{{- if .Values.backup.enabled }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: expense-tracker-backups
  namespace: {{ .Values.namespace.name }}
  labels:
    app.kubernetes.io/name: expense-tracker-backup
    {{- include "expense-tracker.labels" . | nindent 4 }}
spec:
  accessModes: ["ReadWriteOnce"]
  {{- if .Values.backup.persistence.storageClassName }}
  storageClassName: {{ .Values.backup.persistence.storageClassName }}
  {{- end }}
  resources:
    requests:
      storage: {{ .Values.backup.persistence.size }}
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: expense-tracker-backup
  namespace: {{ .Values.namespace.name }}
  labels:
    app.kubernetes.io/name: expense-tracker-backup
    {{- include "expense-tracker.labels" . | nindent 4 }}
spec:
  schedule: {{ .Values.backup.schedule | quote }}
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 2
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        metadata:
          labels:
            app.kubernetes.io/name: expense-tracker-backup
        spec:
          restartPolicy: OnFailure
          securityContext:
            runAsUser: 70
            runAsGroup: 70
            fsGroup: 70
            runAsNonRoot: true
            seccompProfile:
              type: RuntimeDefault
          containers:
            - name: pg-dump
              image: {{ .Values.postgres.image | quote }}
              command:
                - sh
                - -ec
                - |
                  f="/backup/{{ .Values.postgres.database }}-$(date +%Y%m%d-%H%M%S).dump"
                  # Write to a temp name first so a failed dump never looks like a good backup.
                  pg_dump --format=custom --no-owner -f "$f.partial"
                  mv "$f.partial" "$f"
                  echo "wrote $f ($(du -h "$f" | cut -f1))"
                  find /backup -name '*.dump' -mtime +{{ .Values.backup.retentionDays }} -print -delete
                  find /backup -name '*.partial' -mmin +60 -delete
                  ls -lh /backup
              env:
                {{- include "expense-tracker.pgenv" . | nindent 16 }}
              securityContext:
                allowPrivilegeEscalation: false
                capabilities:
                  drop: ["ALL"]
              resources:
                requests:
                  cpu: 10m
                  memory: 32Mi
                limits:
                  memory: 256Mi
              volumeMounts:
                - name: backups
                  mountPath: /backup
          volumes:
            - name: backups
              persistentVolumeClaim:
                claimName: expense-tracker-backups
{{- end }}