:
|
|
secretName: rclone-conf-b2
|
|
items:
|
|
- key: RCLONE_CONF
|
|
path: rclone.conf
|
|
- name: scripts
|
|
configMap:
|
|
name: backup-scripts
|
|
defaultMode: 0755
|