apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: s3-backup-proxy
  namespace: longhorn-system
spec:
  interval: 10m
  chartRef:
    kind: OCIRepository
    name: s3-backup-proxy
  driftDetection:
    mode: enabled
  values:
    controllers:
      app:
        containers:
          app:
            image:
              repository: rclone/rclone
              tag: "1.75.0"
            command:
              - sh
              - -c
              - |
                set -eu
                # crypt's password/password2 must be stored "obscured" (rclone's
                # reversible obfuscation, not real encryption on its own - the
                # actual protection is the passphrase's entropy). Generating it
                # here at startup from the plaintext secret env vars means the
                # real secret only ever needs to exist as one sops-encrypted
                # k8s Secret, never hand-obscured and pasted into git.
                CRYPT_PASSWORD_OBS=$(rclone obscure "$CRYPT_PASSWORD")
                CRYPT_PASSWORD2_OBS=$(rclone obscure "$CRYPT_PASSWORD2")
                cat > /tmp/rclone.conf <<EOF
                [wasabi]
                type = s3
                provider = Wasabi
                access_key_id = ${WASABI_ACCESS_KEY_ID}
                secret_access_key = ${WASABI_SECRET_ACCESS_KEY}
                endpoint = s3.eu-central-1.wasabisys.com
                region = eu-central-1

                [crypt]
                type = crypt
                remote = wasabi:kubebackup
                password = ${CRYPT_PASSWORD_OBS}
                password2 = ${CRYPT_PASSWORD2_OBS}
                filename_encryption = standard
                directory_name_encryption = true
                EOF
                exec rclone serve s3 crypt: \
                  --config /tmp/rclone.conf \
                  --addr :8080 \
                  --auth-key "${PROXY_ACCESS_KEY},${PROXY_SECRET_KEY}"
            env:
              WASABI_ACCESS_KEY_ID:
                valueFrom:
                  secretKeyRef:
                    name: s3-backup-proxy-secrets
                    key: WASABI_ACCESS_KEY_ID
              WASABI_SECRET_ACCESS_KEY:
                valueFrom:
                  secretKeyRef:
                    name: s3-backup-proxy-secrets
                    key: WASABI_SECRET_ACCESS_KEY
              CRYPT_PASSWORD:
                valueFrom:
                  secretKeyRef:
                    name: s3-backup-proxy-secrets
                    key: CRYPT_PASSWORD
              CRYPT_PASSWORD2:
                valueFrom:
                  secretKeyRef:
                    name: s3-backup-proxy-secrets
                    key: CRYPT_PASSWORD2
              PROXY_ACCESS_KEY:
                valueFrom:
                  secretKeyRef:
                    name: s3-backup-proxy-secrets
                    key: PROXY_ACCESS_KEY
              PROXY_SECRET_KEY:
                valueFrom:
                  secretKeyRef:
                    name: s3-backup-proxy-secrets
                    key: PROXY_SECRET_KEY
            probes:
              liveness:
                enabled: true
              readiness:
                enabled: true

    service:
      app:
        controller: app
        ports:
          http:
            port: 8080