From f45dcae79ead90d2f7a82886ca0bc1a84ca9cec7 Mon Sep 17 00:00:00 2001 From: Tech Garden Date: Mon, 13 Jul 2026 19:08:50 -0400 Subject: [PATCH 1/2] feat(garage): expose S3 as garage.kian.sh LB for pelican backups Adds garage-s3-lb LoadBalancer (MetalLB) with internal external-dns annotations publishing garage.kian.sh, so Wings hosts on VLAN 80 can reach Garage S3 for native in-panel Pelican backups (path-style, endpoint http://garage.kian.sh:3900, bucket pelican-backups). PROMOTE_OVERRIDE=1 (garage is prod-only, no dev pair) --- .../1276-prod/garage/garage/service.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/kubernetes/clusters/1276-prod/garage/garage/service.yaml b/kubernetes/clusters/1276-prod/garage/garage/service.yaml index c581883a..56005b5a 100644 --- a/kubernetes/clusters/1276-prod/garage/garage/service.yaml +++ b/kubernetes/clusters/1276-prod/garage/garage/service.yaml @@ -28,3 +28,20 @@ spec: selector: { app.kubernetes.io/name: garage } ports: - { name: rpc, port: 3901, targetPort: 3901 } +--- +apiVersion: v1 +kind: Service +metadata: + name: garage-s3-lb + namespace: garage + annotations: + # internal external-dns (RFC2136 -> Technitium) only processes resources + # carrying this provider annotation (--annotation-filter). Without it the + # A record for garage.kian.sh is never published. Mirrors pelican-internal. + dns.kian.sh/provider: internal + external-dns.alpha.kubernetes.io/hostname: garage.kian.sh +spec: + type: LoadBalancer # MetalLB IP, reachable from VLAN 80 wings hosts + selector: { app.kubernetes.io/name: garage } + ports: + - { name: s3-api, port: 3900, targetPort: 3900 } From be9fcd78386e268f8751daab84a447f3628fa87b Mon Sep 17 00:00:00 2001 From: Tech Garden Date: Mon, 13 Jul 2026 19:11:21 -0400 Subject: [PATCH 2/2] feat(pelican): wire s3 backup driver to garage.kian.sh beta35 config/backups.php is env-driven (verify-live #3). Adds APP_BACKUP_DRIVER=s3 + AWS_* endpoint/region/bucket/path-style vars, plus AWS_ACCESS_KEY_ID/SECRET from the pelican-backups-key scoped RW to pelican-backups only (via ExternalSecret -> pelican secret). Var names verified against live beta35 config: path-style flag is AWS_USE_PATH_STYLE_ENDPOINT (not the _BACKUPS_ variant the plan guessed). PROMOTE_OVERRIDE=1 (pelican is prod-only, no dev pair) --- .../1276-prod/pelican/pelican/base/externalsecret.yaml | 6 ++++++ kubernetes/clusters/1276-prod/pelican/pelican/values.yaml | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/kubernetes/clusters/1276-prod/pelican/pelican/base/externalsecret.yaml b/kubernetes/clusters/1276-prod/pelican/pelican/base/externalsecret.yaml index d005330c..802197c5 100644 --- a/kubernetes/clusters/1276-prod/pelican/pelican/base/externalsecret.yaml +++ b/kubernetes/clusters/1276-prod/pelican/pelican/base/externalsecret.yaml @@ -17,3 +17,9 @@ spec: - secretKey: redis-password remoteRef: key: "1d7a1dc8-b9b3-4265-bdee-b41b0016204f" + - secretKey: backup-s3-access-key-id + remoteRef: + key: "e3e89d3c-67c9-4e4e-903c-b486017d17f9" # pelican-backups-s3-access-key-id (garage pelican-backups-key, RW pelican-backups only) + - secretKey: backup-s3-secret-access-key + remoteRef: + key: "c3c91067-4df7-467d-8245-b486017d181f" # pelican-backups-s3-secret-access-key diff --git a/kubernetes/clusters/1276-prod/pelican/pelican/values.yaml b/kubernetes/clusters/1276-prod/pelican/pelican/values.yaml index 2569a7df..75b709ad 100644 --- a/kubernetes/clusters/1276-prod/pelican/pelican/values.yaml +++ b/kubernetes/clusters/1276-prod/pelican/pelican/values.yaml @@ -51,9 +51,17 @@ envs: BEHIND_PROXY: "true" APP_ENV: "production" APP_INSTALLED: "true" # keep true — migrate via CLI (Task 1.6); false exposes the public web installer + # Native backups -> in-cluster Garage S3 (var names verified against beta35 config/backups.php). + APP_BACKUP_DRIVER: "s3" + AWS_DEFAULT_REGION: "garage" + AWS_BACKUPS_BUCKET: "pelican-backups" + AWS_ENDPOINT: "http://garage.kian.sh:3900" + AWS_USE_PATH_STYLE_ENDPOINT: "true" # Garage is non-AWS -> path-style addressing secretEnvs: pelican: DB_PASSWORD: db-password APP_KEY: app-key REDIS_PASSWORD: redis-password + AWS_ACCESS_KEY_ID: backup-s3-access-key-id + AWS_SECRET_ACCESS_KEY: backup-s3-secret-access-key