alexlebens/infrastructure
1
0
Fork 0
Code Issues 1 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

add logging and secret

Browse Source
This commit is contained in:
Alex Lebens
2025-03-10 19:10:29 -05:00
parent e6b934a428
commit 7ed7fcccac
3 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
clusters/cl01tl/platform/gitea/templates/external-secret.yaml
View File

@@ -117,6 +117,13 @@ spec:
key: /digital-ocean/home-infra/gitea-backup key: /digital-ocean/home-infra/gitea-backup
metadataPolicy: None metadataPolicy: None
property: AWS_SECRET_ACCESS_KEY property: AWS_SECRET_ACCESS_KEY
- secretKey: S3_REPOSITORY
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /digital-ocean/home-infra/gitea-backup
metadataPolicy: None
property: S3_REPOSITORY
--- ---
apiVersion: external-secrets.io/v1beta1 apiVersion: external-secrets.io/v1beta1

10
clusters/cl01tl/platform/gitea/values.yaml
View File

@@ -150,8 +150,10 @@ backup:
args: args:
- -ec - -ec
- | - |
s3cmd put --no-check-md5 --no-check-certificate -v /opt/backup/gitea-backup.zip s3://gitea-backups-8ba8dae3674a2f53354c600e/cl01tl/cl01tl-gitea-backups/gitea-backup-$(date +"%Y%m%d-%H-%M").zip; echo ">> Running S3 backup for Gitea"
s3cmd put --no-check-md5 --no-check-certificate -v /opt/backup/gitea-backup.zip ${S3_REPOSITORY}/gitea-backup-$(date +"%Y%m%d-%H-%M").zip;
mv /opt/backup/gitea-backup.zip /opt/backup/gitea-backup-$(date +"%Y%m%d-%H-%M").zip; mv /opt/backup/gitea-backup.zip /opt/backup/gitea-backup-$(date +"%Y%m%d-%H-%M").zip;
echo ">> Completed S3 backup for Gitea"
envFrom: envFrom:
- secretRef: - secretRef:
name: gitea-backup-s3 name: gitea-backup-s3
@@ -170,12 +172,14 @@ backup:
- -ec - -ec
- | - |
export WEEK_AGO=$(date -d @$(( $(date +%s) - 604800 )) +%Y-%m-%d\ %H:%M:%S); export WEEK_AGO=$(date -d @$(( $(date +%s) - 604800 )) +%Y-%m-%d\ %H:%M:%S);
echo ">> Running S3 prune for Gitea backup repository"
s3cmd ls -v s3://gitea-backups-8ba8dae3674a2f53354c600e/cl01tl/cl01tl-gitea-backups/ | echo ">> Backups prior to '$WEEK_AGO' will be removed"
s3cmd ls -v $S3_REPOSITORY |
awk -v week_ago="$WEEK_AGO" '$1 < week_ago {print $4}' | awk -v week_ago="$WEEK_AGO" '$1 < week_ago {print $4}' |
while read file; while read file;
do s3cmd del -v "$file"; do s3cmd del -v "$file";
done; done;
echo ">> Completed S3 prune for Gitea backup repository"
envFrom: envFrom:
- secretRef: - secretRef:
name: gitea-backup-s3 name: gitea-backup-s3

8
clusters/cl01tl/platform/vault/values.yaml
View File

@@ -178,10 +178,12 @@ snapshot:
- -ec - -ec
- | - |
apk add --no-cache jq; apk add --no-cache jq;
echo ">> Running Vault snapshot"
export VAULT_TOKEN=$(vault write auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID -format=json | jq -r .auth.client_token); export VAULT_TOKEN=$(vault write auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID -format=json | jq -r .auth.client_token);
vault operator raft snapshot save /opt/backup/vault-snapshot-latest.snap; vault operator raft snapshot save /opt/backup/vault-snapshot-latest.snap;
cp /opt/backup/vault-snapshot-latest.snap /opt/backup/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap; cp /opt/backup/vault-snapshot-latest.snap /opt/backup/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap;
cp /opt/backup/vault-snapshot-latest.snap /opt/backup/vault-snapshot-s3.snap; cp /opt/backup/vault-snapshot-latest.snap /opt/backup/vault-snapshot-s3.snap;
echo ">> Completed Vault snapshot"
envFrom: envFrom:
- secretRef: - secretRef:
name: vault-snapshot-agent-token name: vault-snapshot-agent-token
@@ -203,8 +205,10 @@ snapshot:
args: args:
- -ec - -ec
- | - |
echo ">> Running S3 backup for Vault snapshot"
s3cmd put --no-check-md5 --no-check-certificate -v /opt/backup/vault-snapshot-s3.snap ${S3_REPOSITORY}/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap; s3cmd put --no-check-md5 --no-check-certificate -v /opt/backup/vault-snapshot-s3.snap ${S3_REPOSITORY}/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap;
rm -f /opt/backup/vault-snapshot-s3.snap; rm -f /opt/backup/vault-snapshot-s3.snap;
echo ">> Completed S3 backup for Vault snapshot"
envFrom: envFrom:
- secretRef: - secretRef:
name: vault-snapshot-s3 name: vault-snapshot-s3
@@ -223,12 +227,14 @@ snapshot:
- -ec - -ec
- | - |
export MONTH_AGO=$(date -d @$(( $(date +%s) - 2592000 )) +%Y-%m-%d\ %H:%M:%S); export MONTH_AGO=$(date -d @$(( $(date +%s) - 2592000 )) +%Y-%m-%d\ %H:%M:%S);
echo ">> Running S3 prune for Vault snapshot repository"
echo ">> Backups prior to '$MONTH_AGO' will be removed"
s3cmd ls -v $S3_REPOSITORY | s3cmd ls -v $S3_REPOSITORY |
awk -v month_ago="$MONTH_AGO" '$1 < month_ago {print $4}' | awk -v month_ago="$MONTH_AGO" '$1 < month_ago {print $4}' |
while read file; while read file;
do s3cmd del -v "$file"; do s3cmd del -v "$file";
done; done;
echo ">> Completed S3 prune for Vault snapshot repository"
envFrom: envFrom:
- secretRef: - secretRef:
name: vault-snapshot-s3 name: vault-snapshot-s3