Add Helm chart for the expense tracker (app, Postgres, ingress, backups)

- Deployment/Service for the app, StatefulSet/Service for Postgres 17 - Secrets (DB password, session secret, Google client, allowed e-mails) via ExternalSecret from OpenBao - Ingress with a Let's Encrypt certificate, NetworkPolicy for Postgres - Nightly pg_dump CronJob - Optional OpenBao OIDC provider setup script Co-Authored-By: Claude Sonnet 5 <[email protected]>
2026-09-20 18:46:19 +02:00
commit 2ee46ceb4a
13 changed files with 881 additions and 0 deletions
@@ -0,0 +1,82 @@
+{{- if .Values.backup.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: expense-tracker-backups
+  namespace: {{ .Values.namespace.name }}
+  labels:
+    app.kubernetes.io/name: expense-tracker-backup
+    {{- include "expense-tracker.labels" . | nindent 4 }}
+spec:
+  accessModes: ["ReadWriteOnce"]
+  {{- if .Values.backup.persistence.storageClassName }}
+  storageClassName: {{ .Values.backup.persistence.storageClassName }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.backup.persistence.size }}
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: expense-tracker-backup
+  namespace: {{ .Values.namespace.name }}
+  labels:
+    app.kubernetes.io/name: expense-tracker-backup
+    {{- include "expense-tracker.labels" . | nindent 4 }}
+spec:
+  schedule: {{ .Values.backup.schedule | quote }}
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 2
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: expense-tracker-backup
+        spec:
+          restartPolicy: OnFailure
+          securityContext:
+            runAsUser: 70
+            runAsGroup: 70
+            fsGroup: 70
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: pg-dump
+              image: {{ .Values.postgres.image | quote }}
+              command:
+                - sh
+                - -ec
+                - |
+                  f="/backup/{{ .Values.postgres.database }}-$(date +%Y%m%d-%H%M%S).dump"
+                  # Write to a temp name first so a failed dump never looks like a good backup.
+                  pg_dump --format=custom --no-owner -f "$f.partial"
+                  mv "$f.partial" "$f"
+                  echo "wrote $f ($(du -h "$f" | cut -f1))"
+                  find /backup -name '*.dump' -mtime +{{ .Values.backup.retentionDays }} -print -delete
+                  find /backup -name '*.partial' -mmin +60 -delete
+                  ls -lh /backup
+              env:
+                {{- include "expense-tracker.pgenv" . | nindent 16 }}
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop: ["ALL"]
+              resources:
+                requests:
+                  cpu: 10m
+                  memory: 32Mi
+                limits:
+                  memory: 256Mi
+              volumeMounts:
+                - name: backups
+                  mountPath: /backup
+          volumes:
+            - name: backups
+              persistentVolumeClaim:
+                claimName: expense-tracker-backups
+{{- end }}