Skip to content

Commit bb63fc0

Browse files
frzifusfrzifus
committed
apps: do daily enshrouded backups
Signed-off-by: Benedikt Bongartz <bongartz@klimlive.de>
1 parent 6504758 commit bb63fc0

File tree

6 files changed

+218
-0
lines changed

6 files changed

+218
-0
lines changed

‎clusters/homelab/apps/enshrouded/backup/backup-pod-config.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
apiVersion: k8up.io/v1
3+
kind: PodConfig
4+
metadata:
5+
name: enshrouded-backup-pod-config
6+
namespace: enshrouded
7+
spec:
8+
template:
9+
spec:
10+
affinity:
11+
podAffinity:
12+
requiredDuringSchedulingIgnoredDuringExecution:
13+
- labelSelector:
14+
matchLabels:
15+
app: enshrouded-server
16+
topologyKey: kubernetes.io/hostname
17+
securityContext:
18+
fsGroup: 10000
19+
runAsGroup: 10000
20+
runAsUser: 10000
21+
containers:
22+
- name: k8up
23+
securityContext:
24+
allowPrivilegeEscalation: false

‎clusters/homelab/apps/enshrouded/backup/backup-schedule.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
# Backup schedule for Enshrouded game server state
3+
apiVersion: k8up.io/v1
4+
kind: Schedule
5+
metadata:
6+
name: enshrouded-backup
7+
namespace: enshrouded
8+
spec:
9+
backend:
10+
repoPasswordSecretRef:
11+
name: enshrouded-backup-credentials
12+
key: RESTIC_PASSWORD
13+
s3:
14+
endpoint: https://s3.us-west-000.backblazeb2.com
15+
bucket: enshrouded-ff759ae6-7fe3-4ffc-a341-2770e6cd84ba
16+
accessKeyIDSecretRef:
17+
name: enshrouded-backup-credentials
18+
key: ACCESS_KEY_ID
19+
secretAccessKeySecretRef:
20+
name: enshrouded-backup-credentials
21+
key: SECRET_ACCESS_KEY
22+
backup:
23+
schedule: "0 4 * * *" # Daily at 4 AM
24+
failedJobsHistoryLimit: 2
25+
successfulJobsHistoryLimit: 3
26+
# Target specific PVCs by label
27+
labelSelectors:
28+
- matchExpressions:
29+
- key: k8up.io/backup
30+
operator: In
31+
values:
32+
- "true"
33+
# Follow enshrouded-server pod to same node (required for RWO volumes)
34+
podConfigRef:
35+
name: enshrouded-backup-pod-config
36+
check:
37+
schedule: "0 2 * * *" # Daily at 2 AM
38+
prune:
39+
schedule: "0 3 * * *" # Daily at 3 AM
40+
retention:
41+
keepLast: 7
42+
keepDaily: 7

‎clusters/homelab/apps/enshrouded/backup/backup-secret.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: enshrouded-backup-credentials
5+
namespace: enshrouded
6+
type: Opaque
7+
stringData:
8+
ACCESS_KEY_ID: ENC[AES256_GCM,data:/sIg0oO7oRuxqU4Yd3e2IG9DmoxvADQHbA==,iv:mFHQ3fkiT6PJHz3AGLZGngJyL3PW0q9llAYejZgm9vE=,tag:dR64dXfCAsHo7skT82etUQ==,type:str]
9+
SECRET_ACCESS_KEY: ENC[AES256_GCM,data:8b5oQnkqg6paYdzGYEH4SydsaMTRE2gsUEoixeIrww==,iv:zp+LP6NwD74i+pKvoFhFGOnuQTwkL6x6PmhcUreADws=,tag:8GNcjiQRdhdxxysDV5v5uQ==,type:str]
10+
RESTIC_PASSWORD: ENC[AES256_GCM,data:cwg3Kkvs0o7UtLf5SSnpeMPPMTboT7fKrSWfgraYBA==,iv:bZCPXm9u4ugPGEerCGbBo6tdIHWycokCaMDlQKJS0No=,tag:s05LKjQVDsNJfbC5G9z1ug==,type:str]
11+
sops:
12+
kms: []
13+
gcp_kms: []
14+
azure_kv: []
15+
hc_vault: []
16+
age:
17+
- recipient: age1nl4pnuny2pjg3ejfk9vrx0y4ssmna36xlw3wqmzv55ku38psdylsp2t2yw
18+
enc: |
19+
-----BEGIN AGE ENCRYPTED FILE-----
20+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvQTRpVXZmSlpyOUo3VlU4
21+
TjJkVVhhSXVReWh6ZlNxRmtjcHczdnAwMWlRClk5RmtiSTc4c3V5a0ZaZGEyQnRK
22+
dER2RENValphdGRNQjVxWFUwN2pGclUKLS0tIEZqOFEyaWdNWFJ6SUlScWFRdFJq
23+
OXIwSThWY0UxSW9BVWhhMis2dmNSVDgKQFLDM/z+0RRE0aCSV5CVuPuBD/irOq2e
24+
X/jPce0xQ3xAhC8uHdu0iYv5OEfQCy5cB/gKaWLc9En28YyPue5hgQ==
25+
-----END AGE ENCRYPTED FILE-----
26+
lastmodified: "2026-04-11T12:45:22Z"
27+
mac: ENC[AES256_GCM,data:d2/P21vjXi3CIhHP5LS8B8z84tso1ncF9nK/o/Lti9EB5XP1j5n4fo1pkgI7FQTlyDEszsOSwo9oD3M+TnsTxPfTEz9jQHzhM5ffU3Df++nAEyLS7c7bcLv122x14kqIoGOa3P7d23Urr5X/etn/8395qMkhXHV0oIrUF+YPPGA=,iv:wPr+6id5XvNlkjQH/obFtjyY4psFETt14LWcAdmDSwY=,tag:5QCmEn1QGhSs/aL8JFIiOA==,type:str]
28+
pgp: []
29+
encrypted_regex: ^(stringData)$
30+
version: 3.9.0

