Erich Blume
e0057b46e4
Prereq for the wave-1 decommission. The cutover moved paperless+teslamate (postgres) and mealie (SQLite) to ringtail, but borgmatic and the Grafana TeslaMate datasource still pointed at the minikube copies — the migrated live data was unbacked since cutover, and dropping the minikube DBs would break the TeslaMate dashboards. - Tailscale Service `blumeops-pg-ringtail` + Caddy L4 route `pg.ops.eblu.me:5434` - borgmatic: teslamate + paperless postgres → :5434; mealie SQLite → ssh:eblume@ringtail - Grafana TeslaMate datasource → pg.ops.eblu.me:5434 Deploy: sync databases-ringtail (tailscale svc) + grafana from branch; provision-indri --tags caddy,borgmatic; verify a backup run + dashboards. Unblocks the decommission PR. Reviewed-on: #364
123 lines
4.5 KiB
YAML
123 lines
4.5 KiB
YAML
---
|
|
borgmatic_config: /Users/erichblume/.config/borgmatic/config.yaml
|
|
borgmatic_config_dir: /Users/erichblume/.config/borgmatic
|
|
borgmatic_log_dir: /Users/erichblume/Library/Logs
|
|
|
|
# Full path to borg binary since LaunchAgent doesn't have homebrew in PATH
|
|
borgmatic_local_path: /opt/homebrew/bin/borg
|
|
|
|
# Borgmatic version — keep in sync with mise.toml in the repo root.
|
|
# Ansible installs this via `mise install` so indri doesn't need the repo cloned.
|
|
borgmatic_version: "2.1.4"
|
|
|
|
# Full path to borgmatic binary — called directly by LaunchAgents to avoid
|
|
# routing through mise, which triggers macOS TCC permission dialogs for
|
|
# protected folders (e.g. ~/Documents) that hang headless LaunchAgent sessions.
|
|
# Uses mise's "latest" symlink so version bumps don't break the LaunchAgent path.
|
|
borgmatic_bin: /Users/erichblume/.local/share/mise/installs/pipx-borgmatic/latest/bin/borgmatic
|
|
|
|
# Schedule: runs daily at 2:00 AM
|
|
borgmatic_schedule_hour: 2
|
|
borgmatic_schedule_minute: 0
|
|
|
|
# Source directories to back up
|
|
borgmatic_source_directories:
|
|
- /Users/erichblume/code/personal/zk
|
|
- /opt/homebrew/var/forgejo
|
|
- /Users/erichblume/.config/borgmatic
|
|
- /Users/erichblume/Documents
|
|
- /Users/erichblume/.local/share/borgmatic/k8s-dumps
|
|
# Shower app prize-photo uploads (sifaka SMB mount). Mounted manually
|
|
# on indri via Finder — see docs/how-to/operations/shower-app.md.
|
|
- /Volumes/shower
|
|
|
|
# Backup repositories
|
|
borgmatic_repositories:
|
|
- path: /Volumes/backups/borg/
|
|
label: sifaka-borg-backups
|
|
encryption: repokey
|
|
append_only: true
|
|
- path: ssh://u3ugi1x1@u3ugi1x1.repo.borgbase.com/./repo
|
|
label: borgbase-offsite
|
|
encryption: repokey
|
|
append_only: true
|
|
|
|
# BorgBase SSH key (fetched from 1Password in playbook pre_tasks)
|
|
borgmatic_borgbase_ssh_key_path: /Users/erichblume/.ssh/borgbase_ed25519
|
|
|
|
# Directory for pre-backup database dumps from k8s pods
|
|
borgmatic_k8s_dump_dir: /Users/erichblume/.local/share/borgmatic/k8s-dumps
|
|
|
|
# K8s SQLite databases to dump before backup via kubectl exec
|
|
# Each entry runs: kubectl exec <pod-selector> -- sqlite3 <path> ".backup /tmp/backup.db"
|
|
# then copies the dump to borgmatic_k8s_dump_dir/<name>.db
|
|
borgmatic_k8s_sqlite_dumps:
|
|
- name: mealie
|
|
namespace: mealie
|
|
label_selector: app=mealie
|
|
db_path: /app/data/mealie.db
|
|
# migrated to ringtail (wave-1); ssh to ringtail and run k3s kubectl
|
|
# there, same as shower below.
|
|
target: ssh:eblume@ringtail
|
|
- name: shower
|
|
namespace: shower
|
|
label_selector: app=shower
|
|
db_path: /app/data/db.sqlite3
|
|
# ssh to ringtail and run k3s kubectl there — avoids needing a
|
|
# ringtail kubeconfig on indri. k3s.yaml on ringtail is
|
|
# world-readable (mode 644), so no sudo required.
|
|
target: ssh:eblume@ringtail
|
|
|
|
# Exclude patterns
|
|
borgmatic_exclude_patterns: []
|
|
|
|
# Encryption passcommand (reads borg passphrase)
|
|
borgmatic_encryption_passcommand: cat /Users/erichblume/.borg/config.yaml
|
|
|
|
# Retention policy
|
|
borgmatic_keep_daily: 7
|
|
borgmatic_keep_monthly: 12
|
|
borgmatic_keep_yearly: 1000
|
|
|
|
# PostgreSQL databases to backup (streamed via pg_dump)
|
|
# Password is read from ~/.pgpass (managed by this role)
|
|
# pg_dump_command must be full path since LaunchAgent doesn't have homebrew in PATH
|
|
# --- Immich photo library backup (BorgBase offsite only) ---
|
|
borgmatic_photos_config: /Users/erichblume/.config/borgmatic/photos.yaml
|
|
borgmatic_photos_source_directories:
|
|
- /Volumes/photos/library
|
|
- /Volumes/photos/upload
|
|
borgmatic_photos_borgbase_repo: ssh://xcrtl5tg@xcrtl5tg.repo.borgbase.com/./repo
|
|
# Schedule: runs daily at 4:00 AM (offset from main backup at 2:00 AM)
|
|
borgmatic_photos_schedule_hour: 4
|
|
borgmatic_photos_schedule_minute: 0
|
|
# Retention: photos are precious, keep more history
|
|
borgmatic_photos_keep_daily: 7
|
|
borgmatic_photos_keep_monthly: 12
|
|
borgmatic_photos_keep_yearly: 1000
|
|
|
|
borgmatic_pg_dump_command: /opt/homebrew/opt/postgresql@18/bin/pg_dump
|
|
borgmatic_postgresql_databases:
|
|
# k8s PostgreSQL (CloudNativePG) via Caddy L4 proxy
|
|
- name: miniflux
|
|
hostname: pg.ops.eblu.me
|
|
port: 5432
|
|
username: borgmatic
|
|
- name: authentik
|
|
hostname: pg.ops.eblu.me
|
|
port: 5432
|
|
username: borgmatic
|
|
# migrated to ringtail blumeops-pg (wave-1); port 5434 = Caddy L4 route
|
|
- name: teslamate
|
|
hostname: pg.ops.eblu.me
|
|
port: 5434
|
|
username: borgmatic
|
|
- name: paperless
|
|
hostname: pg.ops.eblu.me
|
|
port: 5434
|
|
username: borgmatic
|
|
# immich-pg cluster (VectorChord) via Caddy L4 on port 5433
|
|
- name: immich
|
|
hostname: pg.ops.eblu.me
|
|
port: 5433
|
|
username: borgmatic
|