Add borgmatic backups for authentik and immich databases #314

Merged

eblume merged 1 commit from feature/borgmatic-all-pg-backups into main

2026-03-27 16:59:59 -07:00

eblume commented

2026-03-27 16:53:34 -07:00

Owner

Summary

Add authentik database (blumeops-pg cluster) to borgmatic pg_dump backups
Add immich database (immich-pg cluster) to borgmatic pg_dump backups
For immich-pg: new borgmatic managed role with pg_read_all_data, ExternalSecret, Tailscale LoadBalancer service, and Caddy L4 TCP proxy on port 5433
Update backup docs to reflect all four CNPG databases + mealie SQLite

Deploy plan

Deploy order matters — k8s resources must exist before ansible can route to them:

ArgoCD (databases app): sync to pick up immich-pg borgmatic role, ExternalSecret, and Tailscale service
```
argocd app set blumeops-pg --revision feature/borgmatic-all-pg-backups
argocd app sync blumeops-pg
```
Wait for immich-pg-tailscale service to get a Tailscale IP and immich-pg.tail8d86e.ts.net to resolve
Ansible (caddy): deploy Caddy L4 route for port 5433
```
mise run provision-indri -- --tags caddy
```
Ansible (borgmatic): deploy updated config and .pgpass
```
mise run provision-indri -- --tags borgmatic
```
Verify: trigger a manual borgmatic run and check all four pg_dump streams succeed
```
borgmatic --verbosity 1 2>&1 | grep -E '(Dumping|ERROR)'
```

Test plan

kubectl kustomize builds cleanly
ansible --check --diff for borgmatic and caddy show expected changes
ArgoCD sync succeeds for databases app
immich-pg.tail8d86e.ts.net resolves
pg.ops.eblu.me:5433 accepts connections
borgmatic --verbosity 1 dumps all four databases without errors

## Summary - Add `authentik` database (blumeops-pg cluster) to borgmatic pg_dump backups - Add `immich` database (immich-pg cluster) to borgmatic pg_dump backups - For immich-pg: new borgmatic managed role with `pg_read_all_data`, ExternalSecret, Tailscale LoadBalancer service, and Caddy L4 TCP proxy on port 5433 - Update backup docs to reflect all four CNPG databases + mealie SQLite ## Deploy plan Deploy order matters — k8s resources must exist before ansible can route to them: 1. **ArgoCD (databases app):** sync to pick up immich-pg borgmatic role, ExternalSecret, and Tailscale service ``` argocd app set blumeops-pg --revision feature/borgmatic-all-pg-backups argocd app sync blumeops-pg ``` 2. **Wait** for `immich-pg-tailscale` service to get a Tailscale IP and `immich-pg.tail8d86e.ts.net` to resolve 3. **Ansible (caddy):** deploy Caddy L4 route for port 5433 ``` mise run provision-indri -- --tags caddy ``` 4. **Ansible (borgmatic):** deploy updated config and .pgpass ``` mise run provision-indri -- --tags borgmatic ``` 5. **Verify:** trigger a manual borgmatic run and check all four pg_dump streams succeed ``` borgmatic --verbosity 1 2>&1 | grep -E '(Dumping|ERROR)' ``` ## Test plan - [x] `kubectl kustomize` builds cleanly - [x] `ansible --check --diff` for borgmatic and caddy show expected changes - [ ] ArgoCD sync succeeds for databases app - [ ] `immich-pg.tail8d86e.ts.net` resolves - [ ] `pg.ops.eblu.me:5433` accepts connections - [ ] `borgmatic --verbosity 1` dumps all four databases without errors

eblume added 1 commit

2026-03-27 16:53:35 -07:00

Add borgmatic backups for authentik and immich databases 1b18748f51

Closes the gap where only miniflux and teslamate were backed up.
Authentik (blumeops-pg) just needed a config entry. Immich (immich-pg)
required a new borgmatic managed role, ExternalSecret, Tailscale
service, and Caddy L4 proxy on port 5433.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>