From 6b30958a24a432ca745a82b31aeb073d827485ab Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 15 Aug 2026 12:06:30 +1000
Subject: [PATCH] jellyfin: add cephrgw config-backup bucket for k8up

Give the jellyfin backup user a second bucket so k8up can store restic
backups of the jellyfin-config PVC alongside the existing CNPG barman
bucket (one user, two buckets).

- Add a jellyfin-config-backup Bucket owned by the existing
  cnpg-jellyfin-backup ObjectStoreUser
- Add a read-write BucketAccess emitting jellyfin-config-backup-s3 with
  the S3 creds k8up consumes
- Wire the new file into the jellyfin kustomization
---
 apps/base/jellyfin/cephrgw-config-backup.yaml | 32 +++++++++++++++++++
 apps/base/jellyfin/kustomization.yaml         |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 apps/base/jellyfin/cephrgw-config-backup.yaml

diff --git a/apps/base/jellyfin/cephrgw-config-backup.yaml b/apps/base/jellyfin/cephrgw-config-backup.yaml
new file mode 100644
index 0000000..14ad7ed
--- /dev/null
+++ b/apps/base/jellyfin/cephrgw-config-backup.yaml
@@ -0,0 +1,32 @@
+---
+# Second Ceph RGW (S3) bucket owned by the existing jellyfin backup user
+# (cnpg-jellyfin-backup, defined in cnpg_backup.yaml) — one user, two buckets:
+# the CNPG barman bucket plus this one, which k8up uses to hold restic backups
+# of the jellyfin-config PVC. The BucketAccess emits read-write S3 creds into a
+# Secret the k8up Schedule consumes.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: jellyfin-config-backup
+  namespace: jellyfin
+spec:
+  placementTarget: ec
+  bucketName: jellyfin-config-backup
+  ownerRef: cnpg-jellyfin-backup
+  versioning: false
+  tags:
+    app: jellyfin
+    purpose: config-backup
+  retainOnDelete: true
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: BucketAccess
+metadata:
+  name: jellyfin-config-backup
+  namespace: jellyfin
+spec:
+  bucketRef: jellyfin-config-backup
+  level: read-write
+  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ S3_ENDPOINT,
+  # BUCKET_NAME) into this Secret; the k8up Schedule reads the access keys.
+  secretName: jellyfin-config-backup-s3
diff --git a/apps/base/jellyfin/kustomization.yaml b/apps/base/jellyfin/kustomization.yaml
index 2c4117d..edab63d 100644
--- a/apps/base/jellyfin/kustomization.yaml
+++ b/apps/base/jellyfin/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
   - cnpg_backup.yaml
+  - cephrgw-config-backup.yaml
   - pvc-config.yaml
   - pvc-transcode.yaml
   - pvc-media-tv.yaml