# PostgreSQL 定时备份：每天凌晨 pg_dump 压缩后上传到 S3 兼容存储
# 需要先在 backend-secret 里填好 s3-* 配置，然后在 kustomization.yaml 里取消注释启用
apiVersion: batch/v1
kind: CronJob
metadata:
  name: postgres-backup
  namespace: blog
spec:
  # 每天 03:30 执行
  schedule: "30 3 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: backup
              image: postgres:16-alpine
              command:
                - sh
                - -c
                - |
                  set -e
                  FILE="blog-$(date +%Y%m%d-%H%M%S).sql.gz"
                  pg_dump "$DATABASE_URL" | gzip > "/tmp/$FILE"
                  apk add --no-cache aws-cli > /dev/null
                  AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \
                    aws --endpoint-url "$S3_ENDPOINT" s3 cp "/tmp/$FILE" "s3://$S3_BUCKET/backups/$FILE"
                  echo "backup uploaded: $FILE"
              env:
                - name: DATABASE_URL
                  valueFrom:
                    secretKeyRef:
                      name: backend-secret
                      key: database-url
                - name: S3_ENDPOINT
                  valueFrom:
                    secretKeyRef:
                      name: backend-secret
                      key: s3-endpoint
                - name: S3_BUCKET
                  valueFrom:
                    secretKeyRef:
                      name: backend-secret
                      key: s3-bucket
                - name: S3_ACCESS_KEY
                  valueFrom:
                    secretKeyRef:
                      name: backend-secret
                      key: s3-access-key
                - name: S3_SECRET_KEY
                  valueFrom:
                    secretKeyRef:
                      name: backend-secret
                      key: s3-secret-key