add vaultwarden daily backup CronJob to NFS

SQLite backup via Online Backup API + copy of RSA keys,
attachments, sends, and config. 30-day retention with rotation.
Pod affinity ensures co-scheduling with vaultwarden for RWO PVC access.

stacks/platform/modules/vaultwarden/main.tf

@@ -2,6 +2,7 @@ variable "tls_secret_name" {}
 variable "tier" { type = string }
 variable "smtp_password" {}
 variable "mail_host" { type = string }
+variable "nfs_server" { type = string }
 
 resource "kubernetes_namespace" "vaultwarden" {
   metadata {
@@ -193,3 +194,101 @@ module "ingress" {
     "gethomepage.dev/pod-selector" = ""
   }
 }
+
+# -----------------------------------------------------------------------------
+# Backup — Daily SQLite + data files to NFS
+# -----------------------------------------------------------------------------
+
+module "nfs_vaultwarden_backup" {
+  source     = "../../../../modules/kubernetes/nfs_volume"
+  name       = "vaultwarden-backup"
+  namespace  = kubernetes_namespace.vaultwarden.metadata[0].name
+  nfs_server = var.nfs_server
+  nfs_path   = "/mnt/main/vaultwarden-backup"
+}
+
+resource "kubernetes_cron_job_v1" "vaultwarden-backup" {
+  metadata {
+    name      = "vaultwarden-backup"
+    namespace = kubernetes_namespace.vaultwarden.metadata[0].name
+  }
+  spec {
+    concurrency_policy            = "Replace"
+    failed_jobs_history_limit     = 5
+    schedule                      = "0 0 * * *"
+    starting_deadline_seconds     = 10
+    successful_jobs_history_limit = 10
+    job_template {
+      metadata {}
+      spec {
+        backoff_limit              = 3
+        ttl_seconds_after_finished = 10
+        template {
+          metadata {}
+          spec {
+            affinity {
+              pod_affinity {
+                required_during_scheduling_ignored_during_execution {
+                  label_selector {
+                    match_labels = {
+                      app = "vaultwarden"
+                    }
+                  }
+                  topology_key = "kubernetes.io/hostname"
+                }
+              }
+            }
+            container {
+              name  = "vaultwarden-backup"
+              image = "alpine"
+              command = ["/bin/sh", "-c", <<-EOT
+                set -euxo pipefail
+                apk add --no-cache sqlite
+                now=$(date +"%Y_%m_%d_%H_%M")
+                mkdir -p /backup/$now
+                # Safe SQLite backup (handles WAL/locks)
+                sqlite3 /data/db.sqlite3 ".backup /backup/$now/db.sqlite3"
+                # Copy RSA keys, attachments, sends, config
+                cp -a /data/rsa_key.pem /data/rsa_key.pub.pem /backup/$now/ 2>/dev/null || true
+                cp -a /data/attachments /backup/$now/ 2>/dev/null || true
+                cp -a /data/sends /backup/$now/ 2>/dev/null || true
+                cp -a /data/config.json /backup/$now/ 2>/dev/null || true
+                # Rotate — 30 day retention
+                find /backup -maxdepth 1 -mindepth 1 -type d -mtime +30 -exec rm -rf {} +
+                echo "Backup complete: $now"
+              EOT
+              ]
+              volume_mount {
+                name       = "data"
+                mount_path = "/data"
+                read_only  = true
+              }
+              volume_mount {
+                name       = "backup"
+                mount_path = "/backup"
+              }
+            }
+            volume {
+              name = "data"
+              persistent_volume_claim {
+                claim_name = kubernetes_persistent_volume_claim.vaultwarden_data.metadata[0].name
+              }
+            }
+            volume {
+              name = "backup"
+              persistent_volume_claim {
+                claim_name = module.nfs_vaultwarden_backup.claim_name
+              }
+            }
+            dns_config {
+              option {
+                name  = "ndots"
+                value = "2"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}