initial migration

infrastructure/backup/overlays/applying.md

@@ -0,0 +1,8 @@
+```
+k kustomize backup/overlays/backup | k apply -f -
+> secret/restic-credentials-backup created
+> cronjob.batch/restic-backblaze-backup created
+k kustomize backup/overlays/prune | k apply -f -
+> secret/restic-credentials-prune created
+> cronjob.batch/restic-backblaze-prune created
+```

infrastructure/backup/overlays/backup/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# namespace: backup
+nameSuffix: -backup
+resources:
+  - ../../base
+  # - ./restic-commands.yaml
+
+
+# patch the cronjob args field:
+patches:
+  - path: ./restic-commands.yaml
+    target:
+      kind: CronJob
+      

infrastructure/backup/overlays/backup/restic-commands.yaml

@@ -0,0 +1,25 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: backup-patch
+spec:
+  schedule: "0 2 * * *"
+  # at 2:00, every day
+
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: restic-base-container
+            args:
+            # >- strips newlines
+            # -r $(RESTIC_REPOSITORY) not needed, bc set as env var
+              - >-
+                  restic backup
+                  --verbose=2
+                  /data
+                  --exclude=s3/
+                  &&
+                  restic
+                  list snapshots

infrastructure/backup/overlays/prune/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# namespace: backup
+nameSuffix: -prune
+resources:
+  - ../../base
+  # - ./restic-commands.yaml
+
+
+# patch the cronjob args field:
+patches:
+  - path: ./restic-commands.yaml
+    target:
+      kind: CronJob

infrastructure/backup/overlays/prune/restic-commands.yaml

@@ -0,0 +1,24 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: prune-patch
+spec:
+  schedule: "0 0 1/15 * *"
+  # at midnight, the first and 15. of every month
+  
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: restic-base-container
+            args:
+            # >- strips newlines
+            # RESTIC_ARGS Can be for instance: --verbose --dry-run
+            # RESTIC_REPOSITORY is set in the secret
+              - >-
+                  restic forget
+                  -r $(RESTIC_REPOSITORY)
+                  --verbose=2
+                  --keep-daily 7 --keep-weekly 5
+                  --prune