backup: cut authentik, immich, velero over to Hetzner #25

2026-06-25T13:43:13Z

k.renner commented

2026-06-25 13:43:13 +00:00

Stage 2: broaden the Hetzner backup cutover

Applies the pattern validated end-to-end on paperless (PR #23/#24 — WAL archive + base backup + scratch restore all green) to the remaining backups.

CNPG — authentik (`ak-pg`) + immich (`im-pg`)

ObjectStore → s3://renner-uno-k8s-cnpg/<srv> @ fsn1
creds barman-cloud-creds → hetzner-s3-creds (secrets already in repo from PR #23; now wired into the kustomizations)
drop encryption: AES256 — Hetzner offers only SSE-C, which barman-cloud can't use (#646). At-rest encryption unavailable; transit TLS, bucket private.

Velero

BSL → renner-uno-k8s-velero @ fsn1, virtual-hosted (s3ForcePathStyle: "false"), region: fsn1, checksumAlgorithm: "" (required on Hetzner's Ceph RGW)
credentials → cloud-credentials-hetzner
Velero keeps at-rest encryption — Kopia encrypts client-side, independent of the bucket.

Notes

Garage creds/secrets left in place → one-git revert rollback per app.
All four kustomizations kubectl kustomize clean.
Velero re-seed: first backup re-uploads ~300 GB to the new bucket (one-time, background, ~13h at 50 Mbps).

After merge

I'll validate each: authentik/immich base backup Completed to Hetzner; velero BSL Available + a backup Completed. Then the finish line — drop the Garage scrape/alerts so nas-1 can go nightly-off.

🤖 Generated with Claude Code

## Stage 2: broaden the Hetzner backup cutover Applies the pattern **validated end-to-end on paperless** (PR #23/#24 — WAL archive + base backup + scratch restore all green) to the remaining backups. ### CNPG — authentik (`ak-pg`) + immich (`im-pg`) - ObjectStore → `s3://renner-uno-k8s-cnpg/<srv>` @ `fsn1` - creds `barman-cloud-creds` → `hetzner-s3-creds` (secrets already in repo from PR #23; now wired into the kustomizations) - **drop `encryption: AES256`** — Hetzner offers only SSE-C, which barman-cloud can't use ([#646](https://github.com/cloudnative-pg/plugin-barman-cloud/issues/646)). At-rest encryption unavailable; transit TLS, bucket private. ### Velero - BSL → `renner-uno-k8s-velero` @ `fsn1`, **virtual-hosted** (`s3ForcePathStyle: "false"`), `region: fsn1`, `checksumAlgorithm: ""` (required on Hetzner's Ceph RGW) - credentials → `cloud-credentials-hetzner` - **Velero keeps at-rest encryption** — Kopia encrypts client-side, independent of the bucket. ### Notes - Garage creds/secrets left in place → one-`git revert` rollback per app. - All four kustomizations `kubectl kustomize` clean. - Velero re-seed: first backup re-uploads ~300 GB to the new bucket (one-time, background, ~13h at 50 Mbps). ### After merge I'll validate each: authentik/immich base backup `Completed` to Hetzner; velero BSL `Available` + a backup `Completed`. Then the finish line — drop the Garage scrape/alerts so nas-1 can go nightly-off. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner added 1 commit 2026-06-25 13:43:14 +00:00

backup: cut authentik, immich, velero over to Hetzner c27825279e

Stage 2 of the offsite backup migration, applying the pattern validated
end-to-end on paperless (WAL archive + base backup + scratch restore).

CNPG (authentik ak-pg, immich im-pg):
- repoint ObjectStore -> s3://renner-uno-k8s-cnpg/<srv> @ fsn1
- creds barman-cloud-creds -> hetzner-s3-creds (wired into kustomizations)
- drop encryption: AES256 (Hetzner has no barman-usable SSE; see #646)

Velero:
- BSL -> renner-uno-k8s-velero @ fsn1, virtual-hosted (s3ForcePathStyle
  false), region fsn1, checksumAlgorithm "" (required on Hetzner)
- credentials -> cloud-credentials-hetzner
- Kopia encrypts client-side, so velero keeps at-rest encryption.

Garage creds/secrets left in place for one-revert rollback. After this
deploys + validates, the Garage Prometheus scrape/alerts can be dropped
and nas-1 freed for nightly shutdown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 8be75b0e7f into master

2026-06-25 13:52:35 +00:00

k.renner referenced this issue from a commit

2026-06-25 13:52:35 +00:00

Merge pull request 'backup: cut authentik, immich, velero over to Hetzner' (#25) from hetzner-cutover-rest into master

k.renner referenced this pull request

2026-06-25 14:09:55 +00:00

monitoring: retire Garage scrape, add Hetzner backup-endpoint alert #26

Sign in to join this conversation.