From fd306bc351728bb67dd28c34f78df57625b43518 Mon Sep 17 00:00:00 2001
From: Timo Behrendt <t.behrendt@t00n.de>
Date: Mon, 6 Apr 2026 15:01:58 +0200
Subject: [PATCH] feat: add backup

---
 .gitea/workflows/deploy.yaml     |  2 +-
 .gitea/workflows/run-backup.yaml | 20 ++++++++++
 k8s/24_backup_photoprism.yaml    | 63 ++++++++++++++++++++++++++++++++
 3 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 .gitea/workflows/run-backup.yaml
 create mode 100644 k8s/24_backup_photoprism.yaml

diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 0c5e9db..d0653c5 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -28,7 +28,7 @@ jobs:
         uses: azure/k8s-create-secret@6e0ba8047235646753f2a3a3b359b4d0006ff218 # v5.0.1
         with:
           namespace: ${{ steps.namespace.outputs.namespace }}
-          secret-name: backupsidecar-secret
+          secret-name: backup-secret
           secret-type: generic
           data: |
             {
diff --git a/.gitea/workflows/run-backup.yaml b/.gitea/workflows/run-backup.yaml
new file mode 100644
index 0000000..983bcc3
--- /dev/null
+++ b/.gitea/workflows/run-backup.yaml
@@ -0,0 +1,20 @@
+name: Run Scan
+
+on:
+  workflow_dispatch:
+
+jobs:
+  run-renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://gitea.t000-n.de/t.behrendt/k_deploy_workflows/.gitea/actions/extract-namespace-from-repo-name@c41eeb249e8a47e009c5f070d71f167dd1d39760 # 0.0.7
+        id: namespace
+        with:
+          repo: ${{ github.repository }}
+      - uses: azure/setup-kubectl@15650b3ad78fff148532a140b8a4c821796b2d7b # v5.0.0
+      - uses: azure/k8s-set-context@ae59a723ba9abe7a9655538854a025448dbab4aa # v4.0.2
+        with:
+          method: kubeconfig
+          kubeconfig: ${{ secrets.KUBECONFIG }}
+      - run: |
+          kubectl -n photoprism create job --from=cronjob/backup backup-photoprism-${{ github.run_id }}
diff --git a/k8s/24_backup_photoprism.yaml b/k8s/24_backup_photoprism.yaml
new file mode 100644
index 0000000..11559ce
--- /dev/null
+++ b/k8s/24_backup_photoprism.yaml
@@ -0,0 +1,63 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: backup
+spec:
+  schedule: "0 20 */14 * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 5
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    metadata:
+      labels:
+        t00n.de/restic-backup: "true"
+    spec:
+      backoffLimit: 3
+      activeDeadlineSeconds: 300
+      template:
+        spec:
+          nodeSelector:
+            kubernetes.io/hostname: k3sh0
+          restartPolicy: OnFailure
+          containers:
+            - name: backup-photoprism
+              image: gitea.t000-n.de/t.behrendt/backupsidecar:6ff6e8759e827b9aa8ec7ecec4356cc04e4ca75a@sha256:f0841b9d74c6c9db8445d130b79c631a5526a2890ce34371859b3bb65f0ee5be
+              env:
+                - name: BACKUP_MODE
+                  value: "directory"
+                - name: RESTIC_REPOSITORY
+                  value: "rest:http://restserver.restic.svc.cluster.local:8000/photoprism"
+                - name: RESTIC_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: backup-secret
+                      key: restic_password
+                - name: RESTIC_REST_USERNAME
+                  valueFrom:
+                    secretKeyRef:
+                      name: backup-secret
+                      key: restic_rest_username
+                - name: RESTIC_REST_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: backup-secret
+                      key: restic_rest_password
+                - name: GOTIFYHOST
+                  value: "https://gotify.t000-n.de"
+                - name: GOTIFYTOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: backup-secret
+                      key: gotify_token
+                - name: GOTIFYTOPIC
+                  value: "Photoprism Backup"
+                - name: SOURCEDIR
+                  value: "/data"
+              volumeMounts:
+                - name: source-data
+                  mountPath: /data
+          volumes:
+            - name: source-data
+              hostPath:
+                path: /mnt/longhorn1/svc/photoprism/main
+                type: Directory
-- 
2.49.1