From 5b889197464a23fc45f88adcede320d04b321260 Mon Sep 17 00:00:00 2001
From: Alex Auvolat <alex@adnab.me>
Date: Mon, 26 Sep 2022 13:02:38 +0200
Subject: Move cryptpad backup job to backup-daily.hcl

---
 cluster/prod/app/backup/deploy/backup-daily.hcl    | 45 +++++++++++++++++
 .../backup/cryptpad/backup_aws_access_key_id       |  1 +
 .../backup/cryptpad/backup_aws_secret_access_key   |  1 +
 .../secrets/backup/cryptpad/backup_restic_password |  1 +
 .../backup/cryptpad/backup_restic_repository       |  1 +
 cluster/prod/app/cryptpad/deploy/backup.hcl        | 57 ----------------------
 .../cryptpad_backup/backup_aws_access_key_id       |  1 -
 .../cryptpad_backup/backup_aws_secret_access_key   |  1 -
 .../secrets/cryptpad_backup/backup_restic_password |  1 -
 .../cryptpad_backup/backup_restic_repository       |  1 -
 restic-summary                                     |  2 +-
 11 files changed, 50 insertions(+), 62 deletions(-)
 create mode 100644 cluster/prod/app/backup/secrets/backup/cryptpad/backup_aws_access_key_id
 create mode 100644 cluster/prod/app/backup/secrets/backup/cryptpad/backup_aws_secret_access_key
 create mode 100644 cluster/prod/app/backup/secrets/backup/cryptpad/backup_restic_password
 create mode 100644 cluster/prod/app/backup/secrets/backup/cryptpad/backup_restic_repository
 delete mode 100644 cluster/prod/app/cryptpad/deploy/backup.hcl
 delete mode 100644 cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_access_key_id
 delete mode 100644 cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_secret_access_key
 delete mode 100644 cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_password
 delete mode 100644 cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_repository

diff --git a/cluster/prod/app/backup/deploy/backup-daily.hcl b/cluster/prod/app/backup/deploy/backup-daily.hcl
index df592ce..10020f2 100644
--- a/cluster/prod/app/backup/deploy/backup-daily.hcl
+++ b/cluster/prod/app/backup/deploy/backup-daily.hcl
@@ -193,4 +193,49 @@ EOH
       }
     }
   }
+
+  group "backup-cryptpad" {
+    constraint {
+      attribute = "${attr.unique.hostname}"
+      operator = "="
+      value = "courgette"
+    }
+
+    task "main" {
+      driver = "docker"
+
+      config {
+        image = "restic/restic:0.12.1"
+        entrypoint = [ "/bin/sh", "-c" ]
+        args = [ "restic backup /cryptpad && restic forget --keep-within 1m1d --keep-within-weekly 3m --keep-within-monthly 1y && restic prune --max-unused 50% --max-repack-size 2G && restic check" ]
+        volumes = [
+          "/mnt/storage/cryptpad:/cryptpad"
+        ]
+      }
+
+      template {
+        data = <<EOH
+AWS_ACCESS_KEY_ID={{ key "secrets/backup/cryptpad/backup_aws_access_key_id" }}
+AWS_SECRET_ACCESS_KEY={{ key "secrets/backup/cryptpad/backup_aws_secret_access_key" }}
+RESTIC_REPOSITORY={{ key "secrets/backup/cryptpad/backup_restic_repository" }}
+RESTIC_PASSWORD={{ key "secrets/backup/cryptpad/backup_restic_password" }}
+EOH
+
+         destination = "secrets/env_vars"
+         env = true
+      }
+
+      resources {
+        cpu = 500
+        memory = 200
+      }
+
+      restart {
+        attempts = 2
+        interval = "30m"
+        delay = "15s"
+        mode = "fail"
+      }
+    }
+  }
 }
diff --git a/cluster/prod/app/backup/secrets/backup/cryptpad/backup_aws_access_key_id b/cluster/prod/app/backup/secrets/backup/cryptpad/backup_aws_access_key_id
new file mode 100644
index 0000000..9235e53
--- /dev/null
+++ b/cluster/prod/app/backup/secrets/backup/cryptpad/backup_aws_access_key_id
@@ -0,0 +1 @@
+USER Backup AWS access key ID
diff --git a/cluster/prod/app/backup/secrets/backup/cryptpad/backup_aws_secret_access_key b/cluster/prod/app/backup/secrets/backup/cryptpad/backup_aws_secret_access_key
new file mode 100644
index 0000000..f34677e
--- /dev/null
+++ b/cluster/prod/app/backup/secrets/backup/cryptpad/backup_aws_secret_access_key
@@ -0,0 +1 @@
+USER Backup AWS secret access key
diff --git a/cluster/prod/app/backup/secrets/backup/cryptpad/backup_restic_password b/cluster/prod/app/backup/secrets/backup/cryptpad/backup_restic_password
