Erich Blume
0a69a1d579
The shower dump hook referenced kubectl --context=k3s-ringtail, but indri's kubeconfig deliberately doesn't carry the ringtail credentials. Since PR #349 (2026-05-11), nightly borgmatic runs have failed at the before_backup hook, aborting both sifaka-borg-backups and borgbase-offsite. Rewrite the dump to ssh into ringtail and run k3s kubectl there. /etc/rancher/k3s/k3s.yaml on ringtail is mode 644, so no sudo is needed; the ssh user (eblume) reads it directly. Dump file is created in the pod via sqlite3.backup, copied to ringtail's host filesystem via k3s kubectl cp, then scp'd back to indri. Template gains a `ssh_host` field on dump entries — when set, uses the ssh path; when absent (as for mealie), uses local kubectl with the existing `context` field. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
121 lines
4.3 KiB
YAML
121 lines
4.3 KiB
YAML
---
|
|
borgmatic_config: /Users/erichblume/.config/borgmatic/config.yaml
|
|
borgmatic_config_dir: /Users/erichblume/.config/borgmatic
|
|
borgmatic_log_dir: /Users/erichblume/Library/Logs
|
|
|
|
# Full path to borg binary since LaunchAgent doesn't have homebrew in PATH
|
|
borgmatic_local_path: /opt/homebrew/bin/borg
|
|
|
|
# Borgmatic version — keep in sync with mise.toml in the repo root.
|
|
# Ansible installs this via `mise install` so indri doesn't need the repo cloned.
|
|
borgmatic_version: "2.1.4"
|
|
|
|
# Full path to borgmatic binary — called directly by LaunchAgents to avoid
|
|
# routing through mise, which triggers macOS TCC permission dialogs for
|
|
# protected folders (e.g. ~/Documents) that hang headless LaunchAgent sessions.
|
|
# Uses mise's "latest" symlink so version bumps don't break the LaunchAgent path.
|
|
borgmatic_bin: /Users/erichblume/.local/share/mise/installs/pipx-borgmatic/latest/bin/borgmatic
|
|
|
|
# Schedule: runs daily at 2:00 AM
|
|
borgmatic_schedule_hour: 2
|
|
borgmatic_schedule_minute: 0
|
|
|
|
# Source directories to back up
|
|
borgmatic_source_directories:
|
|
- /Users/erichblume/code/personal/zk
|
|
- /opt/homebrew/var/forgejo
|
|
- /Users/erichblume/.config/borgmatic
|
|
- /Users/erichblume/Documents
|
|
- /Users/erichblume/.local/share/borgmatic/k8s-dumps
|
|
# Shower app prize-photo uploads (sifaka SMB mount). Mounted manually
|
|
# on indri via Finder — see docs/how-to/operations/shower-app.md.
|
|
- /Volumes/shower
|
|
|
|
# Backup repositories
|
|
borgmatic_repositories:
|
|
- path: /Volumes/backups/borg/
|
|
label: sifaka-borg-backups
|
|
encryption: repokey
|
|
append_only: true
|
|
- path: ssh://u3ugi1x1@u3ugi1x1.repo.borgbase.com/./repo
|
|
label: borgbase-offsite
|
|
encryption: repokey
|
|
append_only: true
|
|
|
|
# BorgBase SSH key (fetched from 1Password in playbook pre_tasks)
|
|
borgmatic_borgbase_ssh_key_path: /Users/erichblume/.ssh/borgbase_ed25519
|
|
|
|
# Directory for pre-backup database dumps from k8s pods
|
|
borgmatic_k8s_dump_dir: /Users/erichblume/.local/share/borgmatic/k8s-dumps
|
|
|
|
# K8s SQLite databases to dump before backup via kubectl exec
|
|
# Each entry runs: kubectl exec <pod-selector> -- sqlite3 <path> ".backup /tmp/backup.db"
|
|
# then copies the dump to borgmatic_k8s_dump_dir/<name>.db
|
|
borgmatic_k8s_sqlite_dumps:
|
|
- name: mealie
|
|
namespace: mealie
|
|
label_selector: app=mealie
|
|
db_path: /app/data/mealie.db
|
|
# local kubectl, --context=minikube (indri's only configured ctx)
|
|
target: local:minikube
|
|
- name: shower
|
|
namespace: shower
|
|
label_selector: app=shower
|
|
db_path: /app/data/db.sqlite3
|
|
# ssh to ringtail and run k3s kubectl there — avoids needing a
|
|
# ringtail kubeconfig on indri. k3s.yaml on ringtail is
|
|
# world-readable (mode 644), so no sudo required.
|
|
target: ssh:eblume@ringtail
|
|
|
|
# Exclude patterns
|
|
borgmatic_exclude_patterns: []
|
|
|
|
# Encryption passcommand (reads borg passphrase)
|
|
borgmatic_encryption_passcommand: cat /Users/erichblume/.borg/config.yaml
|
|
|
|
# Retention policy
|
|
borgmatic_keep_daily: 7
|
|
borgmatic_keep_monthly: 12
|
|
borgmatic_keep_yearly: 1000
|
|
|
|
# PostgreSQL databases to backup (streamed via pg_dump)
|
|
# Password is read from ~/.pgpass (managed by this role)
|
|
# pg_dump_command must be full path since LaunchAgent doesn't have homebrew in PATH
|
|
# --- Immich photo library backup (BorgBase offsite only) ---
|
|
borgmatic_photos_config: /Users/erichblume/.config/borgmatic/photos.yaml
|
|
borgmatic_photos_source_directories:
|
|
- /Volumes/photos/library
|
|
- /Volumes/photos/upload
|
|
borgmatic_photos_borgbase_repo: ssh://xcrtl5tg@xcrtl5tg.repo.borgbase.com/./repo
|
|
# Schedule: runs daily at 4:00 AM (offset from main backup at 2:00 AM)
|
|
borgmatic_photos_schedule_hour: 4
|
|
borgmatic_photos_schedule_minute: 0
|
|
# Retention: photos are precious, keep more history
|
|
borgmatic_photos_keep_daily: 7
|
|
borgmatic_photos_keep_monthly: 12
|
|
borgmatic_photos_keep_yearly: 1000
|
|
|
|
borgmatic_pg_dump_command: /opt/homebrew/opt/postgresql@18/bin/pg_dump
|
|
borgmatic_postgresql_databases:
|
|
# k8s PostgreSQL (CloudNativePG) via Caddy L4 proxy
|
|
- name: miniflux
|
|
hostname: pg.ops.eblu.me
|
|
port: 5432
|
|
username: borgmatic
|
|
- name: teslamate
|
|
hostname: pg.ops.eblu.me
|
|
port: 5432
|
|
username: borgmatic
|
|
- name: authentik
|
|
hostname: pg.ops.eblu.me
|
|
port: 5432
|
|
username: borgmatic
|
|
- name: paperless
|
|
hostname: pg.ops.eblu.me
|
|
port: 5432
|
|
username: borgmatic
|
|
# immich-pg cluster (VectorChord) via Caddy L4 on port 5433
|
|
- name: immich
|
|
hostname: pg.ops.eblu.me
|
|
port: 5433
|
|
username: borgmatic
|