rclone s3 proxy

2026-08-11 21:34:21 +03:00
parent 3a0a00f994
commit be53f040c7
13 changed files with 222 additions and 63 deletions
@@ -0,0 +1,97 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: s3-backup-proxy
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: rclone/rclone
+              tag: "1.75.0"
+            command:
+              - sh
+              - -c
+              - |
+                set -eu
+                # crypt's password/password2 must be stored "obscured" (rclone's
+                # reversible obfuscation, not real encryption on its own - the
+                # actual protection is the passphrase's entropy). Generating it
+                # here at startup from the plaintext secret env vars means the
+                # real secret only ever needs to exist as one sops-encrypted
+                # k8s Secret, never hand-obscured and pasted into git.
+                CRYPT_PASSWORD_OBS=$(rclone obscure "$CRYPT_PASSWORD")
+                CRYPT_PASSWORD2_OBS=$(rclone obscure "$CRYPT_PASSWORD2")
+                cat > /tmp/rclone.conf <<EOF
+                [wasabi]
+                type = s3
+                provider = Wasabi
+                access_key_id = ${WASABI_ACCESS_KEY_ID}
+                secret_access_key = ${WASABI_SECRET_ACCESS_KEY}
+                endpoint = s3.eu-central-1.wasabisys.com
+                region = eu-central-1
+
+                [crypt]
+                type = crypt
+                remote = wasabi:kubebackup
+                password = ${CRYPT_PASSWORD_OBS}
+                password2 = ${CRYPT_PASSWORD2_OBS}
+                filename_encryption = standard
+                directory_name_encryption = true
+                EOF
+                exec rclone serve s3 crypt: \
+                  --config /tmp/rclone.conf \
+                  --addr :8080 \
+                  --auth-key "${PROXY_ACCESS_KEY},${PROXY_SECRET_KEY}"
+            env:
+              WASABI_ACCESS_KEY_ID:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_ACCESS_KEY_ID
+              WASABI_SECRET_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_SECRET_ACCESS_KEY
+              CRYPT_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD
+              CRYPT_PASSWORD2:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD2
+              PROXY_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_ACCESS_KEY
+              PROXY_SECRET_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_SECRET_KEY
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8080