From a869a5a67f9134706744b26129d710361ab8aa7f Mon Sep 17 00:00:00 2001
From: Scooby Husky <garrettstone499@gmail.com>
Date: Mon, 17 Aug 2026 22:49:50 -0500
Subject: [PATCH] Add CNPG ScheduledBackup for authentik/n8n/nextcloud - WAL
 archiving alone isn't restorable

Found while building the VPS replica clusters (Phase 2): all three
CNPG clusters' backup.barmanObjectStore blocks only configure continuous
WAL archiving. CNPG's bootstrap.recovery needs at least one real Backup
object in the object store before it has anything to restore -
'no target backup found', confirmed live against pg-authentik. This gap
was systemic (gitlab has it too, not fixed here - out of scope for
tonight, no VPS standby depends on it).

immediate: true fires one backup right away in addition to the daily
01:00 schedule, to unblock the in-progress VPS restore now rather than
waiting up to 24h for the first scheduled run.
---
 apps/n8n/manifests/scheduled-backup.yaml      | 16 ++++++++++++
 .../nextcloud/manifests/scheduled-backup.yaml | 16 ++++++++++++
 .../authentik/manifests/scheduled-backup.yaml | 26 +++++++++++++++++++
 3 files changed, 58 insertions(+)
 create mode 100644 apps/n8n/manifests/scheduled-backup.yaml
 create mode 100644 apps/nextcloud/manifests/scheduled-backup.yaml
 create mode 100644 infrastructure/authentik/manifests/scheduled-backup.yaml

diff --git a/apps/n8n/manifests/scheduled-backup.yaml b/apps/n8n/manifests/scheduled-backup.yaml
new file mode 100644
index 0000000..65b6b7e
--- /dev/null
+++ b/apps/n8n/manifests/scheduled-backup.yaml
@@ -0,0 +1,16 @@
+---
+# Same gap/fix as infrastructure/authentik/manifests/scheduled-backup.yaml -
+# see that file for the full explanation. WAL-only barmanObjectStore
+# config has no restorable base backup without this.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-n8n-backup
+  namespace: n8n
+spec:
+  schedule: "0 1 * * *"
+  backupOwnerReference: self
+  immediate: true
+  method: barmanObjectStore
+  cluster:
+    name: pg-n8n
diff --git a/apps/nextcloud/manifests/scheduled-backup.yaml b/apps/nextcloud/manifests/scheduled-backup.yaml
new file mode 100644
index 0000000..5d0b41c
--- /dev/null
+++ b/apps/nextcloud/manifests/scheduled-backup.yaml
@@ -0,0 +1,16 @@
+---
+# Same gap/fix as infrastructure/authentik/manifests/scheduled-backup.yaml -
+# see that file for the full explanation. WAL-only barmanObjectStore
+# config has no restorable base backup without this.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-nextcloud-backup
+  namespace: nextcloud
+spec:
+  schedule: "0 1 * * *"
+  backupOwnerReference: self
+  immediate: true
+  method: barmanObjectStore
+  cluster:
+    name: pg-nextcloud
diff --git a/infrastructure/authentik/manifests/scheduled-backup.yaml b/infrastructure/authentik/manifests/scheduled-backup.yaml
new file mode 100644
index 0000000..e4c27a7
--- /dev/null
+++ b/infrastructure/authentik/manifests/scheduled-backup.yaml
@@ -0,0 +1,26 @@
+---
+# Found 2026-08-18 while building the VPS Authentik replica cluster: the
+# barmanObjectStore backup: block on cnpg-cluster.yaml only configures
+# continuous WAL archiving - it does NOT itself produce a restorable base
+# backup. CNPG's bootstrap.recovery (used by
+# infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml) needs
+# at least one actual Backup object to exist before it has anything to
+# restore ("no target backup found" otherwise, confirmed live). This gap
+# was systemic - n8n, nextcloud, and gitlab all had the same WAL-only
+# setup with no ScheduledBackup anywhere in the repo.
+#
+# immediate: true also fires one backup right away on creation, not just
+# on the schedule - needed to unblock the VPS restore immediately rather
+# than waiting up to 24h for the first scheduled run.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-authentik-backup
+  namespace: authentik
+spec:
+  schedule: "0 1 * * *"  # daily 01:00 - ahead of the VPS's other restore/replay jobs
+  backupOwnerReference: self
+  immediate: true
+  method: barmanObjectStore
+  cluster:
+    name: pg-authentik