Erich Blume
ca0c9354ee
## Summary - Add `authentik` database (blumeops-pg cluster) to borgmatic pg_dump backups - Add `immich` database (immich-pg cluster) to borgmatic pg_dump backups - For immich-pg: new borgmatic managed role with `pg_read_all_data`, ExternalSecret, Tailscale LoadBalancer service, and Caddy L4 TCP proxy on port 5433 - Update backup docs to reflect all four CNPG databases + mealie SQLite ## Deploy plan Deploy order matters — k8s resources must exist before ansible can route to them: 1. **ArgoCD (databases app):** sync to pick up immich-pg borgmatic role, ExternalSecret, and Tailscale service ``` argocd app set blumeops-pg --revision feature/borgmatic-all-pg-backups argocd app sync blumeops-pg ``` 2. **Wait** for `immich-pg-tailscale` service to get a Tailscale IP and `immich-pg.tail8d86e.ts.net` to resolve 3. **Ansible (caddy):** deploy Caddy L4 route for port 5433 ``` mise run provision-indri -- --tags caddy ``` 4. **Ansible (borgmatic):** deploy updated config and .pgpass ``` mise run provision-indri -- --tags borgmatic ``` 5. **Verify:** trigger a manual borgmatic run and check all four pg_dump streams succeed ``` borgmatic --verbosity 1 2>&1 | grep -E '(Dumping|ERROR)' ``` ## Test plan - [x] `kubectl kustomize` builds cleanly - [x] `ansible --check --diff` for borgmatic and caddy show expected changes - [ ] ArgoCD sync succeeds for databases app - [ ] `immich-pg.tail8d86e.ts.net` resolves - [ ] `pg.ops.eblu.me:5433` accepts connections - [ ] `borgmatic --verbosity 1` dumps all four databases without errors Reviewed-on: #314
22 lines
581 B
YAML
22 lines
581 B
YAML
# Tailscale LoadBalancer for immich-pg PostgreSQL access
|
|
# Canonical hostname: immich-pg.tail8d86e.ts.net
|
|
# Caddy L4 proxies pg.ops.eblu.me:5433 → this service for borgmatic backups
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: immich-pg-tailscale
|
|
namespace: databases
|
|
annotations:
|
|
tailscale.com/hostname: "immich-pg"
|
|
tailscale.com/proxy-class: "default"
|
|
spec:
|
|
type: LoadBalancer
|
|
loadBalancerClass: tailscale
|
|
selector:
|
|
cnpg.io/cluster: immich-pg
|
|
role: primary
|
|
ports:
|
|
- name: postgresql
|
|
port: 5432
|
|
targetPort: 5432
|
|
protocol: TCP
|