rclone s3 proxy

2026-08-11 21:34:21 +03:00
parent 3a0a00f994
commit be53f040c7
13 changed files with 222 additions and 63 deletions
@@ -0,0 +1,97 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: s3-backup-proxy
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: rclone/rclone
+              tag: "1.75.0"
+            command:
+              - sh
+              - -c
+              - |
+                set -eu
+                # crypt's password/password2 must be stored "obscured" (rclone's
+                # reversible obfuscation, not real encryption on its own - the
+                # actual protection is the passphrase's entropy). Generating it
+                # here at startup from the plaintext secret env vars means the
+                # real secret only ever needs to exist as one sops-encrypted
+                # k8s Secret, never hand-obscured and pasted into git.
+                CRYPT_PASSWORD_OBS=$(rclone obscure "$CRYPT_PASSWORD")
+                CRYPT_PASSWORD2_OBS=$(rclone obscure "$CRYPT_PASSWORD2")
+                cat > /tmp/rclone.conf <<EOF
+                [wasabi]
+                type = s3
+                provider = Wasabi
+                access_key_id = ${WASABI_ACCESS_KEY_ID}
+                secret_access_key = ${WASABI_SECRET_ACCESS_KEY}
+                endpoint = s3.eu-central-1.wasabisys.com
+                region = eu-central-1
+
+                [crypt]
+                type = crypt
+                remote = wasabi:kubebackup
+                password = ${CRYPT_PASSWORD_OBS}
+                password2 = ${CRYPT_PASSWORD2_OBS}
+                filename_encryption = standard
+                directory_name_encryption = true
+                EOF
+                exec rclone serve s3 crypt: \
+                  --config /tmp/rclone.conf \
+                  --addr :8080 \
+                  --auth-key "${PROXY_ACCESS_KEY},${PROXY_SECRET_KEY}"
+            env:
+              WASABI_ACCESS_KEY_ID:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_ACCESS_KEY_ID
+              WASABI_SECRET_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_SECRET_ACCESS_KEY
+              CRYPT_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD
+              CRYPT_PASSWORD2:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD2
+              PROXY_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_ACCESS_KEY
+              PROXY_SECRET_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_SECRET_KEY
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8080
@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml
@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: s3-backup-proxy-secrets
+    namespace: longhorn-system
+stringData:
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:rgc0xjmQKckyC6iT5fBP4h8g5uU=,iv:MFuYH2N5Ek+UnQT0B/VEERvHGRywbNLLriQ8ghaZVoE=,tag:iCO6vu3S1vpZRnmPRLZ+Og==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:XUyJjhl8nzzUhHOIISSIFPiWjV9/SxR2U9S92jwG9sZCqPSZY7h33Q==,iv:Z0YDFHAheLzYO8XWA378nrr/4y4IfDRByoPa607Py2A=,tag:Pu6cvQ71jBbqh/jpxjU62Q==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:PSW/dxh8y1BDswEAy1VGwKkmuqr+yXxITkkFq2iL9W+neieuZd4Z2X8LHw==,iv:30ozLFfNQI9NzEdvDhFTJl+X00UiiaFRL+oGqB2eDHk=,tag:f0fgKn8hPZZIsE2KUMi+1A==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:c/MIyhK4yg5wYaB2aZ2b3UYm0T+JJDtMYrDruipP0ZmdmO/sz33EtMNPTg==,iv:YodQc8tXVUBU2Y95lazG3MoawIyAYAPxyGAEP/z9dpY=,tag:AyMDKO1iK1c3l0kMuuxcfQ==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:PVKKx8YBkonrcDMFcEx0KT+UJ+g=,iv:inuyggvzMGgHi6ND8FLC4yT7Tyis98Qkg6XJf1p0/x8=,tag:eU//31BKXe+p+L6G1MxQQw==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:7sWaULr5rjlAj6mUiXjAmE+RgYFRvmTpbqtuG6KfQGrSSgkqkIzD7Q==,iv:pVc3Mec6JkpV8GlHWdZW3t4zM3AnLaFjFFAZRm4HzbQ=,tag:+O645+nh6F3REnplyzFMPg==,type:str]
+sops:
+    age:
+        - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1MFk4SG8xUmpYd2dPU1Nq
+            RWpOMWQrSkRXTjZzSkZVOWJIdGdJZ3hSNnlVClhBaWc2NjJkaFFheTZxL2IwRWw4
+            SGp0eWR1RDI0ckx3MWNLY0M2dG14T2sKLS0tIGczVXg1ZnZRTXIvNHZjaWVmQk95
+            SXE1RGJyOVFhQ0NnUkkwNkFkNEI5Yk0KrqnQ3qUem0Vk1Wepr4oTcrVRNm2K5h8s
+            IAo92Tq7NA3w73z5ihFOcsUMO3JG0qZRJSkmamfc2omi5WlkY/ZLnw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:24:43Z"
+    mac: ENC[AES256_GCM,data:UTajx+N1T/heelIZSaJdBr732PACcJAS4c0ghu79wHkWXtfUuRLtpd/4lCCFbToaBlX7fHsQKb/DDX5pUNhBwGCuRMBXSHKf8HSDvOUIVlMeBH+HbiDSdUvrhJX5KDD+5DLgmLcPis8sLG5nBSM1n6rkC84KQcyG3aZpJgJRPSE=,iv:DkUkP+v/1EMo2WhpVRGsgAFPEALKuH7G2BSG1qRfvBM=,tag:NMhFppGT1bvqiWChIIDeHg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0