feat(storage): install restic rest-server

[martinohmann]

No description provided.

[github-actions]

kustomization changes in kubernetes/storage

--- kubernetes/storage/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/restic

+++ kubernetes/storage/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/restic

@@ -0,0 +1,34 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: restic
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: restic
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+  - name: cert-manager-issuers
+  interval: 30m
+  path: ./kubernetes/storage/apps/default/restic/app
+  postBuild:
+    substituteFrom:
+    - kind: Secret
+      name: cluster-secrets
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  targetNamespace: default
+  timeout: 5m
+  wait: false
+
--- kubernetes/storage/apps/default/restic/app Kustomization: flux-system/restic Certificate: default/restic

+++ kubernetes/storage/apps/default/restic/app Kustomization: flux-system/restic Certificate: default/restic

@@ -0,0 +1,19 @@

+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  labels:
+    app.kubernetes.io/name: restic
+    kustomize.toolkit.fluxcd.io/name: restic
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: restic
+  namespace: default
+spec:
+  commonName: restic.18b.haus
+  dnsNames:
+  - restic.18b.haus
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-production
+  secretName: restic-tls
+
--- kubernetes/storage/apps/default/restic/app Kustomization: flux-system/restic HelmRelease: default/restic

+++ kubernetes/storage/apps/default/restic/app Kustomization: flux-system/restic HelmRelease: default/restic

@@ -0,0 +1,81 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: restic
+    kustomize.toolkit.fluxcd.io/name: restic
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: restic
+  namespace: default
+spec:
+  chart:
+    spec:
+      chart: app-template
+      interval: 30m
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+      version: 3.5.1
+  interval: 2h
+  values:
+    controllers:
+      restic:
+        annotations:
+          reloader.stakater.com/auto: 'true'
+        containers:
+          app:
+            env:
+              OPTIONS: |
+                --listen 0.0.0.0:443 --private-repos --prometheus --prometheus-no-auth --tls --tls-cert /certs/tls.crt --tls-key /certs/tls.key
+            image:
+              repository: docker.io/restic/rest-server
+              tag: 0.13.0
+            probes:
+              liveness:
+                enabled: false
+              readiness:
+                enabled: false
+              startup:
+                enabled: false
+            resources:
+              requests:
+                cpu: 5m
+                memory: 128Mi
+            securityContext:
+              privileged: true
+              runAsUser: 0
+    persistence:
+      certs:
+        globalMounts:
+        - path: /certs
+          readOnly: true
+        name: restic-tls
+        type: secret
+      repository:
+        globalMounts:
+        - path: /data
+        hostPath: /io/restic
+        hostPathType: Directory
+        type: hostPath
+    service:
+      app:
+        annotations:
+          external-dns.alpha.kubernetes.io/hostname: restic.18b.haus
+          io.cilium/lb-ipam-ips: 192.168.40.156
+        controller: restic
+        ports:
+          https:
+            port: 443
+        type: LoadBalancer
+    serviceMonitor:
+      app:
+        endpoints:
+        - interval: 1m
+          path: /metrics
+          port: metrics
+          scheme: http
+          scrapeTimeout: 10s
+        serviceName: restic
+

[github-actions]

helmrelease changes in kubernetes/storage

--- HelmRelease: default/restic Service: default/restic

+++ HelmRelease: default/restic Service: default/restic

@@ -0,0 +1,25 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: restic
+  labels:
+    app.kubernetes.io/instance: restic
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: restic
+    app.kubernetes.io/service: restic
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: restic.18b.haus
+    io.cilium/lb-ipam-ips: 192.168.40.156
+spec:
+  type: LoadBalancer
+  ports:
+  - port: 443
+    targetPort: 443
+    protocol: TCP
+    name: https
+  selector:
+    app.kubernetes.io/component: restic
+    app.kubernetes.io/instance: restic
+    app.kubernetes.io/name: restic
+
--- HelmRelease: default/restic Deployment: default/restic

+++ HelmRelease: default/restic Deployment: default/restic

@@ -0,0 +1,65 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: restic
+  labels:
+    app.kubernetes.io/component: restic
+    app.kubernetes.io/instance: restic
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: restic
+  annotations:
+    reloader.stakater.com/auto: 'true'
+spec:
+  revisionHistoryLimit: 3
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: restic
+      app.kubernetes.io/name: restic
+      app.kubernetes.io/instance: restic
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: restic
+        app.kubernetes.io/instance: restic
+        app.kubernetes.io/name: restic
+    spec:
+      enableServiceLinks: false
+      serviceAccountName: default
+      automountServiceAccountToken: true
+      hostIPC: false
+      hostNetwork: false
+      hostPID: false
+      dnsPolicy: ClusterFirst
+      containers:
+      - env:
+        - name: OPTIONS
+          value: |
+            --listen 0.0.0.0:443 --private-repos --prometheus --prometheus-no-auth --tls --tls-cert /certs/tls.crt --tls-key /certs/tls.key
+        image: docker.io/restic/rest-server:0.13.0
+        name: app
+        resources:
+          requests:
+            cpu: 5m
+            memory: 128Mi
+        securityContext:
+          privileged: true
+          runAsUser: 0
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /data
+          name: repository
+      volumes:
+      - name: certs
+        secret:
+          secretName: restic-tls
+      - hostPath:
+          path: /io/restic
+          type: Directory
+        name: repository
+
--- HelmRelease: default/restic ServiceMonitor: default/restic

+++ HelmRelease: default/restic ServiceMonitor: default/restic

@@ -0,0 +1,26 @@

+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: restic
+  labels:
+    app.kubernetes.io/instance: restic
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: restic
+spec:
+  jobLabel: restic
+  namespaceSelector:
+    matchNames:
+    - default
+  selector:
+    matchLabels:
+      app.kubernetes.io/service: restic
+      app.kubernetes.io/name: restic
+      app.kubernetes.io/instance: restic
+  endpoints:
+  - interval: 1m
+    path: /metrics
+    port: metrics
+    scheme: http
+    scrapeTimeout: 10s
+