fix homeassistant configuration.yaml not being writable

homeassistant/backup-cronjob.yaml

@@ -0,0 +1,109 @@
+---
+# Home Assistant configuration backup.
+#
+# This CronJob copies Home Assistant backup tarballs from the config PVC
+# (/config/backups) to the Synology NAS over SSH (rsync), so you have an
+# off-PVC copy of your configuration.
+#
+# Prerequisite 1 (in the Home Assistant UI):
+#   Enable automatic backups so tarballs land in /config/backups:
+#     Settings -> System -> Backups -> (menu) -> Schedule backups
+#   Recommended: daily backup, e.g. "Every day at 04:00", keep the last 7.
+#
+# Prerequisite 2 (manual, once - secrets are NOT committed to Git):
+#   Create the NAS SSH credentials secret in the cluster:
+#
+#     kubectl create secret generic home-assistant-backup-nas \
+#       --from-literal=NAS_USER=<nas-ssh-user> \
+#       --from-literal=NAS_HOST=10.88.30.10 \
+#       --from-literal=NAS_PORT=22 \
+#       --from-literal=NAS_PATH='<shared-folder-path>/home-assistant-backups' \
+#       --from-file=ssh-privatekey=$HOME/.ssh/id_rsa_nas \
+#       -n home-assistant
+#
+#   Also add the NAS to known_hosts (so rsync doesn't prompt):
+#
+#     ssh-keyscan -p 22 -H 10.88.30.10 > /tmp/nas_known_hosts
+#     kubectl create configmap home-assistant-backup-known-hosts \
+#       --from-file=known_hosts=/tmp/nas_known_hosts \
+#       -n home-assistant
+#
+# The NAS_HOST above (10.88.30.10) matches the NAS IP used by the nas-proxy
+# service in this repo. Adjust NAS_PATH/credentials to your Synology share.
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: home-assistant-backup
+  namespace: home-assistant
+spec:
+  schedule: "30 4 * * *"        # daily at 04:30 (after the HA 04:00 backup)
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      template:
+        spec:
+          restartPolicy: OnFailure
+          containers:
+          - name: backup
+            image: alpine:3.20
+            env:
+            - name: NAS_USER
+              valueFrom:
+                secretKeyRef:
+                  name: home-assistant-backup-nas
+                  key: NAS_USER
+            - name: NAS_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: home-assistant-backup-nas
+                  key: NAS_HOST
+            - name: NAS_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: home-assistant-backup-nas
+                  key: NAS_PORT
+            - name: NAS_PATH
+              valueFrom:
+                secretKeyRef:
+                  name: home-assistant-backup-nas
+                  key: NAS_PATH
+            command: ["/bin/sh", "-c"]
+            args:
+              - |
+                set -e
+                apk add --no-cache rsync openssh-client
+                mkdir -p ~/.ssh
+                cp /ssh-keys/ssh-privatekey ~/.ssh/id_rsa
+                chmod 600 ~/.ssh/id_rsa
+                cp /known-hosts/known_hosts ~/.ssh/known_hosts
+                chmod 644 ~/.ssh/known_hosts
+                echo "Syncing /config/backups -> ${NAS_USER}@${NAS_HOST}:${NAS_PATH}/"
+                rsync -a --delete -e "ssh -p ${NAS_PORT} -o StrictHostKeyChecking=yes" \
+                  /config/backups/ "${NAS_USER}@${NAS_HOST}:${NAS_PATH}/"
+                echo "Backup sync complete."
+            volumeMounts:
+            - name: config
+              mountPath: /config
+              readOnly: true
+            - name: ssh-keys
+              mountPath: /ssh-keys
+              readOnly: true
+            - name: known-hosts
+              mountPath: /known-hosts
+              readOnly: true
+          volumes:
+          - name: config
+            persistentVolumeClaim:
+              claimName: home-assistant-config
+          - name: ssh-keys
+            secret:
+              secretName: home-assistant-backup-nas
+              items:
+              - key: ssh-privatekey
+                path: ssh-privatekey
+          - name: known-hosts
+            configMap:
+              name: home-assistant-backup-known-hosts