feat: add backups namespace with Pelican PG backup CronJob and Longhorn recurring jobs

Reviewed-on: #113

deployments/backups/longhorn-recurring-jobs.yaml

@@ -0,0 +1,25 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: daily-snapshot
+  namespace: longhorn-system
+spec:
+  cron: "0 1 * * *"
+  task: snapshot
+  retain: 7
+  concurrency: 2
+  labels:
+    backup-tier: daily
+---
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: weekly-backup
+  namespace: longhorn-system
+spec:
+  cron: "0 3 * * 0"
+  task: backup
+  retain: 4
+  concurrency: 1
+  labels:
+    backup-tier: weekly

deployments/backups/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: backups
+  labels:
+    app.kubernetes.io/managed-by: argocd

deployments/backups/pelican-pg-backup-cronjob.yaml

@@ -0,0 +1,62 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: pelican-pg-backup
+  namespace: backups
+spec:
+  schedule: "0 2 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: OnFailure
+          containers:
+            - name: pg-dump
+              image: postgres:16-alpine
+              env:
+                - name: PGPASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: pelican-pg-backup-credentials
+                      key: password
+                - name: PGHOST
+                  value: postgresql.pelican.svc.cluster.local
+                - name: PGUSER
+                  valueFrom:
+                    secretKeyRef:
+                      name: pelican-pg-backup-credentials
+                      key: username
+                - name: PGDATABASE
+                  valueFrom:
+                    secretKeyRef:
+                      name: pelican-pg-backup-credentials
+                      key: database
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  set -e
+                  BACKUP_DIR=/backups/pelican
+                  mkdir -p "$BACKUP_DIR"
+                  FILENAME="$BACKUP_DIR/pelican-$(date +%Y%m%d-%H%M%S).sql.gz"
+                  pg_dump -h "$PGHOST" -U "$PGUSER" -d "$PGDATABASE" | gzip > "$FILENAME"
+                  echo "Backup written: $FILENAME"
+                  find "$BACKUP_DIR" -name '*.sql.gz' -mtime +7 -delete
+                  echo "Retention cleanup done (keeping 7 days)"
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 128Mi
+                limits:
+                  cpu: 500m
+                  memory: 512Mi
+              volumeMounts:
+                - name: backup-storage
+                  mountPath: /backups
+          volumes:
+            - name: backup-storage
+              persistentVolumeClaim:
+                claimName: backup-storage

deployments/backups/pelican-pg-externalsecret.yaml

@@ -0,0 +1,26 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: pelican-pg-backup-credentials
+  namespace: backups
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: pelican-pg-backup-credentials
+    creationPolicy: Owner
+  data:
+    - secretKey: username
+      remoteRef:
+        key: Talos Cluster/pelican/panel/db
+        property: DB_USER
+    - secretKey: password
+      remoteRef:
+        key: Talos Cluster/pelican/panel/db
+        property: DB_PASSWORD
+    - secretKey: database
+      remoteRef:
+        key: Talos Cluster/pelican/panel/db
+        property: DB_NAME

deployments/backups/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: backup-storage
+  namespace: backups
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 50Gi

deployments/media/transmission/deployment.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: transmission
-  namespace: media
+  namespace: apps
   labels:
     app: transmission
 spec:
@@ -10,76 +10,58 @@ spec:
   selector:
     matchLabels:
       app: transmission
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
         app: transmission
     spec:
       containers:
-        - name: gluetun
-          image: ghcr.io/qmcgaw/gluetun:v3.40.0
-          env:
-            - name: OPENVPN_PROVIDER
-              value: "PROTONVPN"
-            - name: OPENVPN_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: transmission-vpn-secret
-                  key: username
-            - name: OPENVPN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: transmission-vpn-secret
-                  key: password
-            - name: SERVER_COUNTRIES
-              value: "US"
-            - name: FIREWALL_ENABLED
-              value: "off"
-            - name: DOT_ENABLED
-              value: "true"
-          ports:
-            - name: http
-              containerPort: 8000
-          volumeMounts:
-            - name: config
-              mountPath: /config
         - name: transmission
           image: lscr.io/linuxserver/transmission:latest
+          ports:
+            - name: web
+              containerPort: 9091
+              protocol: TCP
+            - name: peer
+              containerPort: 51413
+              protocol: TCP
+            - name: peer-udp
+              containerPort: 51413
+              protocol: UDP
           env:
             - name: PUID
               value: "1000"
             - name: PGID
               value: "1000"
             - name: TZ
-              value: "America/New_York"
+              value: "Etc/UTC"
-            - name: USER
-              value: "admin"
-            - name: PASS
-              value: "admin"
             - name: TRANSMISSION_WEB_HOME
-              value: "/combui"
+              value: "/web/":"
-            - name: PEER_PORT
+          volumeMounts:
-              valueFrom:
+            - name: config
-                configMapKeyRef:
+              mountPath: /config
-                  name: transmission-config
+            - name: data
-                  key: peer-port
+              mountPath: /data
-          ports:
+        - name: gluetun
-            - name: http
+          image: qmcgaw/gluetun:latest
-              containerPort: 9091
+          env:
-            - name: peer
+            - name: VPN_SERVICE_PROVIDER
-              containerPort: 0
+              value: "protonvpn"
-              protocol: TCP
+            - name: VPN_TYPE
-            - name: peer-udp
+              value: "wireguard"
-              containerPort: 0
+          ports:
-              protocol: UDP
+            - name: https
+              containerPort: 443
+              protocol: TCP
           volumeMounts:
             - name: config
               mountPath: /config
-            - name: downloads
-              mountPath: /downloads
       volumes:
         - name: config
-          emptyDir: {}
-        - name: downloads
           persistentVolumeClaim:
-            claimName: media-data
+            claimName: transmission-config-claim
+        - name: data
+          persistentVolumeClaim:
+            claimName: transmission-data-claim