---
# Home Assistant configuration backup.
#
# This CronJob copies Home Assistant backup tarballs from the config PVC
# (/config/backups) to the Synology NAS over SSH (rsync), so you have an
# off-PVC copy of your configuration.
#
# Prerequisite 1 (in the Home Assistant UI):
#   Enable automatic backups so tarballs land in /config/backups:
#     Settings -> System -> Backups -> (menu) -> Schedule backups
#   Recommended: daily backup, e.g. "Every day at 04:00", keep the last 7.
#
# Prerequisite 2 (manual, once - secrets are NOT committed to Git):
#   Create the NAS SSH credentials secret in the cluster:
#
#     kubectl create secret generic home-assistant-backup-nas \
#       --from-literal=NAS_USER=<nas-ssh-user> \
#       --from-literal=NAS_HOST=10.88.30.10 \
#       --from-literal=NAS_PORT=22 \
#       --from-literal=NAS_PATH='<shared-folder-path>/home-assistant-backups' \
#       --from-file=ssh-privatekey=$HOME/.ssh/id_rsa_nas \
#       -n home-assistant
#
#   Also add the NAS to known_hosts (so rsync doesn't prompt):
#
#     ssh-keyscan -p 22 -H 10.88.30.10 > /tmp/nas_known_hosts
#     kubectl create configmap home-assistant-backup-known-hosts \
#       --from-file=known_hosts=/tmp/nas_known_hosts \
#       -n home-assistant
#
# The NAS_HOST above (10.88.30.10) matches the NAS IP used by the nas-proxy
# service in this repo. Adjust NAS_PATH/credentials to your Synology share.
apiVersion: batch/v1
kind: CronJob
metadata:
  name: home-assistant-backup
  namespace: home-assistant
spec:
  schedule: "30 4 * * *"        # daily at 04:30 (after the HA 04:00 backup)
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          restartPolicy: OnFailure
          containers:
          - name: backup
            image: alpine:3.20
            env:
            - name: NAS_USER
              valueFrom:
                secretKeyRef:
                  name: home-assistant-backup-nas
                  key: NAS_USER
            - name: NAS_HOST
              valueFrom:
                secretKeyRef:
                  name: home-assistant-backup-nas
                  key: NAS_HOST
            - name: NAS_PORT
              valueFrom:
                secretKeyRef:
                  name: home-assistant-backup-nas
                  key: NAS_PORT
            - name: NAS_PATH
              valueFrom:
                secretKeyRef:
                  name: home-assistant-backup-nas
                  key: NAS_PATH
            command: ["/bin/sh", "-c"]
            args:
              - |
                set -e
                apk add --no-cache rsync openssh-client
                mkdir -p ~/.ssh
                cp /ssh-keys/ssh-privatekey ~/.ssh/id_rsa
                chmod 600 ~/.ssh/id_rsa
                cp /known-hosts/known_hosts ~/.ssh/known_hosts
                chmod 644 ~/.ssh/known_hosts
                echo "Syncing /config/backups -> ${NAS_USER}@${NAS_HOST}:${NAS_PATH}/"
                rsync -a --delete -e "ssh -p ${NAS_PORT} -o StrictHostKeyChecking=yes" \
                  /config/backups/ "${NAS_USER}@${NAS_HOST}:${NAS_PATH}/"
                echo "Backup sync complete."
            volumeMounts:
            - name: config
              mountPath: /config
              readOnly: true
            - name: ssh-keys
              mountPath: /ssh-keys
              readOnly: true
            - name: known-hosts
              mountPath: /known-hosts
              readOnly: true
          volumes:
          - name: config
            persistentVolumeClaim:
              claimName: home-assistant-config
          - name: ssh-keys
            secret:
              secretName: home-assistant-backup-nas
              items:
              - key: ssh-privatekey
                path: ssh-privatekey
          - name: known-hosts
            configMap:
              name: home-assistant-backup-known-hosts