91 lines
3.8 KiB
Text
91 lines
3.8 KiB
Text
# Contract for the backup_manager component instance configuration.
|
|
# Consumed by the cluster install script via env-backup_manager.j2.
|
|
|
|
{
|
|
BackupManager = {
|
|
name | String,
|
|
namespace | String | doc "K8s namespace for the daemon Deployment" | default = "backup-system",
|
|
mode | [| 'cluster |] | default = 'cluster,
|
|
|
|
# Daemon Deployment parameters
|
|
daemon_replicas | Number | doc "Single replica today (HA via leader election deferred)" | default = 1,
|
|
daemon_image | String,
|
|
daemon_http_port | Number | default = 9099,
|
|
daemon_metrics_port | Number | default = 9100,
|
|
|
|
# Mount Pod (ephemeral, not 24/7)
|
|
mount_image | String,
|
|
|
|
# Vault wiring (ADR-017)
|
|
vault_endpoint | String,
|
|
vault_bootstrap_secret_ref | String | doc "K8s Secret holding the bootstrap NKey/JWT for first-time vault auth",
|
|
|
|
# NATS wiring (ADR-016)
|
|
nats_url | String,
|
|
nats_topology_ref | String | doc "Path to the NATS topology Nickel file (declarative streams + consumers)",
|
|
|
|
# Workspace policy paths (consumed by daemon at startup + on watcher reload)
|
|
policies = {
|
|
components_path | String | doc "Glob pattern for component .ncl files" | default = "infra/libre-wuji/components/*.ncl",
|
|
groups_path | String | doc "Path to backup-groups.ncl" | default = "infra/libre-wuji/backup-groups.ncl",
|
|
system_backups_path | String | doc "Path to system-backups.ncl" | default = "infra/libre-wuji/system-backups.ncl",
|
|
verify_recipes_path | String | doc "Directory with DrillSpec recipes" | default = "infra/libre-wuji/verify-recipes",
|
|
nickel_import_path | String | default = "/opt/provisioning",
|
|
},
|
|
|
|
# Concurrency budgets
|
|
concurrency = {
|
|
max_parallel_backups | Number | default = 4,
|
|
max_parallel_per_destination | Number | default = 2,
|
|
},
|
|
|
|
# On-host installation: where to deploy the binary for SystemBackupDef
|
|
# consumers (etcd, k8s_certs, vault_state, host_configs). The wrapper
|
|
# provisioning installer copies the prvng-backup binary via SSH.
|
|
host_install = {
|
|
binary_path | String | default = "/usr/local/bin/prvng-backup",
|
|
cron_dir | String | default = "/etc/cron.d",
|
|
systemd_dir | String | default = "/etc/systemd/system",
|
|
env_dir | String | default = "/etc/prvng-backup",
|
|
},
|
|
|
|
# Required Secrets injected into the daemon Pod (via envFrom.secretRef).
|
|
# Contents are populated at install time by the wrapper from SOPS+Age
|
|
# bootstrap secrets; the daemon then promotes them into vault for
|
|
# subsequent runs (ADR-017).
|
|
requires = {
|
|
storage | { size | String, persistent | Bool } | default = { size = "5Gi", persistent = true },
|
|
ports | Array {
|
|
port | Number,
|
|
protocol | String | default = "TCP",
|
|
exposure | [| 'public, 'private, 'internal |] | default = 'internal,
|
|
} | default = [
|
|
{ port = 9099, exposure = 'internal },
|
|
{ port = 9100, exposure = 'internal },
|
|
],
|
|
credentials | Array String | default = [
|
|
"VAULT_BOOTSTRAP_TOKEN",
|
|
"NATS_BOOTSTRAP_NKEY_SEED",
|
|
"BACKUP_AGE_KEY", # bootstrap age key for vault_state recovery
|
|
"BACKUP_S3_PRIMARY_ACCESS_KEY",
|
|
"BACKUP_S3_PRIMARY_SECRET_KEY",
|
|
"BACKUP_B2_REPLICA_KEY_ID",
|
|
"BACKUP_B2_REPLICA_APPLICATION_KEY",
|
|
],
|
|
},
|
|
|
|
provides = {
|
|
service | String | default = "backup-manager",
|
|
port | Number | default = 9099,
|
|
endpoints | Array String | default = ["/metrics", "/api/v1/policy", "/api/v1/queue"],
|
|
},
|
|
|
|
operations = {
|
|
install | Bool | default = true,
|
|
update | Bool | default = true,
|
|
delete | Bool | default = true,
|
|
health | Bool | default = true,
|
|
restart | Bool | default = true,
|
|
},
|
|
},
|
|
}
|