Add Velero configuration files and update production kustomization

apps/base/velero/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: velero
+
+resources:
+  - namespace.yaml
+  - repository.yaml

apps/base/velero/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: velero

apps/base/velero/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: velero-helm-repo
+  namespace: velero
+spec:
+  interval: 1h
+  url: https://vmware-tanzu.github.io/helm-charts

apps/prod/kustomization.yaml

@@ -7,4 +7,5 @@ resources:
   - lemma
   - ghost
   - dashboard
-  - homelab-proxy
+  - homelab-proxy
+  - velero

apps/prod/velero/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: velero
+
+resources:
+  - ../../base/velero
+  - secret.yaml
+  - release.yaml
+
+configMapGenerator:
+  - name: velero-prod-values
+    namespace: velero
+    files:
+      - values.yaml
+
+configurations:
+  - kustomizeconfig.yaml

apps/prod/velero/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+- kind: ConfigMap
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease

apps/prod/velero/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: velero
+  namespace: velero
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: velero
+      version: 10.1.0
+      sourceRef:
+        kind: HelmRepository
+        name: velero-helm-repo
+        namespace: velero
+  valuesFrom:
+    - kind: ConfigMap
+      name: velero-prod-values
+      valuesKey: values.yaml

apps/prod/velero/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: velero-s3-credentials
+    namespace: velero
+stringData:
+    cloud: ENC[AES256_GCM,data:xe/0WSMf6xzPQiz5Ob+JOeJWU2lG8kkLilMRkmpxKYYLTavluSc6DTR/M80wIs5pQXyeFOSkmvpubViNvn1FernbI/Fjh8FGRdHASLugdsH4b95rQdKj17gC7sdZu+l1cHVwz3oqycNYWf2qYNykbA==,iv:JGo2jHko1yUWsMsrOjzY1+3g7s3VV3oUqWtVXKDfUU0=,tag:L+rNbm9x05BSxq2NeJR6Vw==,type:str]
+sops:
+    age:
+        - recipient: age1jk99rtxq3ep2xj2w886cchddf7jypqpwkr3dszg5dzq93gn8cy9qyc786m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYaVgvYmtTSEFjYk4yeWox
+            bGdsc2x3VHh0ODBlamZJSnl4NXNoQ1BRclI4CjdUZkt6NVprM3orUkNIKzZIdnBl
+            MzNxKzFpY29ubjJ3Z0hJYm05VDdBRjgKLS0tIEo2Y0JWMitJZkVQRmhjSkR2cjdY
+            SnBPbHFIQWc1NjBGbmR1eXdSYUNGR2cK8zkfj54jgv5tLMKHfOci6tBkTVDUbBFO
+            NTRucXIRfNu8HMaH5jSP+VlSDrheXm3p4Rdx2jLoPmJKnhmw+PNhmA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-08-30T13:21:34Z"
+    mac: ENC[AES256_GCM,data:cmKct89oRyL7DMtithkIngxnODAfRh9I0HjvaY65UCfaEAao8+VWewa/dOXjX55YDFLDC5I92DvUD796k/NOLdZnznGmq0cix73W119LmwXxsen7WM2BIvt+ziS8MvjaQrZ84R1Q/jtRxIMD4AD1cyhkcg3OwgSAPRsa85bdZhQ=,iv:QFUGHgo4zu05HUZa+wCg3E9IWXKnX6G1KW1df4ftSKQ=,tag:CB8jnAKMXF77HprABNG/pw==,type:str]
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.10.2

apps/prod/velero/values.yaml

@@ -0,0 +1,39 @@
+snapshotsEnabled: false
+deployNodeAgent: true
+configuration:
+  backupStorageLocation:
+  - name: scaleway
+    provider: velero.io/aws
+    default: true
+    bucket: ${VELERO_BUCKET}
+    config:
+      region: ${VELERO_REGION}
+      s3Url: https://s3.${VELERO_REGION}.scw.cloud
+
+  defaultVolumesToFsBackup: true
+  
+schedules:
+  daily-backup:
+    schedule: "0 2 * * *"
+    template:
+      includedNamespaces:
+        - gitea
+      storageLocation: default
+      ttl: "168h"
+      includedResources:
+        - persistentvolumeclaims
+        - persistentvolumes
+      labels:
+        type: scheduled
+        period: daily
+
+credentials:
+  existingSecret: velero-s3-credentials
+
+initContainers:
+  - name: velero-plugin-for-aws
+    image: velero/velero-plugin-for-aws:v1.12.2
+    imagePullPolicy: IfNotPresent
+    volumeMounts:
+      - mountPath: /target
+        name: plugins