# Taegliche pg_dump-Sicherung der Modelcamp-Datenbank auf die Storage Box.
# Voraussetzung im Cluster: StorageClass smb-backup (SMB 3.1.1 mit seal),
# legt pro PVC einen Ordner unter Server/Backups/<namespace>/ an.
# Aufbewahrung: 14 Tage taeglich, 8 Wochen sonntags.
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: artista-db-backup
  namespace: artista
spec:
  accessModes: [ReadWriteMany]
  storageClassName: smb-backup
  resources:
    requests:
      storage: 10Gi
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: artista-db-backup
  namespace: artista
spec:
  schedule: "25 2 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 1
      activeDeadlineSeconds: 1800
      template:
        metadata:
          labels:
            app: artista-db-backup
            db-client: "true"
        spec:
          restartPolicy: Never
          automountServiceAccountToken: false
          securityContext:
            runAsUser: 70
            runAsGroup: 70
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: backup
              image: postgres:18.6-alpine
              command:
                - /bin/sh
                - -ec
                - |
                  stamp=$(date +%Y-%m-%d)
                  kind=daily; [ "$(date +%u)" = "7" ] && kind=weekly
                  mkdir -p /backups/daily /backups/weekly
                  pg_dump -h artista-modelcamp-postgres -Fc -f /backups/$kind/artista-$stamp.dump.tmp
                  mv /backups/$kind/artista-$stamp.dump.tmp /backups/$kind/artista-$stamp.dump
                  find /backups/daily -name '*.dump' -mtime +14 -delete
                  find /backups/weekly -name '*.dump' -mtime +56 -delete
                  ls -l /backups/$kind | tail -3
              env:
                - {name: PGUSER, value: artista}
                - {name: PGDATABASE, value: artista}
                - name: PGPASSWORD
                  valueFrom: {secretKeyRef: {name: artista-modelcamp-secrets, key: DB_PASSWORD}}
              resources:
                requests: {cpu: "0", memory: "0"}
                limits: {memory: 512Mi}
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities: {drop: [ALL]}
              volumeMounts:
                - {name: backups, mountPath: /backups}
          volumes:
            - name: backups
              persistentVolumeClaim: {claimName: artista-db-backup}