feat: add scheduled backups (#48)

* feat: add scheduled backups

* Rename Kubernetes cron job resource for tasknote DB

Author: RMCampos

.github/workflows/cd-main.yml

@@ -109,6 +109,8 @@ jobs:
             -var="db_name=${{ secrets.DB_NAME }}" \
             -var="security_key=${{ secrets.JWT_SECURITY_KEY }}" \
             -var="mailgun_apikey=${{ secrets.MAILGUN_API_KEY }}" \
+            -var="r2_access_key=${{ secrets.R2_ACCESS_KEY_ID }}" \
+            -var="r2_secret_key=${{ secrets.R2_SECRET_ACCESS_KEY }}" \
             -var="backend_image=${{ steps.deploy-vars.outputs.backend_image }}" \
             -var="frontend_image=${{ steps.deploy-vars.outputs.frontend_image }}"
           terraform show -json tfplan > tfplan.json

terraform/.terraform.lock.hcl

@@ -48,6 +48,26 @@ variable "mailgun_apikey" {
   sensitive = true
 }
 
+variable "r2_access_key" {
+  type      = string
+  sensitive = true
+}
+
+variable "r2_secret_key" {
+  type      = string
+  sensitive = true
+}
+
+variable "r2_bucket_name" {
+  type    = string
+  default = "tasknote-backups"
+}
+
+variable "r2_endpoint" {
+  type    = string
+  default = "https://d17eb09b6bce2f90e16e800bb2a6baf9.r2.cloudflarestorage.com"
+}
+
 variable "cors_allowed_origins" {
   type    = string
   default = "https://tasknote.darkroasted.vps-kinghost.net"
@@ -368,3 +388,120 @@ resource "kubernetes_ingress_v1" "tasknote_ingress" {
     }
   }
 }
+
+resource "kubernetes_secret_v1" "r2_backup_secrets" {
+  metadata {
+    name      = "r2-backup-secrets"
+    namespace = kubernetes_namespace_v1.tasknote.metadata[0].name
+  }
+
+  data = {
+    access_key = var.r2_access_key
+    secret_key = var.r2_secret_key
+  }
+}
+
+resource "kubernetes_cron_job_v1" "tasknote_db_backup" {
+  metadata {
+    name      = "tasknote-db-backup"
+    namespace = kubernetes_namespace_v1.tasknote.metadata[0].name
+  }
+  spec {
+    schedule = "0 0,12 * * *"
+    job_template {
+      metadata {
+        labels = {
+          app = "taknote-db-backup"
+        }
+      }
+      spec {
+        template {
+          metadata {
+            labels = {
+              app = "tasknote-db-backup"
+            }
+          }
+          spec {
+            container {
+              name    = "backup"
+              image   = "postgres:15.8-alpine"
+              command = ["/bin/sh", "-c"]
+              args = [
+                <<-EOT
+                apk add --no-cache aws-cli
+                export PGPASSWORD=$POSTGRES_PASSWORD
+                FILENAME="backup-$(date +%Y%m%d%H%M%S).sql.gz"
+                echo "Starting backup of $POSTGRES_DB to $FILENAME..."
+                pg_dump -h $DB_HOST -U $POSTGRES_USER $POSTGRES_DB | gzip > /tmp/$FILENAME
+                echo "Uploading to R2..."
+                AWS_ACCESS_KEY_ID=$R2_ACCESS_KEY AWS_SECRET_ACCESS_KEY=$R2_SECRET_KEY \
+                aws s3 cp /tmp/$FILENAME s3://$R2_BUCKET/ --endpoint-url $R2_ENDPOINT
+                echo "Backup completed successfully."
+                EOT
+              ]
+              env {
+                name  = "DB_HOST"
+                value = "tasknote-db-svc"
+              }
+              env {
+                name = "POSTGRES_USER"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret_v1.tasknote_secrets.metadata[0].name
+                    key  = "postgres_user"
+                  }
+                }
+              }
+              env {
+                name = "POSTGRES_PASSWORD"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret_v1.tasknote_secrets.metadata[0].name
+                    key  = "postgres_password"
+                  }
+                }
+              }
+              env {
+                name = "POSTGRES_DB"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret_v1.tasknote_secrets.metadata[0].name
+                    key  = "postgres_db"
+                  }
+                }
+              }
+              env {
+                name = "R2_ACCESS_KEY"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret_v1.r2_backup_secrets.metadata[0].name
+                    key  = "access_key"
+                  }
+                }
+              }
+              env {
+                name = "R2_SECRET_KEY"
+                value_from {
+                  secret_key_ref {
+                    name = kubernetes_secret_v1.r2_backup_secrets.metadata[0].name
+                    key  = "secret_key"
+                  }
+                }
+              }
+              env {
+                name  = "R2_BUCKET"
+                value = var.r2_bucket_name
+              }
+              env {
+                name  = "R2_ENDPOINT"
+                value = var.r2_endpoint
+              }
+            }
+            restart_policy = "OnFailure"
+          }
+        }
+      }
+    }
+  }
+}
+