feat(chorus): replicate kopiur repository to r2 via chorus

[onedr0p]

Puts the kopia repository behind a chorus S3 proxy so writes land on Garage and are mirrored to Cloudflare R2.

What

• kubernetes/components/dragonfly: reusable Dragonfly component. 2 replicas spread across nodes, auth password minted by an External Secrets Password generator (refreshPolicy: CreatedOnce) into ${APP}-dragonfly-secret, snapshot PVC on miroir-slow, PodMonitor. Image left to the operator default.
• dragonfly-system: dragonfly-operator chart v1.6.1 (ghcr operator image, Grafana dashboard via grafana-operator).
• chorus-system: chorus chart 0.4.0 (appVersion v0.7.9). Garage is main at expanse.internal:9000, R2 is the follower. Proxy runs 2 replicas with hostname anti-affinity and a PDB; worker and UI run 1. Bundled Redis disabled in favour of the Dragonfly component. Metrics and ServiceMonitors enabled. UI exposed at chorus.turbo.ac via envoy-internal.
• Credentials: Garage keys from the kopiur 1Password item, R2 endpoint and keys from kopiur-r2, rendered into chorus's override.yaml so the R2 account endpoint stays out of git.
• kopiur: ClusterRepository endpoint moved to chorus-proxy.chorus-system.svc.cluster.local:9669; kopiur-repository now depends on chorus. Proxy auth reuses the Garage credentials so kopiur's secret is unchanged.
• .mise: chorctl via the github: backend.

Post-merge

Replication policy is runtime state, created once:

export CHORUS_ADDRESS=https://chorus.turbo.ac/api
chorctl repl add -u kopiur -f garage -t r2 -b kopiur

This seeds the existing Garage bucket into the kopiur R2 bucket and enables live replication of writes through the proxy. R2 is only a usable repository once the seed completes.

Notes

• Backups and restores now depend on chorus and Dragonfly being up.
• The chorus management API has no authentication of its own; it is reachable only via the internal gateway.
• Validated with kustomize build on every new directory, helm template against both charts, and kubeconform against the home-operations schemas.

[bot-ross]

Warning

• ClusterRoleBinding dragonfly-operator-manager-clusterrolebinding: new ClusterRoleBinding; grants cluster-wide permissions
• ClusterRoleBinding dragonfly-operator-proxy-clusterrolebinding: new ClusterRoleBinding; grants cluster-wide permissions

Note

+55 added · 2 changed: 57 resources across 6 apps · 1 CRD

Blast radius

• Kustomization dragonfly-system/dragonfly-operator: 2 dependents (chorus-system/chorus +1 more)
• Kustomization chorus-system/chorus: 1 dependent (kopiur-system/kopiur-repository)

image	from	to	upstream
ghcr.io/dragonflydb/operator	∅	v1.6.1	✅
harbor.clyso.com/chorus/proxy	∅	v0.7.9	✅
harbor.clyso.com/chorus/web-ui	∅	v0.7.9	✅
harbor.clyso.com/chorus/worker	∅	v0.7.9	✅
quay.io/brancz/kube-rbac-proxy	∅	v0.20.2	✅

_{konflate 0.6.3 · rendered 784ab9b · full diff →}