longhorn backup target

clusters/base/infra/longhorn/longhorn-system/helmrelease.yaml

@@ -29,8 +29,12 @@ spec:
       defaultDataPath: /var/lib/longhorn
       guaranteedEngineManagerCPU: 12
       guaranteedReplicaManagerCPU: 12
-      # если backup target ещё не настроен — оставь пустым, донастроишь позже через UI/CR
-      backupTarget: ""
+      # points at the in-cluster rclone proxy (clusters/base/infra/longhorn/s3-backup-proxy),
+      # which itself encrypts and forwards to the real Wasabi bucket. "longhorn-backups" is
+      # a virtual bucket the proxy creates on demand under the crypt remote - already exists.
+      # region is a dummy value; the real endpoint comes from AWS_ENDPOINTS in the secret below.
+      backupTarget: "s3://longhorn-backups@us-east-1/"
+      backupTargetCredentialSecret: longhorn-backup-target-secret
       # чтобы не разъезжались реплики при 3 нодах
       replicaSoftAntiAffinity: false
     persistence:
@@ -44,4 +48,4 @@ spec:
       resizerReplicaCount: 3
       snapshotterReplicaCount: 3
     ingress:
-      enabled: false             # у тебя уже есть Caddy/Traefik, заведёшь свой Ingress/IngressRoute отдельно
+      enabled: false # exposed via Traefik explicitly

clusters/base/infra/longhorn/longhorn-system/kustomization.yaml

@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - helmrepository.yaml
+  - secret.enc.yaml
   - helmrelease.yaml
   - ingress.yaml

clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: longhorn-backup-target-secret
+    namespace: longhorn-system
+stringData:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:vli6H1YZQviV4ygwEKOhUltZ+5o=,iv:P6xcqbIVME4xMEOiWtXGm1z6S8ceF+uoTHDI6sqG1y8=,tag:IAnsJBEndhf6AVhXN6E1Vg==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:8UXxo+WALaBj1TCC8YfAyq/sJhShIKkfEtI0wHGTuyt1aMdMdqXQRw==,iv:9Gqy3LnX988o+eMwhMxvWw+u9yZ1QDh7pPMX0qs6yL4=,tag:VTWbe2A5vRu5bLeQt2KE6Q==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:Co4mTd6AY+woOmd71Uo/6wmniWIG6Wa6q54UL6XLIsto/6Z79N+gKvV5AaaQ5mXdWi78zaJYJT7lbi2AOg==,iv:DaDMi/CUBcRyoBiau03PXBzdoO4UVV05puhKvHibDFg=,tag:WSMC+QDIn2rFj9lcVc5uLQ==,type:str]
+sops:
+    age:
+        - recipient: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDbW1GRUJad1B1cUJtZXp1
+            TGxsaytYMW9hcE1hR1BlcnVoTjIrdWQ2YmdNCkhuemIwd3hsL1UrWGxRaFo1NHRQ
+            ZVBzR2pFeUlYQ0dTN3E3RG5taitXWGsKLS0tIFNIRDJhZUpwYjV6UXpDcmZUS09n
+            VzhUZkQ1KzdTUnlLRlp6TzJWb2lGdjQK34QBtclIRUTO4dyNHFmPJ0EO9a4fLuXm
+            jQ7DOac/g5S3wByq3xmV65PwalJum1Mty4i+HqphvDsGupyNY6xX+Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:24:50Z"
+    mac: ENC[AES256_GCM,data:6Kn5AD4MuU6+JhtYyOXsEKzmFKRxfMAA83LChO0MeZbhGwI/J7EBeSYMYtZMetua9pmjvZakBQoPlE6Hdjq5cwBG8K3v7K54ZDKb/NK6dfEZMY2hZ5GMe+4NWNDLWPRphu6V7wLNwvhZNrh/J9+LDpnIVdMls2WPzhncmI/pENg=,iv:OLYZWQ0Dl28tUCHkt9XInP67OajX3IaqsGpmE5XNpGQ=,tag:XQzBoYNKZC7yRdhOUUoIqA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml

