4 Commits

Include renames

Author	SHA1	Message	Date
cayce	df36126617	backup: freshness check — alert when last backup is older than 26h (Tanda B, point 4) ... /usr/local/bin/cayce-check-backup-freshness (from deploy/backup/check-freshness.sh): exits 1 if the newest /var/backups/cayce/YYYY-MM-DD/ dir has mtime older than 26h, or if no backups exist while the age recipient IS configured (backups expected). Info-exit-0 when backups have never been configured. Not attached to a timer (only cayce-backup.timer was authorized); documented for manual or cron use. Verified: fresh dir => OK 0h exit 0; dir with 2-day mtime => ALERT 48h exit 1; no-dir + recipient => ALERT; no-dir + no-recipient => INFO.	2026-10-28 21:09:59 +00:00
cayce	d7156358f6	backup: RESTORE.md runbook + E2E restore test evidence (Tanda B, point 3) ... RESTORE.md documents the exact from-zero recovery on a fresh VPS: download+verify (sha256 over encrypted artifacts, no private key needed on the pull side), decrypt on the operator Mac, Postgres pg_restore, Gitea unzip+migrate, Caddy/systemd/.env config restore, repo re-clone, backup pipeline reinstall with the SAME age recipient, and a post-restore checklist. E2E test executed on the VPS (no production touched — cayce-ops has no production DB; a probe DB was created and dropped): - manifest.sha256: 3/3 artifacts OK (verified WITHOUT any private key) - age decrypt roundtrip with a throwaway keypair (destroyed afterwards) - pg_restore TOC valid; full restore into a scratch DB: 5000/5000 rows - gitea zip valid, config tar valid (34 entries) - all test material removed: probe DB dropped, throwaway key deleted, recipient file removed, test backup deleted (was encrypted to the destroyed throwaway key)	2026-10-28 21:07:58 +00:00
cayce	fc2dcd4fca	backup: backup-pull user — read-only rsync-only SSH access (Tanda B, point 2) ... System user backup-pull created on the VPS (no sudo, locked password). authorized_keys restricted with restrict + forced command rrsync -ro /var/backups/cayce. Verified with a since-deleted throwaway key: no shell, no arbitrary commands, no sftp/scp, no reads outside /var/backups/cayce, no writes; the positive rsync pull works. authorized_keys is left EMPTY — the operator adds their real key with the exact line documented in deploy/backup/backup-pull-setup.md.	2026-10-28 21:01:44 +00:00
cayce	b87a51afc0	backup: encrypted daily backups — VPS generates, Mac pulls (Tanda B, point 1) ... deploy/backup/make-backup.sh (installed as /usr/local/bin/cayce-make-backup): - pg_dump custom-format of the cayce-ops DB (URL from env or .env, SQLAlchemy driver qualifier stripped, credentials never logged) - gitea dump (repos + sqlite + attachments), live; consistency notes in RESTORE.md - config tar: Caddyfile(+d), gitea app.ini + internal_token, cayce-* units, .env - EACH artifact encrypted with age BEFORE leaving the tmpdir; recipient read from /etc/cayce-backup/age-recipient.pub (public key only). The private age key never touches this server. - plaintext exists ONLY in a mktemp dir removed by an EXIT trap; a partial day directory is removed on failure; any step failure => exit != 0 => journald entry - manifest.sha256 over the encrypted artifacts (pull side verifies integrity WITHOUT the age private key) - destination /var/backups/cayce/YYYY-MM-DD/ (750 root:backup-pull, 640) - retention: 7 daily dirs, pruned by mtime systemd: cayce-backup.service (oneshot, hardened: ProtectSystem=strict, NoNewPrivileges, ProtectHome=read-only) + cayce-backup.timer (daily 03:15 UTC, Persistent). Timer ENABLED on the VPS per operator instruction; runs fail loudly (exit 1, clear journald message) until the age recipient is provided — that is the designed not-configured state.	2026-10-28 20:59:28 +00:00