‎clusters/homelab/apps/enshrouded/backup/backup-test.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
apiVersion: k8up.io/v1
3+
kind: Backup
4+
metadata:
5+
name: enshrouded-backup-test
6+
namespace: enshrouded
7+
spec:
8+
backend:
9+
repoPasswordSecretRef:
10+
name: enshrouded-backup-credentials
11+
key: RESTIC_PASSWORD
12+
s3:
13+
endpoint: https://s3.us-west-000.backblazeb2.com
14+
bucket: enshrouded-ff759ae6-7fe3-4ffc-a341-2770e6cd84ba
15+
accessKeyIDSecretRef:
16+
name: enshrouded-backup-credentials
17+
key: ACCESS_KEY_ID
18+
secretAccessKeySecretRef:
19+
name: enshrouded-backup-credentials
20+
key: SECRET_ACCESS_KEY
21+
failedJobsHistoryLimit: 2
22+
successfulJobsHistoryLimit: 3
23+
# Target specific PVCs by label
24+
labelSelectors:
25+
- matchExpressions:
26+
- key: k8up.io/backup
27+
operator: In
28+
values:
29+
- "true"
30+
# Follow enshrouded-server pod to same node (required for RWO volumes)
31+
podConfigRef:
32+
name: enshrouded-backup-pod-config

‎clusters/homelab/apps/enshrouded/pvc.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@ apiVersion: v1
33
kind: PersistentVolumeClaim
44
metadata:
55
name: enshrouded-state
6+
namespace: enshrouded
7+
labels:
8+
k8up.io/backup: "true"
9+
app: enshrouded-server
610
spec:
711
accessModes:
812
- ReadWriteOnce

‎clusters/homelab/core/k8up.yaml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,89 @@ spec:
3333
crds: CreateReplace
3434
upgrade:
3535
crds: CreateReplace
36+
values:
37+
k8up:
38+
envVars:
39+
- name: BACKUP_PROMURL
40+
value: "http://pushgateway.k8up.svc.cluster.local:9091"
41+
- name: CLUSTER_NAME
42+
value: "homelab"
43+
---
44+
# Prometheus Push Gateway for K8up metrics across all namespaces
45+
apiVersion: apps/v1
46+
kind: Deployment
47+
metadata:
48+
name: pushgateway
49+
namespace: k8up
50+
labels:
51+
app: pushgateway
52+
spec:
53+
replicas: 1
54+
selector:
55+
matchLabels:
56+
app: pushgateway
57+
template:
58+
metadata:
59+
labels:
60+
app: pushgateway
61+
spec:
62+
securityContext:
63+
runAsNonRoot: true
64+
seccompProfile:
65+
type: RuntimeDefault
66+
containers:
67+
- name: pushgateway
68+
image: prom/pushgateway:v1.10.0
69+
args:
70+
- --web.listen-address=:9091
71+
- --web.telemetry-path=/metrics
72+
- --persistence.interval=5m
73+
ports:
74+
- containerPort: 9091
75+
name: http
76+
securityContext:
77+
allowPrivilegeEscalation: false
78+
capabilities:
79+
drop:
80+
- ALL
81+
readOnlyRootFilesystem: true
82+
runAsNonRoot: true
83+
resources:
84+
requests:
85+
cpu: 50m
86+
memory: 64Mi
87+
limits:
88+
cpu: 200m
89+
memory: 256Mi
90+
---
91+
apiVersion: v1
92+
kind: Service
93+
metadata:
94+
name: pushgateway
95+
namespace: k8up
96+
labels:
97+
app: pushgateway
98+
spec:
99+
selector:
100+
app: pushgateway
101+
ports:
102+
- name: http
103+
port: 9091
104+
targetPort: 9091
105+
type: ClusterIP
106+
---
107+
apiVersion: monitoring.coreos.com/v1
108+
kind: ServiceMonitor
109+
metadata:
110+
name: pushgateway
111+
namespace: k8up
112+
labels:
113+
app: pushgateway
114+
spec:
115+
selector:
116+
matchLabels:
117+
app: pushgateway
118+
endpoints:
119+
- port: http
120+
path: /metrics
121+
interval: 30s

0 commit comments

Comments
 (0)