add backup image

.github/workflows/main.yml

@@ -55,12 +55,12 @@ jobs:
 
       - name: Install dependencies
         run: pnpm install
-        working-directory: operator
+        working-directory: images/operator
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Run tests
-        working-directory: operator
+        working-directory: images/operator
         run: pnpm test
 
   update-release-draft:

.github/workflows/publish-backup-tag.yml

@@ -0,0 +1,65 @@
+name: Publish tag
+
+on:
+  push:
+    branches:
+      - "main"
+    tags:
+      - "v*"
+
+env:
+  environment: test
+  release_channel: latest
+  DO_NOT_TRACK: "1"
+  NODE_VERSION: "23.x"
+  DOCKER_REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}-backup
+  PNPM_VERSION: 10.6.0
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  release:
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      pages: write
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: ./images/backup
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

.github/workflows/publish-tag.yml

@@ -52,7 +52,7 @@ jobs:
         id: push
         uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
         with:
-          context: ./operator
+          context: ./images/operator
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

charts/apps/volumes/templates/movies-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: movies
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-movies
-  nfs:
-    path: '{{ .Values.movies.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: movies
-spec:
-  storageClassName: manual-movies
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/volumes/templates/music-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: music
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-music
-  nfs:
-    path: '{{ .Values.music.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: music
-spec:
-  storageClassName: manual-music
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/volumes/templates/pictures-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pictures
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-pictures
-  nfs:
-    path: '{{ .Values.pictures.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pictures
-spec:
-  storageClassName: manual-pictures
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/volumes/templates/podcasts-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: podcasts
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-podcasts
-  nfs:
-    path: '{{ .Values.podcasts.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: podcasts
-spec:
-  storageClassName: manual-podcasts
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/volumes/templates/pvc.yaml

@@ -1,7 +1,12 @@
+{{- $values := .Values -}}
+{{- $release := .Release -}}
+
+---
+{{- range $key, $value := $values.shares }}
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: books
+  name: "{{$key}}"
   labels:
     type: nfs
 spec:
@@ -10,19 +15,22 @@ spec:
   accessModes:
     - ReadWriteMany
   persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-books
+  storageClassName: "manual-{{$key}}"
   nfs:
-    path: '{{ .Values.books.path }}'
-    server: '{{ .Values.host }}'
+    path: "{{ $value.path }}"
+    server: "{{ $values.host }}"
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: books
+  name: "{{ $key }}"
 spec:
-  storageClassName: manual-books
+  storageClassName: "manual-{{ $key }}"
   accessModes:
     - ReadWriteMany
   resources:
     requests:
       storage: 10Gi
+---
+{{- end }}
+

charts/apps/volumes/templates/tv-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: tvshows
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-tvshows
-  nfs:
-    path: '{{ .Values.tvshows.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: tvshows
-spec:
-  storageClassName: manual-tvshows
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/volumes/values.yaml

@@ -1,13 +1,16 @@
 host: 192.168.20.106
-movies:
-  path: /mnt/HDD/Movies
-tvshows:
-  path: /mnt/HDD/TV-Shows
-music:
-  path: /mnt/HDD/Music2
-books:
-  path: /mnt/HDD/Books
-podcasts:
-  path: /mnt/HDD/Podcasts
-pictures:
-  path: /mnt/HDD/Pictures
+shares:
+  movies:
+    path: /mnt/HDD/Movies
+  tvshows:
+    path: /mnt/HDD/TV-Shows
+  music:
+    path: /mnt/HDD/Music2
+  books:
+    path: /mnt/HDD/Books
+  podcasts:
+    path: /mnt/HDD/Podcasts
+  pictures:
+    path: /mnt/HDD/Pictures
+  backups:
+    path: /mnt/HDD/Backups

images/backup/Dockerfile

@@ -0,0 +1,10 @@
+FROM alpine/git:latest
+# or a more specific image like a Debian slim or Ubuntu base image.
+RUN apk add --no-cache restic fuse-overlayfs
+WORKDIR /app
+
+COPY backup.sh /app/backup.sh
+COPY cleanup.sh /app/cleanup.sh
+
+# Make scripts executable
+RUN chmod +x /app/backup.sh /app/cleanup.sh

images/backup/backup.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+
+if [ -z "$RESTIC_PASSWORD" ]; then
+  echo "Error: RESTIC_PASSWORD environment variable is not set." >&2
+  exit 1
+fi
+
+RESTIC_REPOSITORY="/mnt/backup"
+SOURCE_DIR="/mnt/source"
+
+mkdir -p "$SOURCE_DIR"
+mkdir -p "/mnt/backup"
+
+echo "Starting Restic backup from $SOURCE_DIR to $RESTIC_REPOSITORY"
+
+echo "Checking/Initializing Restic repository..."
+restic init --repository "$RESTIC_REPOSITORY" || true
+
+echo "Running Restic backup..."
+restic backup \
+  "$SOURCE_DIR" \
+  --verbose \
+  --tag "daily" \
+  --exclude-cache \
+
+if [ $? -eq 0 ]; then
+  echo "Restic backup completed successfully!"
+else
+  echo "Restic backup failed!"
+  exit 1
+fi
+
+echo "Backup finished."

images/backup/cleanup.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+
+set -e
+
+if [ -z "$RESTIC_PASSWORD" ]; then
+  echo "Error: RESTIC_PASSWORD environment variable is not set." >&2
+  exit 1
+fi
+RESTIC_REPOSITORY="/mnt/backup"
+
+echo "Starting Restic cleanup for repository $RESTIC_REPOSITORY"
+
+echo "Checking Restic repository existence..."
+restic snapshots --repository "$RESTIC_REPOSITORY"
+
+# Restic forget and prune strategy
+# --keep-daily 7: Keep 7 most recent daily backups
+# --keep-weekly 4: Keep 4 most recent weekly backups
+# --keep-monthly 6: Keep 6 most recent monthly backups
+# --keep-yearly 1: Keep 1 most recent yearly backup
+# --prune: Actually delete data that's no longer referenced
+# --group-by host,paths: Group snapshots for retention by host and path.
+echo "Running Restic forget and prune..."
+restic forget \
+  --group-by host,paths \
+  --tag "daily" \
+  --keep-daily 7 \
+  --keep-weekly 4 \
+  --keep-monthly 6 \
+  --keep-yearly 1 \
+  --prune \
+  --verbose \
+  --repository "$RESTIC_REPOSITORY"
+
+if [ $? -eq 0 ]; then
+  echo "Restic cleanup completed successfully!"
+else
+  echo "Restic cleanup failed!"
+  exit 1
+fi
+
+echo "Cleanup finished."