@@ -4,24 +4,24 @@ metadata:
     name: s3-backup-proxy-secrets
     namespace: longhorn-system
 stringData:
-    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:rgc0xjmQKckyC6iT5fBP4h8g5uU=,iv:MFuYH2N5Ek+UnQT0B/VEERvHGRywbNLLriQ8ghaZVoE=,tag:iCO6vu3S1vpZRnmPRLZ+Og==,type:str]
-    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:XUyJjhl8nzzUhHOIISSIFPiWjV9/SxR2U9S92jwG9sZCqPSZY7h33Q==,iv:Z0YDFHAheLzYO8XWA378nrr/4y4IfDRByoPa607Py2A=,tag:Pu6cvQ71jBbqh/jpxjU62Q==,type:str]
-    CRYPT_PASSWORD: ENC[AES256_GCM,data:PSW/dxh8y1BDswEAy1VGwKkmuqr+yXxITkkFq2iL9W+neieuZd4Z2X8LHw==,iv:30ozLFfNQI9NzEdvDhFTJl+X00UiiaFRL+oGqB2eDHk=,tag:f0fgKn8hPZZIsE2KUMi+1A==,type:str]
-    CRYPT_PASSWORD2: ENC[AES256_GCM,data:c/MIyhK4yg5wYaB2aZ2b3UYm0T+JJDtMYrDruipP0ZmdmO/sz33EtMNPTg==,iv:YodQc8tXVUBU2Y95lazG3MoawIyAYAPxyGAEP/z9dpY=,tag:AyMDKO1iK1c3l0kMuuxcfQ==,type:str]
-    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:PVKKx8YBkonrcDMFcEx0KT+UJ+g=,iv:inuyggvzMGgHi6ND8FLC4yT7Tyis98Qkg6XJf1p0/x8=,tag:eU//31BKXe+p+L6G1MxQQw==,type:str]
-    PROXY_SECRET_KEY: ENC[AES256_GCM,data:7sWaULr5rjlAj6mUiXjAmE+RgYFRvmTpbqtuG6KfQGrSSgkqkIzD7Q==,iv:pVc3Mec6JkpV8GlHWdZW3t4zM3AnLaFjFFAZRm4HzbQ=,tag:+O645+nh6F3REnplyzFMPg==,type:str]
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:g09zyM0cods6snZEw89RPFo5nHU=,iv:Ay6LYQEMbh0L80W3nMUyrlrow4HEfz2V0pjLZmO61Xk=,tag:5S7V9nT/Os+yKqmRqdd8RQ==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:hRla0zAYSET9pnVFFMCixIjzPx9V+SSaFmjbRgR0+XgrJZ2/syFO+w==,iv:3EAloXiOzqAkttdrctRQu6GP8mtJK9+CwbrWnoew+Ms=,tag:xBnbE+e3W/Bg5Cq7eAytbg==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:rcGyfY/Sc0stKopzjmt/jyj1lrc0u9A7eULMgd6100ZGp0RxizHLx07lew==,iv:Pyhof8NB42fVZKfp4E5X5s1lV9VN4dxWAk7/YQn8zus=,tag:koAdJNPr9Cdqd7+oPfz2Mw==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:8zGR2BE4S0iZcecdnLfNFZWRFFV8QITEJX3zmNDWmxwM58nsLft8AOWaZQ==,iv:9ceK5agzww4oLflAjrdrX6bdP+om4n2BSjZb4cyEVyo=,tag:qg4PIzK1/xLLSjrdJRMgGQ==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:7jn/yVlcSyr4Yg9G60ufzNI4e5Y=,iv:xvlOl6iG06qWL8YYbgqZ7GeY67MfCVGxBw9YFvmPGrg=,tag:qMJpRalU7nm1c5kKK32aUw==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:vpyIpvVUJAxmp2NNih9+fNLzybs+O1IJpQ2sxsh3tWRdDRQ0gAoF0A==,iv:/aRx91r1sAg2EavKUW/xlSMLe2RTRlPqpZcow2ZdFyk=,tag:afX7oB6jtOSZopobXXlNgQ==,type:str]
 sops:
     age:
         - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1MFk4SG8xUmpYd2dPU1Nq
-            RWpOMWQrSkRXTjZzSkZVOWJIdGdJZ3hSNnlVClhBaWc2NjJkaFFheTZxL2IwRWw4
-            SGp0eWR1RDI0ckx3MWNLY0M2dG14T2sKLS0tIGczVXg1ZnZRTXIvNHZjaWVmQk95
-            SXE1RGJyOVFhQ0NnUkkwNkFkNEI5Yk0KrqnQ3qUem0Vk1Wepr4oTcrVRNm2K5h8s
-            IAo92Tq7NA3w73z5ihFOcsUMO3JG0qZRJSkmamfc2omi5WlkY/ZLnw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByRDhINUFWQmpqU3FZYjI4
+            aGt6RHgwZGhBczVnSDd4WUlKYUFZYWwzdGhZClhSeGZzN3FacUZLNytYMmlZbzZQ
+            NlJHRlFLYzhGeXVQSHhnd1JMVzM3Z2sKLS0tIGFWdGluVllpMDhQWVBNVGpCeTZu
+            OXZFeUI0S1RwQ1pOWkNwRkVjTkJBTk0KkJRTInD67EBbUIpeJqknygJJ5wI+uq59
+            EX64TjZ3rlCbwqwb9fhXMP2urPAfL4FZn5urGjA+E1cxsITezQoZAw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:43Z"
-    mac: ENC[AES256_GCM,data:UTajx+N1T/heelIZSaJdBr732PACcJAS4c0ghu79wHkWXtfUuRLtpd/4lCCFbToaBlX7fHsQKb/DDX5pUNhBwGCuRMBXSHKf8HSDvOUIVlMeBH+HbiDSdUvrhJX5KDD+5DLgmLcPis8sLG5nBSM1n6rkC84KQcyG3aZpJgJRPSE=,iv:DkUkP+v/1EMo2WhpVRGsgAFPEALKuH7G2BSG1qRfvBM=,tag:NMhFppGT1bvqiWChIIDeHg==,type:str]
+    lastmodified: "2026-08-26T10:24:51Z"
+    mac: ENC[AES256_GCM,data:d3edCfrD+Tz6WtlqA6VSSlI2IPbmmptvgokm8V4uoCzLJ6BKiFURcNX876rnCvxe30TT04hsh38C4jlfX1ordMv5yhN/7k/wvA5AAvAs08cilXYxwsJ4tbkd3YF5fY8jkYa8AfsH9b2b0Dj8rjKv4AyJ/s5KI8qNVw0WpyWDpnA=,iv:wP7IMRE/MHKf2pdo3Gqb0OR530fsPw6K2uJUNgmCJos=,tag:YvxS6xlRgjSoUTL/d3zCFg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0