new file mode 100644
index 0000000..fbaa5fa
--- /dev/null
+++ b/cluster/prod/app/backup/secrets/backup/cryptpad/backup_restic_password
@@ -0,0 +1 @@
+USER Restic password to encrypt backups
diff --git a/cluster/prod/app/backup/secrets/backup/cryptpad/backup_restic_repository b/cluster/prod/app/backup/secrets/backup/cryptpad/backup_restic_repository
new file mode 100644
index 0000000..3f6cb93
--- /dev/null
+++ b/cluster/prod/app/backup/secrets/backup/cryptpad/backup_restic_repository
@@ -0,0 +1 @@
+USER Restic repository, eg. s3:https://s3.garage.tld
diff --git a/cluster/prod/app/cryptpad/deploy/backup.hcl b/cluster/prod/app/cryptpad/deploy/backup.hcl
deleted file mode 100644
index 99dee2f..0000000
--- a/cluster/prod/app/cryptpad/deploy/backup.hcl
+++ /dev/null
@@ -1,57 +0,0 @@
-job "cryptpad_backup" {
-  datacenters = ["neptune"]
-  type = "batch"
-
-  priority = "60"
-
-  periodic {
-    cron = "@daily"
-    // Do not allow overlapping runs.
-    prohibit_overlap = true
-  }
-
-  group "backup-cryptpad" {
-    constraint {
-      attribute = "${attr.unique.hostname}"
-      operator = "="
-      value = "courgette"
-    }
-
-    task "main" {
-      driver = "docker"
-
-      config {
-        image = "restic/restic:0.12.1"
-        entrypoint = [ "/bin/sh", "-c" ]
-        args = [ "restic backup /cryptpad && restic forget --keep-within 1m1d --keep-within-weekly 3m --keep-within-monthly 1y && restic prune --max-unused 50% --max-repack-size 2G && restic check" ]
-        volumes = [
-          "/mnt/storage/cryptpad:/cryptpad"
-        ]
-      }
-
-      template {
-        data = <<EOH
-AWS_ACCESS_KEY_ID={{ key "secrets/cryptpad_backup/backup_aws_access_key_id" }}
-AWS_SECRET_ACCESS_KEY={{ key "secrets/cryptpad_backup/backup_aws_secret_access_key" }}
-RESTIC_REPOSITORY={{ key "secrets/cryptpad_backup/backup_restic_repository" }}
-RESTIC_PASSWORD={{ key "secrets/cryptpad_backup/backup_restic_password" }}
-EOH
-
-         destination = "secrets/env_vars"
-         env = true
-      }
-
-      resources {
-        cpu = 500
-        memory = 200
-      }
-
-      restart {
-        attempts = 2
-        interval = "30m"
-        delay = "15s"
-        mode = "fail"
-      }
-    }
-  }
-}
diff --git a/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_access_key_id b/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_access_key_id
deleted file mode 100644
index 9235e53..0000000
--- a/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_access_key_id
+++ /dev/null
@@ -1 +0,0 @@
-USER Backup AWS access key ID
diff --git a/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_secret_access_key b/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_secret_access_key
deleted file mode 100644
index f34677e..0000000
--- a/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_aws_secret_access_key
+++ /dev/null
@@ -1 +0,0 @@
-USER Backup AWS secret access key
diff --git a/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_password b/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_password
deleted file mode 100644
index fbaa5fa..0000000
--- a/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_password
+++ /dev/null
@@ -1 +0,0 @@
-USER Restic password to encrypt backups
diff --git a/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_repository b/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_repository
deleted file mode 100644
index 3f6cb93..0000000
--- a/cluster/prod/app/cryptpad/secrets/cryptpad_backup/backup_restic_repository
+++ /dev/null
@@ -1 +0,0 @@
-USER Restic repository, eg. s3:https://s3.garage.tld
diff --git a/restic-summary b/restic-summary
index f9295ba..38e9433 100755
--- a/restic-summary
+++ b/restic-summary
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-for svc in dovecot consul plume; do
+for svc in dovecot consul plume cryptpad; do
   export RESTIC_REPOSITORY=`pass deuxfleurs/backups/$svc/restic_repository`
   export RESTIC_PASSWORD=`pass deuxfleurs/backups/$svc/restic_password`
   export AWS_ACCESS_KEY_ID=`pass deuxfleurs/backups/$svc/aws_s3_access_key`
-- 
cgit v1.2.3