From c396092c8691515dbc6db351654f9a563d3d3a48 Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Fri, 15 May 2026 23:30:04 +0000 Subject: [PATCH] aiostreams: weekly NFS backup of decrypted user config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds aiostreams-config-backup CronJob (Sun 03:00 weekly): - Pulls /api/v1/user via internal ClusterIP with UUID + password from the existing aiostreams-probe-secrets ExternalSecret - Writes timestamped JSON to nfs-backup PVC mounted at /backup - 90-day retention, prunes older files - Pushgateway metrics: aiostreams_config_backup_{success,bytes,duration,last_run_timestamp} NFS path: 192.168.1.127:/srv/nfs/aiostreams-backup (auto-synced offsite to Synology via the existing offsite-sync-backup CronJob). Complements the daily postgresql-backup-per-db pipeline (which dumps the encrypted blob) by storing the decrypted JSON — usable for human inspection / disaster recovery even without the AIOStreams password. Verified: manual job wrote 12931 bytes, file present on NFS. --- stacks/servarr/aiostreams/main.tf | 125 ++++++++++++++++++++++++++++++ 1 file changed, 125 insertions(+) diff --git a/stacks/servarr/aiostreams/main.tf b/stacks/servarr/aiostreams/main.tf index a666c2b8..630bafd1 100644 --- a/stacks/servarr/aiostreams/main.tf +++ b/stacks/servarr/aiostreams/main.tf @@ -272,6 +272,131 @@ sys.exit(0 if success else 1) } } +module "nfs_backup" { + source = "../../../modules/kubernetes/nfs_volume" + name = "aiostreams-backup" + namespace = kubernetes_namespace.aiostreams.metadata[0].name + nfs_server = var.nfs_server + nfs_path = "/srv/nfs/aiostreams-backup" + storage = "1Gi" +} + +resource "kubernetes_cron_job_v1" "config_backup" { + metadata { + name = "aiostreams-config-backup" + namespace = kubernetes_namespace.aiostreams.metadata[0].name + } + spec { + schedule = "0 3 * * 0" # Sunday 03:00 weekly + concurrency_policy = "Forbid" + successful_jobs_history_limit = 3 + failed_jobs_history_limit = 3 + job_template { + metadata {} + spec { + backoff_limit = 2 + ttl_seconds_after_finished = 600 + template { + metadata {} + spec { + restart_policy = "Never" + container { + name = "backup" + image = "docker.io/library/python:3.12-alpine" + command = ["/bin/sh", "-c", <<-EOT + pip install --quiet --disable-pip-version-check requests && python3 -c ' +import requests, os, time, json, sys, datetime, glob + +BASE = "http://aiostreams.aiostreams.svc.cluster.local" +PUSHGATEWAY = "http://prometheus-prometheus-pushgateway.monitoring:9091/metrics/job/aiostreams-config-backup" +UUID = os.environ["AIOSTREAMS_UUID"] +PW = os.environ["AIOSTREAMS_PASSWORD"] +BACKUP_DIR = "/backup" +RETENTION_DAYS = 90 + +success = 0 +bytes_written = 0 +start = time.time() + +try: + r = requests.get(f"{BASE}/api/v1/user/", params={"uuid": UUID, "password": PW, "raw": "true"}, timeout=30) + r.raise_for_status() + data = r.json()["data"]["userData"] + if not data: + raise RuntimeError("empty userData from API") + + os.makedirs(BACKUP_DIR, exist_ok=True) + ts = datetime.datetime.utcnow().strftime("%Y-%m-%d_%H%M") + path = f"{BACKUP_DIR}/config-{ts}.json" + with open(path, "w") as f: + json.dump(data, f, indent=2, sort_keys=True) + bytes_written = os.path.getsize(path) + os.chmod(path, 0o600) + print(f"OK wrote {path} ({bytes_written} bytes)") + + # Prune backups older than RETENTION_DAYS + cutoff = time.time() - (RETENTION_DAYS * 86400) + pruned = 0 + for f in glob.glob(f"{BACKUP_DIR}/config-*.json"): + if os.path.getmtime(f) < cutoff: + os.unlink(f) + pruned += 1 + if pruned: + print(f"Pruned {pruned} old backups") + success = 1 +except Exception as e: + print(f"ERROR: {e}", file=sys.stderr) + +duration = time.time() - start +body = ( + "# TYPE aiostreams_config_backup_success gauge\n" + f"aiostreams_config_backup_success {success}\n" + "# TYPE aiostreams_config_backup_bytes gauge\n" + f"aiostreams_config_backup_bytes {bytes_written}\n" + "# TYPE aiostreams_config_backup_duration_seconds gauge\n" + f"aiostreams_config_backup_duration_seconds {duration:.3f}\n" + "# TYPE aiostreams_config_backup_last_run_timestamp gauge\n" + f"aiostreams_config_backup_last_run_timestamp {int(time.time())}\n" +) +try: + requests.post(PUSHGATEWAY, data=body, timeout=10).raise_for_status() +except Exception as e: + print(f"WARN: pushgateway POST failed: {e}", file=sys.stderr) + +sys.exit(0 if success else 1) +' + EOT + ] + env_from { + secret_ref { name = "aiostreams-probe-secrets" } + } + volume_mount { + name = "backup" + mount_path = "/backup" + } + resources { + requests = { memory = "64Mi", cpu = "10m" } + limits = { memory = "128Mi" } + } + } + volume { + name = "backup" + persistent_volume_claim { + claim_name = module.nfs_backup.claim_name + } + } + } + } + } + } + } + depends_on = [kubernetes_manifest.probe_secrets, kubernetes_deployment.aiostreams, module.nfs_backup] + lifecycle { + # KYVERNO_LIFECYCLE_V1: Kyverno admission webhook mutates dns_config with ndots=2 + ignore_changes = [spec[0].job_template[0].spec[0].template[0].spec[0].dns_config] + } +} + module "ingress" { source = "../../../modules/kubernetes/ingress_factory" # auth = "app": AIOStreams enforces its own UUID + password gate on /configure