1.7 KiB
Garage on the NAS
S3 storage for Velero, on the Synology (192.168.1.99) in Docker, outside
the cluster. Replaced MinIO, which is no longer maintained. One node, data
in /volume1/docker/garage/{meta,data}. S3 API on port 3900, admin API on
3903, both LAN only. Set up 2026-10-25 with Garage v2.5.0.
The NAS is reached as ssh -p 34000 rubenhensen@192.168.1.99; docker is
in /usr/local/bin, which a non-interactive SSH session doesn't have on
its PATH.
Setup
garage.toml here has placeholders for the two secrets; on the NAS they
were filled in once with openssl rand -hex 32 (rpc_secret) and
openssl rand -base64 32 (admin_token), and only exist there.
cd /volume1/docker/garage
docker compose up -d
g="docker exec garage /garage"
$g layout assign -z nas -c 800G <node id from $g status>
$g layout apply --version 1
$g bucket create velero-backups
$g key create velero
$g bucket allow --read --write --key velero velero-backups
Velero's key is in Vault as kv/velero-s3 (access_key_id,
secret_access_key) and reaches Velero through
velero/external-secret.yaml. Without the cluster, $g key info velero --show-secret on the NAS shows it again.
CNPG's backups (authentik/postgresql-backup.yaml,
immich/postgresql-backup.yaml) have a bucket and a key per cluster, so
neither database can touch the other's backups. Made on 2026-10-26 the
same way as Velero's, with cnpg-authentik and cnpg-immich as both
bucket and key name; the keys are in Vault as kv/cnpg-authentik-s3 and
kv/cnpg-immich-s3.
Renovate updates the image tag in compose.yaml, but nothing deploys it:
after merging, docker compose pull && docker compose up -d on the NAS.