apiVersion: v1
kind: ConfigMap
metadata:
  name: postgresql-backup-script
data:
  backup.sh: |
    #!/bin/sh
    set -eu
    backup_fs=$(stat -f -c %T /backup)
    echo "Backup filesystem: $backup_fs"
    test "$backup_fs" = bcachefs
    case "$BACKUP_TARGET" in *[!a-zA-Z0-9_-]*|'') echo "Invalid backup target" >&2; exit 1 ;; esac
    PGUSER="${PGUSER:-postgres}"
    PGDATABASE="${PGDATABASE:-postgres}"
    export PGUSER PGDATABASE
    test -n "$PGHOST" -a -n "$PGUSER" -a -n "$PGPASSWORD"
    root="/backup/kubernetes/postgresql/$BACKUP_TARGET"
    mkdir -p "$root"
    run="$root/$(date -u +%Y-%m-%dT%H-%M-%SZ)"
    mkdir -m 0700 "$run"
    if [ "$BACKUP_MODE" = all ]; then
      pg_dumpall --globals-only --no-role-passwords > "$run/globals.sql.partial"
      test -s "$run/globals.sql.partial"
      mv "$run/globals.sql.partial" "$run/globals.sql"
      psql -AtX -v ON_ERROR_STOP=1 -d postgres -c 'SELECT datname FROM pg_database WHERE datallowconn AND NOT datistemplate ORDER BY datname' > "$run/databases.list"
      while IFS= read -r database; do
        case "$database" in *[!a-zA-Z0-9_-]*|'') echo "Invalid database name" >&2; exit 1 ;; esac
        pg_dump --format=custom --file="$run/$database.dump.partial" --dbname="$database"
        pg_restore --list "$run/$database.dump.partial" >/dev/null
        mv "$run/$database.dump.partial" "$run/$database.dump"
      done < "$run/databases.list"
      test "$(find "$run" -maxdepth 1 -name '*.dump' | wc -l)" -gt 0
    else
      case "$PGDATABASE" in *[!a-zA-Z0-9_-]*|'') echo "Invalid database name" >&2; exit 1 ;; esac
      pg_dump --format=custom --file="$run/$PGDATABASE.dump.partial" --dbname="$PGDATABASE"
      pg_restore --list "$run/$PGDATABASE.dump.partial" >/dev/null
      mv "$run/$PGDATABASE.dump.partial" "$run/$PGDATABASE.dump"
    fi
    date -u +%FT%TZ > "$run/complete"
    echo "Completed PostgreSQL backup for $BACKUP_TARGET at $run"
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: postgresql-backup
spec:
  schedule: "30 2 * * *"
  timeZone: Europe/Vienna
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 600
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 7
  jobTemplate:
    spec:
      backoffLimit: 0
      activeDeadlineSeconds: 21600
      template:
        spec:
          nodeSelector:
            kubernetes.io/hostname: arschrock
          tolerations:
            - key: node-role.kubernetes.io/control-plane
              operator: Exists
              effect: NoSchedule
          automountServiceAccountToken: false
          restartPolicy: Never
          securityContext:
            runAsUser: 962
            runAsGroup: 962
          containers:
            - name: pg-dump
              image: postgres:18.6
              imagePullPolicy: IfNotPresent
              command: [/bin/sh, /scripts/backup.sh]
              env:
                - name: BACKUP_TARGET
                  value: target
                - name: BACKUP_MODE
                  value: all
                - name: PGHOST
                  value: postgresql
                - name: PGSSLMODE
                  value: prefer
                - name: PGPASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: postgres-backup-credentials
                      key: password
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop: [ALL]
              volumeMounts:
                - name: backup
                  mountPath: /backup
                - name: scripts
                  mountPath: /scripts
                  readOnly: true
          volumes:
            - name: backup
              hostPath:
                path: /mnt/backup
                type: Directory
            - name: scripts
              configMap:
                name: postgresql-backup-script
                defaultMode: 0555