#@ load("@ytt:data", "data")

#@ ns = data.values.application.namespace

#! Daily online volume backup. One CronJob per oCIS PVC, each pinned
#! via podAffinity to the consumer pod that already holds that volume.
#! Mounts the RWO PVC read-only alongside the running app — no
#! downtime, no scale-down dance, no cross-pod coupling.
#!
#! Storage Box layout (latest-state mirror):
#!   storagebox:ocis-volumes/{pvc}/...
#!
#! NOTE: online backup — not crash-consistent. decomposedfs writes may
#! be caught mid-flight. Acceptable trade for zero-downtime.

#@ targets = [
#@   {"app": "storageusers",  "pvc": "storageusers-data"},
#@   {"app": "idm",           "pvc": "idm-data"},
#@   {"app": "storagesystem", "pvc": "storagesystem-data"},
#@ ]

#@ if data.values.backups.enabled and data.values.backups.storagebox.enabled:
#@ for t in targets:
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: #@ "ocis-volume-backup-{}".format(t["app"])
  namespace: #@ ns
spec:
  schedule: "30 2 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      ttlSecondsAfterFinished: 86400
      template:
        spec:
          restartPolicy: OnFailure
          securityContext:
            runAsNonRoot: true
            runAsUser: 1009
            runAsGroup: 1009
            fsGroup: 1009
            seccompProfile:
              type: RuntimeDefault
          affinity:
            podAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                - labelSelector:
                    matchLabels:
                      app: #@ t["app"]
                  topologyKey: kubernetes.io/hostname
          containers:
            - name: rclone
              image: rclone/rclone:1.69.0
              command: [/bin/sh, -c]
              args:
                - |
                  set -eu
                  echo "[backup] Syncing ${PVC}..."
                  rclone sync "/pvc" "storagebox:ocis-volumes/${PVC}" \
                    --links \
                    --transfers=4 \
                    -v
                  echo "[backup] Done."
              resources:
                requests:
                  cpu: 100m
                  memory: 256Mi
              env:
                - name: PVC
                  value: #@ t["app"]
                - name: RCLONE_CONFIG_STORAGEBOX_TYPE
                  value: sftp
                - name: RCLONE_CONFIG_STORAGEBOX_PORT
                  value: "23"
                - name: RCLONE_CONFIG_STORAGEBOX_KEY_FILE
                  value: /etc/storagebox/ssh-key
                - name: RCLONE_CONFIG_STORAGEBOX_SHELL_TYPE
                  value: none
                - name: RCLONE_CONFIG_STORAGEBOX_MD5SUM_COMMAND
                  value: none
                - name: RCLONE_CONFIG_STORAGEBOX_SHA1SUM_COMMAND
                  value: none
                - name: RCLONE_CONFIG_STORAGEBOX_HOST
                  valueFrom:
                    secretKeyRef:
                      name: ocis-storagebox-credentials
                      key: host
                - name: RCLONE_CONFIG_STORAGEBOX_USER
                  valueFrom:
                    secretKeyRef:
                      name: ocis-storagebox-credentials
                      key: user
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop:
                    - ALL
              volumeMounts:
                - name: pvc
                  mountPath: /pvc
                  readOnly: true
                - name: storagebox-ssh
                  mountPath: /etc/storagebox
                  readOnly: true
          volumes:
            - name: pvc
              persistentVolumeClaim:
                claimName: #@ t["pvc"]
            - name: storagebox-ssh
              secret:
                secretName: ocis-storagebox-credentials
                items:
                  - key: ssh-key
                    path: ssh-key
                defaultMode: 0440
#@ end
#@ end
