mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby Husky
7990f1fa47
Foundation for a DR/backup path using an always-on VPS as a second ArgoCD-managed cluster, plus DB/backup standardization work that fell out of it: - vps-standby ArgoCD cluster destination + AppProject, MinIO backup receiver, VPS bootstrap script (k3s, Netbird, cert-manager) - Dual-site DNS failover watcher + home-IP DDNS CronJob, Cloudflare token moved out of git into Vault+ExternalSecret - Nextcloud migrated from ad-hoc MariaDB to CNPG + redis-operator (matches n8n/Authentik/GitLab's backup-native pattern) - Authentik's CNPG manifests moved into the actual ArgoCD-synced manifests/ path (were present but never wired into the sync path) - Vault raft-snapshot CronJob, CNPG barmanObjectStore backups (Authentik/n8n/Nextcloud), Nextcloud file-PVC restic sync - all targeting the new VPS MinIO receiver See VPS Warm-Standby plan doc for full design rationale.
56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
# MinIO on the VPS - shared backup-receiver bucket for the vps-standby site.
|
|
# Standalone mode: single node, single VPS disk, no erasure coding needed here -
|
|
# this is a backup *copy*, not itself something requiring HA.
|
|
#
|
|
# rootUser/rootPassword are intentionally left unset: the chart auto-generates
|
|
# a random root password and stores it in a Secret (minio/minio chart default
|
|
# behavior) rather than committing credentials to git. Retrieve after first
|
|
# deploy with:
|
|
# kubectl --context vps-standby -n minio get secret minio -o jsonpath='{.data.rootPassword}' | base64 -d
|
|
|
|
mode: standalone
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: local-path
|
|
size: 150Gi # budget out of the VPS's 360GB disk; leaves room for Phase 2 standby PVCs
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1Gi
|
|
|
|
# Buckets used by the backup/standby plumbing (Phase 1b / Phase 2). Created on
|
|
# first deploy; safe to append to as later phases land.
|
|
buckets:
|
|
- name: vault-raft-snapshots
|
|
policy: none
|
|
purge: false
|
|
- name: cnpg-backups
|
|
policy: none
|
|
purge: false
|
|
- name: nextcloud-files
|
|
policy: none
|
|
purge: false
|
|
|
|
# No ingress here - MinIO is reached over Netbird (while home is up) or from
|
|
# workloads inside the vps-standby cluster itself. It never needs to be public.
|
|
ingress:
|
|
enabled: false
|
|
|
|
# NodePort so home-cluster CronJobs (vault raft snapshots, CNPG barman backups,
|
|
# Nextcloud PVC sync) can reach this over the Netbird tunnel at
|
|
# <VPS_NETBIRD_IP>:30900 - single-node cluster, so NodePort is simplest here.
|
|
# Verify the exact key path against `helm show values minio/minio` for the
|
|
# deployed chart version (5.4.0) before applying - not confirmed live.
|
|
service:
|
|
type: NodePort
|
|
nodePort: 30900
|
|
|
|
metrics:
|
|
serviceMonitor:
|
|
enabled: false # no Prometheus on the VPS cluster (out of scope for this build)
|