add ntfy to script

clusters/cl01tl/helm/vault/Chart.lock

@@ -8,8 +8,5 @@ dependencies:
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.5.0
-- name: app-template
+digest: sha256:01077322d1f106f1bb2834f2bc74f548084910af901a71e2892e05d3fb0d8c68
-  repository: https://bjw-s-labs.github.io/helm-charts/
+generated: "2025-12-19T22:52:58.599824-06:00"
-  version: 4.5.0
-digest: sha256:e8e25bec9d45503f18ed4bdcafe02465d53481d18705a54e069da67d0e33a403
-generated: "2025-12-19T22:15:41.082106-06:00"

clusters/cl01tl/helm/vault/Chart.yaml

@@ -29,9 +29,5 @@ dependencies:
     alias: unseal
     repository: https://bjw-s-labs.github.io/helm-charts/
     version: 4.5.0
-  - name: app-template
-    alias: temp
-    repository: https://bjw-s-labs.github.io/helm-charts/
-    version: 4.5.0
 icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/vault.png
 appVersion: 1.21.1

clusters/cl01tl/helm/vault/templates/config-map.yaml

@@ -65,8 +65,35 @@ data:
   backup.sh: |
     echo " ";
     echo ">> Running S3 backup for Vault snapshot";
-    if s3cmd sync --no-check-certificate -v /opt/backup "${BUCKET}/cl01tl/cl01tl-vault-snapshots/"; then
+    OUTPUT=$(s3cmd sync --no-check-certificate -v /opt/backup "${BUCKET}/cl01tl/cl01tl-vault-snapshots/" 2>&1)
-        echo ">> Sync succeeded"
+    STATUS=$?
+
+    echo " ";
+    if [ $STATUS -ne 0 ]; then
+        if echo "$OUTPUT" | grep -q "403 Forbidden"; then
+            MESSAGE="403 Authentication Error: Your keys are wrong or you don't have permission"
+        elif echo "$OUTPUT" | grep -q "404 Not Found"; then
+            MESSAGE="404 Error: The bucket or folder does not exist"
+        elif echo "$OUTPUT" | grep -q "Connection refused"; then
+            MESSAGE="Network Error: Cannot reach the S3 endpoint"
         else
-        echo ">> ERROR: Sync failed"
+            MESSAGE="Unknown Error: $OUTPUT"
+            echo ">> Unknown Error, output:"
+            echo " "
+            echo "$OUTPUT"
+            echo " "
+        fi
+
+        echo ">> Message: $MESSAGE"
+
+        echo ">> Sending to NTFY ..."
+        curl \
+            -H "Authorization: Bearer ${NTFY_TOKEN}" \
+            -H "X-Priority: 5" \
+            -H "X-Tags: warning" \
+            -H "X-Title: Vault Backup Failed for ${TARGET}" \
+            -d "$MESSAGE" \
+            ${NTFY_ENDPOINT}/${NTFY_TOPIC}
+    else
+        echo ">> S3 Sync succeeded"
     fi

clusters/cl01tl/helm/vault/templates/external-secret.yaml

@@ -117,6 +117,43 @@ spec:
         metadataPolicy: None
         property: BUCKET
 
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vault-backup-ntfy-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: vault-backup-ntfy-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: NTFY_TOKEN
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /ntfy/user/cl01tl
+        metadataPolicy: None
+        property: token
+    - secretKey: NTFY_ENDPOINT
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /ntfy/user/cl01tl
+        metadataPolicy: None
+        property: endpoint
+    - secretKey: NTFY_TOPIC
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/vault/snapshot
+        metadataPolicy: None
+        property: NTFY_TOPIC
+
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret

clusters/cl01tl/helm/vault/values.yaml

@@ -198,12 +198,17 @@ snapshot:
           args:
             - -ec
             - /scripts/backup.sh
+          envFrom:
+            - secretRef:
+                name: vault-backup-ntfy-secret
           env:
             - name: BUCKET
               valueFrom:
                 secretKeyRef:
                   name: vault-s3cmd-local-config
                   key: BUCKET
+            - name: TARGET
+              value: Local
         s3-backup-remote:
           image:
             repository: d3fk/s3cmd
@@ -214,12 +219,17 @@ snapshot:
           args:
             - -ec
             - /scripts/backup.sh
+          envFrom:
+            - secretRef:
+                name: vault-backup-ntfy-secret
           env:
             - name: BUCKET
               valueFrom:
                 secretKeyRef:
                   name: vault-s3cmd-remote-config
                   key: BUCKET
+            - name: TARGET
+              value: Remote
         s3-backup-external:
           image:
             repository: d3fk/s3cmd
@@ -230,12 +240,17 @@ snapshot:
           args:
             - -ec
             - /scripts/backup.sh
+          envFrom:
+            - secretRef:
+                name: vault-backup-ntfy-secret
           env:
             - name: BUCKET
               valueFrom:
                 secretKeyRef:
                   name: vault-s3cmd-external-config
                   key: BUCKET
+            - name: TARGET
+              value: External
   persistence:
     snapshot-script:
       enabled: true
@@ -370,37 +385,3 @@ unseal:
             requests:
               cpu: 10m
               memory: 24Mi
-temp:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      containers:
-        main:
-          image:
-            repository: ubuntu
-            tag: resolute-20251208
-            pullPolicy: IfNotPresent
-          command:
-            - "sleep"
-            - "infinity"
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-  persistence:
-    backup:
-      existingClaim: vault-storage-backup
-      advancedMounts:
-        main:
-          main:
-            - path: /opt/backup
-              readOnly: false
-    backup-old:
-      existingClaim: vault-nfs-storage-backup
-      advancedMounts:
-        main:
-          main:
-            - path: /opt/backup-old
-              readOnly: false