jensandClaude Sonnet 5
e9b51dbffe
Every script/config built this session (sanity-check, attacker-check, the Gitea backup pipeline on both ends) now lives in this repo as reference copies, not just described in prose - previously they only existed on the live servers. Split into scripts/alpha/ (Ubuntu 24.04.4 LTS) and scripts/clients/vlda-01/ (Unraid 7.3.2), each with its own README stating the exact OS/kernel and a file-by-file map to deployed paths, since a script written for one host's conventions doesn't just work unchanged on the other - the vlda-01 README in particular documents the persistence gotchas that actually broke earlier attempts (RAM- backed root filesystem, VFAT /boot with no execute bit, Unassigned Device auto-mount). Root README.md now links directly to these files from each relevant section instead of only describing them. Explicitly not included: the dedicated SSH private key vlda-01 uses to authenticate to alpha - noted in clients/vlda-01/README.md to regenerate rather than ever commit one. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
39 lines
1.7 KiB
Bash
39 lines
1.7 KiB
Bash
#!/bin/bash
|
|
# Nightly Gitea backup (alpha.jayfield.org side of the alpha -> vlda-01
|
|
# backup strategy, see SYNC-PLAN.md "Ongoing backup" section).
|
|
#
|
|
# Uses `gitea dump` rather than a raw copy of /srv/gitea/data, since the
|
|
# DB is a live SQLite file - dumping gives one consistent archive instead
|
|
# of risking a torn mid-write copy. vlda-01 pulls the result on its own
|
|
# schedule; this script only produces and prunes local archives.
|
|
|
|
set -u
|
|
BACKUP_DIR=/srv/gitea/data/backups
|
|
KEEP=14
|
|
FILE="gitea-dump-$(date +%Y%m%d-%H%M%S).zip"
|
|
|
|
if ! docker exec -u git gitea gitea dump -f "/data/backups/${FILE}" --skip-index -q; then
|
|
echo "$(date -Is) ERROR: gitea dump failed, see above" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# vlda-01 verifies integrity before deleting its remote (alpha-side) copy
|
|
cd "$BACKUP_DIR" || exit 1
|
|
sha256sum "$FILE" > "${FILE}.sha256"
|
|
|
|
# the giteabackup SFTP account (see sshd Match Group sftp) needs read
|
|
# access to pull these - default ACL inheritance alone isn't enough, the
|
|
# file's own restrictive mask neutralizes the inherited grant, so set it
|
|
# explicitly on every new file (both the dump and its checksum)
|
|
setfacl -m u:giteabackup:r "${BACKUP_DIR}/${FILE}"
|
|
setfacl -m u:giteabackup:r "${BACKUP_DIR}/${FILE}.sha256"
|
|
|
|
# prune to the last $KEEP archives (safety net only - in normal operation
|
|
# vlda-01 deletes each dump right after a verified pull, well before this
|
|
# would ever trigger; this just bounds disk use if it's offline a while)
|
|
ls -1t gitea-dump-*.zip 2>/dev/null | tail -n +$((KEEP + 1)) | while read -r old; do
|
|
rm -f "$old" "${old}.sha256"
|
|
done
|
|
|
|
echo "$(date -Is) backup complete: ${FILE} ($(du -h "${BACKUP_DIR}/${FILE}" 2>/dev/null | cut -f1)), $(ls -1 gitea-dump-*.zip 2>/dev/null | wc -l) archive(s) retained"
|