blumeops/argocd/manifests
Erich Blume c78b86c72c Add offsite backup for immich photo library to BorgBase (#315)
## Summary

- Adds a second borgmatic config (`photos.yaml`) that backs up `/Volumes/photos` (sifaka SMB mount, ~128 GB) to a dedicated BorgBase repo (`immich-photos`), running daily at 4 AM
- Separate launchd agent (`mcquack.eblume.borgmatic-photos`) so photo backups run independently from the main backup
- Refactors `borgmatic_metrics` script to support multiple repos with a `repo` Prometheus label
- Updates Grafana "Borg Backups" dashboard with a `repo` template variable so you can filter/compare repos
- Docs updated: `backups.md`, `borgmatic.md`

## Prerequisites (manual)

- [x] Create `immich-photos` repo on BorgBase with same SSH key
- [ ] Upgrade BorgBase plan to Small ($24/yr) if currently on free tier (128 GB exceeds 10 GB limit)
- [ ] After deploy: `borg init` the new repo (borgmatic does this automatically on first run)

## Test plan

- [ ] Dry run: `mise run provision-indri -- --check --diff --tags borgmatic,borgmatic_metrics`
- [ ] Deploy borgmatic role and verify both configs deployed
- [ ] Run `borgmatic --config ~/.config/borgmatic/photos.yaml create --verbosity 1` manually for first backup (will take hours)
- [ ] Verify metrics script collects from both repos: `~/.local/bin/borgmatic-metrics && cat /opt/homebrew/var/node_exporter/textfile/borgmatic.prom`
- [ ] Sync grafana-config in ArgoCD and verify dashboard repo selector works

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #315
2026-03-27 19:43:05 -07:00
..
1password-connect Fix 1Password Connect credentials for chart 2.3.0 2026-02-13 17:30:45 -08:00
alloy-k8s Update container tags to fd0bebb (post-merge rebuild) 2026-03-24 13:39:26 -07:00
alloy-ringtail Deploy Tor Snowflake proxy on ringtail (#311) 2026-03-24 20:51:40 -07:00
alloy-tracing-ringtail Update container tags to fd0bebb (post-merge rebuild) 2026-03-24 13:39:26 -07:00
argocd Add ExternalSecret default fields to prevent ArgoCD drift 2026-03-05 09:11:23 -08:00
authentik Update container tags to fd0bebb (post-merge rebuild) 2026-03-24 13:39:26 -07:00
cloudnative-pg Port CloudNative-PG off Helm to direct release manifest (#268) 2026-02-25 17:37:53 -08:00
cv Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
databases Add borgmatic backups for authentik and immich databases (#314) 2026-03-27 16:59:58 -07:00
devpi Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
docs Update docs release to v1.15.0 2026-03-24 19:51:17 -07:00
external-secrets Upgrade External Secrets Operator v2.2.0 + migrate Helm to kustomize (#312) 2026-03-25 15:56:41 -07:00
forgejo-runner Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
frigate Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
grafana Reduce PodNotReady alert lookback from 5m to 60s 2026-03-26 19:48:37 -07:00
grafana-config Add offsite backup for immich photo library to BorgBase (#315) 2026-03-27 19:43:05 -07:00
homepage Deploy Homepage v1.11.0-e375859 2026-03-26 10:25:07 -07:00
immich Fix mirror org refs in ArgoCD apps and widen credential template (#266) 2026-02-25 06:55:53 -08:00
kiwix Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
kube-state-metrics Add :kustomized sentinel tag to manifest images, review devpi 2026-03-06 08:15:06 -08:00
kube-state-metrics-ringtail Add :kustomized sentinel tag to manifest images, review devpi 2026-03-06 08:15:06 -08:00
loki Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
mealie Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
miniflux Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
navidrome Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
ntfy Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
nvidia-device-plugin Upgrade nvidia-device-plugin v0.18.2 → v0.19.0 and add reference card 2026-03-27 07:19:24 -07:00
ollama Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
prometheus Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
prowler Include link to upstream prowler issue 2026-03-24 19:48:43 -07:00
tailscale-operator Expose Forgejo publicly at forge.eblu.me (#278) 2026-03-03 08:40:41 -08:00
tailscale-operator-base Revert Tailscale operator to v1.94.2 — images not yet published 2026-03-22 19:41:40 -07:00
tailscale-operator-ringtail Deploy Tailscale operator on ringtail k3s cluster (#215) 2026-02-19 09:33:05 -08:00
tempo Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
teslamate Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
torrent Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00
unpoller Add RuntimeDefault seccomp profiles to all managed workloads 2026-03-24 16:19:40 -07:00