redo

Author: mitchross

.gitignore

@@ -119,3 +119,7 @@ credentials.base64
 /my-apps/privacy/proxitok/source
 /my-apps/privacy/proxitok/docker/misc
 /my-apps/privacy/proxitok/docker
+
+# Reference implementations (not deployed)
+/home-ops/
+/reference/

docs/backup-restore.md

@@ -9,8 +9,7 @@ resources:
   - external-secrets.yaml  # Wave 0 - External Secrets CRDs (required by Longhorn)
   - longhorn-app.yaml      # Wave 1 - Storage foundation
   - snapshot-controller-app.yaml # Wave 1 - VolumeSnapshot controller + CRDs
-  - volsync-app.yaml       # Wave 1 - PVC backup and replication
-  - pvc-plumber-app.yaml   # Wave 2 - Backup existence checker (before Kyverno)
+  - volsync-app.yaml       # Wave 1 - PVC backup and replication (Kopia + NFS)
   # ApplicationSets for automatic discovery
   - infrastructure-appset.yaml  # Wave 4
   - monitoring-appset.yaml      # Wave 3

docs/notes/volsync-comparison-homeops.md

@@ -5,61 +5,17 @@ metadata:
   name: volsync-pvc-backup-restore
   annotations:
     argocd.argoproj.io/sync-wave: "4"
-    policies.kyverno.io/title: VolSync PVC Backup and Restore (Kopia)
+    policies.kyverno.io/title: VolSync PVC Backup and Restore (Kopia NFS)
     policies.kyverno.io/description: >-
       Automatically configures VolSync backup and restore for PVCs with the
-      label backup: "hourly" or backup: "daily". Uses Kopia for faster backups
-      with compression. Checks S3 for existing backup via pvc-plumber and
-      conditionally enables restore via VolumePopulator.
+      label backup: "hourly" or backup: "daily". Uses Kopia with NFS filesystem
+      backend for faster backups with compression. MutatingAdmissionPolicy injects
+      NFS mount into mover pods.
 spec:
   mutateExistingOnPolicyUpdate: false
   background: true
   rules:
-    # Rule 1: Conditionally add dataSourceRef if backup exists in S3
-    # IMPORTANT: Only trigger on CREATE to avoid race conditions during PVC deletion
-    - name: add-datasource-if-backup-exists
-      match:
-        any:
-          - resources:
-              kinds:
-                - PersistentVolumeClaim
-              operations:
-                - CREATE
-              selector:
-                matchExpressions:
-                  - key: backup
-                    operator: In
-                    values: ["hourly", "daily"]
-      exclude:
-        any:
-          - resources:
-              namespaces:
-                - kube-system
-                - volsync-system
-                - kyverno
-      context:
-        - name: backupCheck
-          apiCall:
-            method: GET
-            service:
-              url: "http://pvc-plumber.volsync-system.svc.cluster.local/exists/{{request.object.metadata.namespace}}/{{request.object.metadata.name}}"
-      preconditions:
-        all:
-          - key: "{{ backupCheck.exists || false }}"
-            operator: Equals
-            value: true
-          - key: "{{ request.object.spec.dataSourceRef || '' }}"
-            operator: Equals
-            value: ""
-      mutate:
-        patchStrategicMerge:
-          spec:
-            dataSourceRef:
-              apiGroup: volsync.backube
-              kind: ReplicationDestination
-              name: "{{request.object.metadata.name}}-restore"
-
-    # Rule 2: Generate ExternalSecret for per-PVC Kopia repository
+    # Rule 1: Generate ExternalSecret for Kopia repository credentials
     - name: generate-kopia-secret
       skipBackgroundRequests: false
       match:
@@ -106,28 +62,17 @@ spec:
                     app.kubernetes.io/managed-by: kyverno
                     volsync.backup/pvc: "{{request.object.metadata.name}}"
                 data:
-                  # Kopia S3 repository configuration
-                  # Full S3 URL with path: s3://bucket/namespace/pvc-name
-                  KOPIA_REPOSITORY: "s3://volsync-kopia/{{request.object.metadata.namespace}}/{{request.object.metadata.name}}"
-                  # S3 endpoint for non-AWS S3 (RustFS/MinIO)
-                  AWS_S3_ENDPOINT: "http://192.168.10.133:30292"
-                  # Disable TLS since endpoint is HTTP
-                  KOPIA_S3_DISABLE_TLS: "true"
+                  # Kopia NFS filesystem repository configuration
+                  # MutatingAdmissionPolicy injects NFS mount at /repository
+                  KOPIA_REPOSITORY: "filesystem:///repository"
+                  KOPIA_FS_PATH: "/repository"
             data:
-              - secretKey: AWS_ACCESS_KEY_ID
-                remoteRef:
-                  key: rustfs
-                  property: k8s-admin-access-key
-              - secretKey: AWS_SECRET_ACCESS_KEY
-                remoteRef:
-                  key: rustfs
-                  property: k8s-admin-secret-key
               - secretKey: KOPIA_PASSWORD
                 remoteRef:
                   key: rustfs
                   property: kopia_password
 
-    # Rule 3: Generate ReplicationSource (backup schedule)
+    # Rule 2: Generate ReplicationSource (backup schedule)
     - name: generate-replication-source
       skipBackgroundRequests: false
       match:
@@ -165,16 +110,13 @@ spec:
               schedule: "{{ request.object.metadata.labels.backup == 'hourly' && '0 * * * *' || '0 2 * * *' }}"
             kopia:
               repository: "volsync-{{request.object.metadata.name}}"
-              # Kopia-specific optimizations
               compression: zstd-fastest
               parallelism: 2
-              # Retention policy
               retain:
                 hourly: 24
                 daily: 7
                 weekly: 4
                 monthly: 2
-              # Snapshot-based backup via Longhorn
               copyMethod: Snapshot
               storageClassName: longhorn
               volumeSnapshotClassName: longhorn-snapclass
@@ -184,7 +126,7 @@ spec:
                 runAsGroup: 568
                 fsGroup: 568
 
-    # Rule 4: Generate ReplicationDestination (restore capability)
+    # Rule 3: Generate ReplicationDestination (restore capability)
     - name: generate-replication-destination
       skipBackgroundRequests: false
       match:
@@ -230,4 +172,4 @@ spec:
               moverSecurityContext:
                 runAsUser: 568
                 runAsGroup: 568
-                fsGroup: 568
+                fsGroup: 568