From 9e45ff637666f0e2dd5da11ef946411b843e59e1 Mon Sep 17 00:00:00 2001
From: Alexandre Pires <c.alexandre.pires@gmail.com>
Date: Sat, 10 May 2025 19:06:25 +0200
Subject: [PATCH] feat(backup): add backup script and refactor cron job to use
 it

---
 terraform/modules/utils/scw_rclone/main.tf    | 40 +++++++++++++++----
 .../utils/scw_rclone/resources/backup.sh      | 32 +++++++++++++++
 2 files changed, 64 insertions(+), 8 deletions(-)
 create mode 100644 terraform/modules/utils/scw_rclone/resources/backup.sh

diff --git a/terraform/modules/utils/scw_rclone/main.tf b/terraform/modules/utils/scw_rclone/main.tf
index 446daac..aa0b62a 100644
--- a/terraform/modules/utils/scw_rclone/main.tf
+++ b/terraform/modules/utils/scw_rclone/main.tf
@@ -29,6 +29,16 @@ resource "kubernetes_config_map" "rclone_config" {
   }
 }
 
+resource "kubernetes_config_map" "backup_script" {
+  metadata {
+    name      = "${var.app_name}-backup-script"
+    namespace = var.namespace
+  }
+  data = {
+    "backup.sh" = file("${path.module}/resources/backup.sh")
+  }
+}
+
 resource "kubernetes_cron_job_v1" "backup_job" {
   metadata {
     name      = "${var.app_name}-backup"
@@ -112,16 +122,10 @@ resource "kubernetes_cron_job_v1" "backup_job" {
                 value = var.bucket_name
               }
               command = ["/bin/sh", "-c"]
-              args = [join(";", [
-                "apk update",
-                "apk add gettext",
-                "envsubst</etc/rclone.conf.tmpl>/etc/rclone.conf",
-                "tar -zcvpf /backup/${var.app_name}-files-`date +\"%Y%m%d\"`.tar.gz /files",
-                "find /backup -type f -name '${var.app_name}-files-*.tar.gz' -mtime +${var.retention_days} | xargs --no-run-if-empty rm",
-                "/usr/local/bin/rclone --config=/etc/rclone.conf sync --progress /backup scaleway:$BUCKET_NAME/${var.app_name}-backup"
-              ])]
+              args    = ["/tmp/scripts/backup.sh"]
               security_context {
                 allow_privilege_escalation = false
+                read_only_root_filesystem  = true
               }
               volume_mount {
                 name       = "backup-storage"
@@ -138,6 +142,15 @@ resource "kubernetes_cron_job_v1" "backup_job" {
                 sub_path   = "rclone.conf"
                 read_only  = true
               }
+              volume_mount {
+                name       = "backup-script"
+                mount_path = "/tmp/scripts"
+                read_only  = true
+              }
+              volume_mount {
+                name       = "tmp"
+                mount_path = "/tmp"
+              }
             }
             volume {
               name = "backup-storage"
@@ -157,6 +170,17 @@ resource "kubernetes_cron_job_v1" "backup_job" {
                 name = kubernetes_config_map.rclone_config.metadata[0].name
               }
             }
+            volume {
+              name = "backup-script"
+              config_map {
+                name         = kubernetes_config_map.backup_script.metadata[0].name
+                default_mode = "0755"
+              }
+            }
+            volume {
+              name = "tmp"
+              empty_dir {}
+            }
             restart_policy                   = "Never"
             termination_grace_period_seconds = 30
           }
diff --git a/terraform/modules/utils/scw_rclone/resources/backup.sh b/terraform/modules/utils/scw_rclone/resources/backup.sh
new file mode 100644
index 0000000..e8ec91c
--- /dev/null
+++ b/terraform/modules/utils/scw_rclone/resources/backup.sh
@@ -0,0 +1,32 @@
+#!/bin/sh
+if [ -z "$SCW_ACCESS_KEY" ] || [ -z "$SCW_SECRET_KEY" ]; then
+  echo "SCW_ACCESS_KEY and SCW_SECRET_KEY must be set"
+  exit 1
+fi
+if [ -z "$BUCKET_NAME" ]; then
+  echo "BUCKET_NAME must be set"
+  exit 1
+fi
+if [ -z "$APP_NAME" ]; then
+  echo "APP_NAME must be set"
+  exit 1
+fi
+if [ -z "$BACKUP_RETENTION" ]; then
+  echo "BACKUP_RETENTION must be set"
+  exit 1
+fi
+
+envsubst < /etc/rclone.conf.tmpl > /tmp/rclone.conf
+unset $SCW_ACCESS_KEY
+unset $SCW_SECRET_KEY
+
+apk update
+apk add gettext
+tar -zcvpf /backup/$APP_NAME-files-`date +\"%Y%m%d\"`.tar.gz /files
+
+# Remove old backups
+BACKUP_FILE_PATTERN="$APP_NAME-files-*.tar.gz"
+find /backup -type f -name $BACKUP_FILE_PATTERN -mtime +$BACKUP_RETENTION | xargs --no-run-if-empty rm
+
+# Upload to Scaleway
+/usr/local/bin/rclone --config=/tmp/rclone.conf sync --progress /backup scaleway:$BUCKET_NAME/$APP_NAME-backup"