110 lines
3.9 KiB
YAML
110 lines
3.9 KiB
YAML
---
|
|
# Home Assistant configuration backup.
|
|
#
|
|
# This CronJob copies Home Assistant backup tarballs from the config PVC
|
|
# (/config/backups) to the Synology NAS over SSH (rsync), so you have an
|
|
# off-PVC copy of your configuration.
|
|
#
|
|
# Prerequisite 1 (in the Home Assistant UI):
|
|
# Enable automatic backups so tarballs land in /config/backups:
|
|
# Settings -> System -> Backups -> (menu) -> Schedule backups
|
|
# Recommended: daily backup, e.g. "Every day at 04:00", keep the last 7.
|
|
#
|
|
# Prerequisite 2 (manual, once - secrets are NOT committed to Git):
|
|
# Create the NAS SSH credentials secret in the cluster:
|
|
#
|
|
# kubectl create secret generic home-assistant-backup-nas \
|
|
# --from-literal=NAS_USER=<nas-ssh-user> \
|
|
# --from-literal=NAS_HOST=10.88.30.10 \
|
|
# --from-literal=NAS_PORT=22 \
|
|
# --from-literal=NAS_PATH='<shared-folder-path>/home-assistant-backups' \
|
|
# --from-file=ssh-privatekey=$HOME/.ssh/id_rsa_nas \
|
|
# -n home-assistant
|
|
#
|
|
# Also add the NAS to known_hosts (so rsync doesn't prompt):
|
|
#
|
|
# ssh-keyscan -p 22 -H 10.88.30.10 > /tmp/nas_known_hosts
|
|
# kubectl create configmap home-assistant-backup-known-hosts \
|
|
# --from-file=known_hosts=/tmp/nas_known_hosts \
|
|
# -n home-assistant
|
|
#
|
|
# The NAS_HOST above (10.88.30.10) matches the NAS IP used by the nas-proxy
|
|
# service in this repo. Adjust NAS_PATH/credentials to your Synology share.
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: home-assistant-backup
|
|
namespace: home-assistant
|
|
spec:
|
|
schedule: "30 4 * * *" # daily at 04:30 (after the HA 04:00 backup)
|
|
concurrencyPolicy: Forbid
|
|
successfulJobsHistoryLimit: 3
|
|
failedJobsHistoryLimit: 3
|
|
jobTemplate:
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
containers:
|
|
- name: backup
|
|
image: alpine:3.20
|
|
env:
|
|
- name: NAS_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: home-assistant-backup-nas
|
|
key: NAS_USER
|
|
- name: NAS_HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: home-assistant-backup-nas
|
|
key: NAS_HOST
|
|
- name: NAS_PORT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: home-assistant-backup-nas
|
|
key: NAS_PORT
|
|
- name: NAS_PATH
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: home-assistant-backup-nas
|
|
key: NAS_PATH
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -e
|
|
apk add --no-cache rsync openssh-client
|
|
mkdir -p ~/.ssh
|
|
cp /ssh-keys/ssh-privatekey ~/.ssh/id_rsa
|
|
chmod 600 ~/.ssh/id_rsa
|
|
cp /known-hosts/known_hosts ~/.ssh/known_hosts
|
|
chmod 644 ~/.ssh/known_hosts
|
|
echo "Syncing /config/backups -> ${NAS_USER}@${NAS_HOST}:${NAS_PATH}/"
|
|
rsync -a --delete -e "ssh -p ${NAS_PORT} -o StrictHostKeyChecking=yes" \
|
|
/config/backups/ "${NAS_USER}@${NAS_HOST}:${NAS_PATH}/"
|
|
echo "Backup sync complete."
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /config
|
|
readOnly: true
|
|
- name: ssh-keys
|
|
mountPath: /ssh-keys
|
|
readOnly: true
|
|
- name: known-hosts
|
|
mountPath: /known-hosts
|
|
readOnly: true
|
|
volumes:
|
|
- name: config
|
|
persistentVolumeClaim:
|
|
claimName: home-assistant-config
|
|
- name: ssh-keys
|
|
secret:
|
|
secretName: home-assistant-backup-nas
|
|
items:
|
|
- key: ssh-privatekey
|
|
path: ssh-privatekey
|
|
- name: known-hosts
|
|
configMap:
|
|
name: home-assistant-backup-known-hosts
|