#@ load("@ytt:data", "data")

#@ ns = data.values.application.namespace

#@ if data.values.backups.enabled and data.values.backups.storagebox.enabled:
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ocis-s3-backup
  namespace: #@ ns

---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: ocis-s3-backup
  namespace: #@ ns
spec:
  schedule: "0 2 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      ttlSecondsAfterFinished: 86400
      template:
        spec:
          restartPolicy: OnFailure
          serviceAccountName: ocis-s3-backup
          securityContext:
            runAsNonRoot: true
            runAsUser: 1009
            runAsGroup: 1009
            fsGroup: 1009
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: backup
              image: rclone/rclone:1.69.0
              args:
                - sync
                - "s3:ocis-tr1ceracop"
                - "backup:"
                - --transfers=4
                - -v
              resources:
                requests:
                  memory: 128Mi
                  cpu: 50m
              env:
                - name: RCLONE_CONFIG_S3_TYPE
                  value: s3
                - name: RCLONE_CONFIG_S3_PROVIDER
                  value: Other
                - name: RCLONE_CONFIG_S3_ENDPOINT
                  value: https://nbg1.your-objectstorage.com
                - name: RCLONE_CONFIG_S3_ACL
                  value: private
                - name: RCLONE_CONFIG_S3_ACCESS_KEY_ID
                  valueFrom:
                    secretKeyRef:
                      name: ocis-s3-credentials
                      key: accessKey
                - name: RCLONE_CONFIG_S3_SECRET_ACCESS_KEY
                  valueFrom:
                    secretKeyRef:
                      name: ocis-s3-credentials
                      key: secretKey
                - name: RCLONE_CONFIG_STORAGEBOX_TYPE
                  value: sftp
                - name: RCLONE_CONFIG_STORAGEBOX_PORT
                  value: "23"
                - name: RCLONE_CONFIG_STORAGEBOX_KEY_FILE
                  value: /etc/storagebox/ssh-key
                - name: RCLONE_CONFIG_STORAGEBOX_SHELL_TYPE
                  value: none
                - name: RCLONE_CONFIG_STORAGEBOX_MD5SUM_COMMAND
                  value: none
                - name: RCLONE_CONFIG_STORAGEBOX_SHA1SUM_COMMAND
                  value: none
                - name: RCLONE_CONFIG_STORAGEBOX_HOST
                  valueFrom:
                    secretKeyRef:
                      name: ocis-storagebox-credentials
                      key: host
                - name: RCLONE_CONFIG_STORAGEBOX_USER
                  valueFrom:
                    secretKeyRef:
                      name: ocis-storagebox-credentials
                      key: user
                - name: RCLONE_CONFIG_BACKUP_TYPE
                  value: compress
                - name: RCLONE_CONFIG_BACKUP_REMOTE
                  value: storagebox:ocis-backup
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop:
                    - ALL
              volumeMounts:
                - name: storagebox-ssh
                  mountPath: /etc/storagebox
                  readOnly: true
          volumes:
            - name: storagebox-ssh
              secret:
                secretName: ocis-storagebox-credentials
                items:
                  - key: ssh-key
                    path: ssh-key
                defaultMode: 0440
#@ end
