jens/docs-alpha.jayfield.org
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check in scripts/configs, organized and documented by host OS

Browse Source 
Every script/config built this session (sanity-check, attacker-check,
the Gitea backup pipeline on both ends) now lives in this repo as
reference copies, not just described in prose - previously they only
existed on the live servers.

Split into scripts/alpha/ (Ubuntu 24.04.4 LTS) and
scripts/clients/vlda-01/ (Unraid 7.3.2), each with its own README
stating the exact OS/kernel and a file-by-file map to deployed paths,
since a script written for one host's conventions doesn't just work
unchanged on the other - the vlda-01 README in particular documents
the persistence gotchas that actually broke earlier attempts (RAM-
backed root filesystem, VFAT /boot with no execute bit, Unassigned
Device auto-mount). Root README.md now links directly to these files
from each relevant section instead of only describing them.

Explicitly not included: the dedicated SSH private key vlda-01 uses to
authenticate to alpha - noted in clients/vlda-01/README.md to
regenerate rather than ever commit one.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
jens
2026-07-26 17:21:05 +02:00
co-authored by Claude Sonnet 5
parent e88b815775
commit e9b51dbffe
16 changed files with 869 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+18
View File
@@ -46,6 +46,10 @@ now fully resolved, see `TODO.md`.
## Post-boot sanity check
Checked into this repo: [`scripts/alpha/sanity-check.sh`](scripts/alpha/sanity-check.sh) /
[`scripts/alpha/sanity-check.service`](scripts/alpha/sanity-check.service)
(Ubuntu 24.04 — see `scripts/alpha/README.md`).
`/usr/local/sbin/sanity-check.sh` (added 2026-07-26, after the 24.04
upgrade turned up two real post-upgrade breakages — see `TODO.md`) checks
that the whole stack is actually healthy, not just "systemd says active":
@@ -73,6 +77,10 @@ routine pending package upgrades, don't fail the run).
## Weekly attacker summary
Checked into this repo: [`scripts/alpha/attacker-check.py`](scripts/alpha/attacker-check.py) /
[`scripts/alpha/cron.d/attacker-check`](scripts/alpha/cron.d/attacker-check)
(Ubuntu 24.04 — see `scripts/alpha/README.md`).
`/usr/local/sbin/attacker-check.py` (added 2026-07-26) parses
`fail2ban.log` (current + recent rotations, gzipped or not — reads enough
history to cover a full week regardless of exactly when logrotate's daily
@@ -354,6 +362,16 @@ Internet → Apache :80/:443 (git.jayfield.org vhost)
### Gitea backup to `vlda-01` (`SYNC-PLAN.md` item 2b)
Checked into this repo, split by which host each half runs on (they're on
different OSes with different conventions — see each `README.md`):
- Alpha side (Ubuntu 24.04): [`scripts/alpha/gitea-backup.sh`](scripts/alpha/gitea-backup.sh) /
[`scripts/alpha/cron.d/gitea-backup`](scripts/alpha/cron.d/gitea-backup)
— see `scripts/alpha/README.md`.
- `vlda-01` side (Unraid 7.3.2): [`scripts/clients/vlda-01/`](scripts/clients/vlda-01/)
— see `scripts/clients/vlda-01/README.md`, which also covers the
Unraid-specific persistence gotchas (RAM-backed root, VFAT `/boot`,
Unassigned Devices) that shaped how this had to be built.
Built 2026-07-26. A point-in-time backup, not a hot standby/live mirror —
now that alpha is the canonical live Gitea, this keeps `vlda-01`'s copy
from just going stale after the migration. Same network direction as