mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
43 lines
1.7 KiB
Markdown
43 lines
1.7 KiB
Markdown
# Garage on the NAS
|
|
|
|
S3 storage for Velero, on the Synology (192.168.1.99) in Docker, outside
|
|
the cluster. Replaced MinIO, which is no longer maintained. One node, data
|
|
in `/volume1/docker/garage/{meta,data}`. S3 API on port 3900, admin API on
|
|
3903, both LAN only. Set up 2026-10-25 with Garage v2.5.0.
|
|
|
|
The NAS is reached as `ssh -p 34000 rubenhensen@192.168.1.99`; docker is
|
|
in `/usr/local/bin`, which a non-interactive SSH session doesn't have on
|
|
its PATH.
|
|
|
|
## Setup
|
|
|
|
`garage.toml` here has placeholders for the two secrets; on the NAS they
|
|
were filled in once with `openssl rand -hex 32` (`rpc_secret`) and
|
|
`openssl rand -base64 32` (`admin_token`), and only exist there.
|
|
|
|
```
|
|
cd /volume1/docker/garage
|
|
docker compose up -d
|
|
g="docker exec garage /garage"
|
|
$g layout assign -z nas -c 800G <node id from $g status>
|
|
$g layout apply --version 1
|
|
$g bucket create velero-backups
|
|
$g key create velero
|
|
$g bucket allow --read --write --key velero velero-backups
|
|
```
|
|
|
|
Velero's key is in Vault as `kv/velero-s3` (`access_key_id`,
|
|
`secret_access_key`) and reaches Velero through
|
|
`velero/external-secret.yaml`. Without the cluster, `$g key info velero
|
|
--show-secret` on the NAS shows it again.
|
|
|
|
CNPG's backups (`authentik/postgresql-backup.yaml`,
|
|
`immich/postgresql-backup.yaml`) have a bucket and a key per cluster, so
|
|
neither database can touch the other's backups. Made on 2026-10-26 the
|
|
same way as Velero's, with `cnpg-authentik` and `cnpg-immich` as both
|
|
bucket and key name; the keys are in Vault as `kv/cnpg-authentik-s3` and
|
|
`kv/cnpg-immich-s3`.
|
|
|
|
Renovate updates the image tag in `compose.yaml`, but nothing deploys it:
|
|
after merging, `docker compose pull && docker compose up -d` on the NAS.
|