mirror of
https://github.com/Portabase/agent.git
synced 2026-10-12 07:49:34 +00:00
Charles Gauthereau
5d87fb2d7d
Back up and restore plain directories, alongside the database sources. Files source and Archive (P0) - `files` type: absolute path (not /), options.exclude and options.one_file_system; walk + tar.gz with symlinks kept as links, special files skipped, unreadable entries fail the run. - Mirror restore: archive validated first, then everything not excluded is wiped (mount points and special files kept) and the archive is extracted, retrying without metadata on filesystems refusing chown/chmod. - Windows-safe platform helpers; helm extraVolumes/extraVolumeMounts. Universal rclone mapper (P1) - rclone_target(storage) for s3, blob, gcs, drive, rclone and sftp; sftp goes through it; rclone obscure reads the password from stdin. Snapshots, restic (P2) - restic in the image; repository per source and channel, password derived from the master key (HKDF); stable host, bs:<row> tags, translated excludes; exit 3 fails and forgets the snapshot. - Mirror restore with `restic restore --delete`; restore payload carries the encrypted channel; snapshot ids must be full ids. - Engine in the ping and in scheduled task metadata. One locked method per source (spec A) - databases.json declares options.method (archive, snapshot, sync), reported in the ping for local sources only. - Sync: rclone sync per channel onto <folder>/sync/<id>/current, refuses an empty source, reports transferred/deleted counters. Local channel (spec B) - Snapshots and Sync reach the dashboard's local storage through its append-only restic REST server and its WebDAV server. Security - Strict rclone config validation: one section, no duplicate keys, no command, credential or host-file keys, no quoted values, valid backend type, blocked backends. - Scheduled task metadata (decrypted storages) is no longer logged.
61 lines
1.3 KiB
YAML
61 lines
1.3 KiB
YAML
replicaCount: 1
|
|
|
|
image:
|
|
repository: portabase/agent
|
|
tag: latest
|
|
pullPolicy: IfNotPresent
|
|
|
|
env:
|
|
EDGE_KEY: "your_edge_key_here"
|
|
TZ: "UTC"
|
|
POLLING: "5"
|
|
APP_ENV: "production"
|
|
LOG: "info"
|
|
RETRY_ATTEMPTS: "3"
|
|
RETRY_BACKOFF_MS: "1000"
|
|
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
|
|
volume:
|
|
configFile:
|
|
enabled: true
|
|
hostPath: "" # Use host file if set, otherwise use `content`
|
|
content: | # JSON content for config.json if no hostPath
|
|
{
|
|
"databases": [
|
|
{
|
|
"name": "my-site-prod (readable name)",
|
|
"database": "devdb",
|
|
"type": "postgresql",
|
|
"host": "localhost",
|
|
"port": 5432,
|
|
"username": "admin_prod",
|
|
"password": "super_secure_password",
|
|
"generated_id": "550e8400-e29b-41d4-a716-446655440000"
|
|
}
|
|
]
|
|
}
|
|
|
|
# Extra volumes for the agent pod, e.g. a host directory used by a `files`
|
|
# source. Mount it read-write: restores write into it.
|
|
extraVolumes: []
|
|
# - name: shared-files
|
|
# hostPath:
|
|
# path: /srv/files
|
|
# type: Directory
|
|
|
|
extraVolumeMounts: []
|
|
# - name: shared-files
|
|
# mountPath: /data/files # use this path as the source `path`
|
|
|
|
network:
|
|
hostAliases:
|
|
- ip: "127.0.0.1"
|
|
hostnames:
|
|
- "localhost" |