Stage 2 of the offsite backup migration, applying the pattern validated
end-to-end on paperless (WAL archive + base backup + scratch restore).
CNPG (authentik ak-pg, immich im-pg):
- repoint ObjectStore -> s3://renner-uno-k8s-cnpg/<srv> @ fsn1
- creds barman-cloud-creds -> hetzner-s3-creds (wired into kustomizations)
- drop encryption: AES256 (Hetzner has no barman-usable SSE; see #646)
Velero:
- BSL -> renner-uno-k8s-velero @ fsn1, virtual-hosted (s3ForcePathStyle
false), region fsn1, checksumAlgorithm "" (required on Hetzner)
- credentials -> cloud-credentials-hetzner
- Kopia encrypts client-side, so velero keeps at-rest encryption.
Garage creds/secrets left in place for one-revert rollback. After this
deploys + validates, the Garage Prometheus scrape/alerts can be dropped
and nas-1 freed for nightly shutdown.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.8