Ronni Baslund
a27c238c76
ci / typecheck (map[dir:apps/booking name:booking]) (push) Has been cancelled
ci / typecheck (map[dir:apps/portal name:portal]) (push) Has been cancelled
ci / typecheck (map[dir:apps/website name:website]) (push) Has been cancelled
ci / typecheck (map[dir:services/platform-api name:platform-api]) (push) Has been cancelled
ci / test (push) Has been cancelled
pg_dumpall (all Postgres DBs + roles) and mongodump (all Mongo DBs) write gzipped dumps to the hostPath /opt/dezky-backup/dumps at 02:50/02:52 UTC, which the host Restic job (03:20) ships to the Storage Box. Each keeps the last 7 local dumps; Restic holds the real off-box retention. - pods run as root (hostPath dir is root-owned, as is the host Restic reader) - mongo job uses bash (mongo:7 /bin/sh is dash → no pipefail) - creds from postgres-secret / mongo-secret via secretKeyRef Verified: both jobs Complete, dumps present on the host (postgres-all ~2.2MB w/ Authentik data, mongo archive).
fleet/data — in-cluster data tier
PostgreSQL 16 (Authentik + OCIS), MongoDB 7 (portal/platform-api) and Redis 7
(cache/sessions) as single-node StatefulSets on Longhorn volumes
(storageClassName: longhorn — see ../longhorn/), in the dezky-data
namespace. Mirrors the dev docker-compose stack. Self-hosted on the box — no
external/managed DBs (EU-sovereign).
Prereq: Longhorn must be installed and its
longhornStorageClass present before applying these (the PVCs request it). See../longhorn/README.md.
Stable in-cluster DNS:
postgres.dezky-data.svc.cluster.local:5432mongo.dezky-data.svc.cluster.local:27017redis.dezky-data.svc.cluster.local:6379
Apply
# 1) Secrets first (out-of-band — NOT in git). Generate values with openssl.
cp secrets.example.yaml /tmp/data-secrets.yaml
$EDITOR /tmp/data-secrets.yaml # fill every REPLACE_* (openssl rand -hex 24)
kubectl create namespace dezky-data --dry-run=client -o yaml | kubectl apply -f -
kubectl apply -f /tmp/data-secrets.yaml && rm /tmp/data-secrets.yaml
# 2) The data tier
kubectl apply -k .
# 3) Watch them come up
kubectl -n dezky-data rollout status statefulset/postgres
kubectl -n dezky-data rollout status statefulset/mongo
kubectl -n dezky-data rollout status statefulset/redis
kubectl -n dezky-data get pods,pvc
Notes
- Postgres init runs once (empty data dir):
postgres-initConfigMap creates theauthentik+ocisdatabases/roles usingAUTHENTIK_DB_PASSWORD/OCIS_DB_PASSWORDfrom the secret. If you change those passwords later, alter the roles in SQL — re-init won't re-run on an existing volume. - Store all generated passwords in Bitwarden.
AUTHENTIK_DB_PASSWORD/OCIS_DB_PASSWORDmust match what you later give Authentik and OCIS. - Backups: Longhorn snapshots + backs these volumes up to Hetzner Object
Storage (S3) — see
../longhorn/README.md. Block snapshots of a live DB are crash-consistent at best, so also runpg_dump/mongodumpCronJobs (added next) into a Longhorn PVC; restore from those logical dumps, not the raw data dirs. - Single replica each — fine for one node. HA/replicas are a later concern.