fix(backup): log redaction leaked credentials — strip userinfo correctly

The previous redaction (${PG_URL%%@*@}) never matched when the URL has a single @, so the full DSN (user:password@host) went to the log/journal. Now: scheme + ***:***@ + hostport/db only. Found during the point-3 E2E test; the leaked value in that transcript was the already-public test DB credential (itest probe DB).
Merge PR #16 : chequeo de frescura de backups
2026-10-28 21:10:47 +00:00 · 2026-10-28 21:10:08 +00:00 · 2026-10-28 21:09:59 +00:00
2 changed files with 36 additions and 1 deletions
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# check-backup-freshness — alert if the newest backup is older than 26h.
+#
+# Exit 0 = fresh (or no backups ever made and NONE expected yet)
+# Exit 1 = stale: last backup dir older than MAX_HOURS, or no dir at all
+#          while the age recipient is configured (backups should exist).
+#
+# Wire it anywhere you like (cron, another timer, or run manually from the
+# Mac after the daily pull). Not attached to any timer by itself — the only
+# authorized timer in Tanda B is cayce-backup.timer.
+set -euo pipefail
+
+BACKUP_ROOT="/var/backups/cayce"
+MAX_HOURS=26
+RECIPIENT_FILE="/etc/cayce-backup/age-recipient.pub"
+
+newest="$(find "$BACKUP_ROOT" -mindepth 1 -maxdepth 1 -type d -name "2*-*-*" 2>/dev/null | sort | tail -1 || true)"
+
+if [[ -z "$newest" ]]; then
+  if [[ -f "$RECIPIENT_FILE" ]]; then
+    echo "ALERT: no backups exist although the age recipient is configured" >&2
+    exit 1
+  fi
+  echo "INFO: no backups yet (age recipient not configured) — nothing to alert"
+  exit 0
+fi
+
+hours=$(( ( $(date +%s) - $(stat -c %Y "$newest") ) / 3600 ))
+if (( hours > MAX_HOURS )); then
+  echo "ALERT: last backup ($newest) is ${hours}h old (max ${MAX_HOURS}h)" >&2
+  exit 1
+fi
+echo "OK: last backup ($newest) is ${hours}h old"
@@ -61,7 +61,9 @@ if [[ -z "$DB_URL" && -r "$ENV_FILE" ]]; then
 fi
 [[ -n "$DB_URL" ]] || die "no CAYCE_OPS_DATABASE_URL in env or $ENV_FILE"
 PG_URL="$(printf "%s" "$DB_URL" | sed -E "s#postgresql\+[a-z]+://#postgresql://#")"
-log "dumping database from ${PG_URL%%@*@}***@..."
+_scheme="${PG_URL%%://*}"
+_hostpart="${PG_URL#**@}"
+log "dumping database from ${_scheme}://***:***@${_hostpart}"
 pg_dump "$PG_URL" --format=custom --file "$TMP/cayce-ops-db.dump"
 encrypt "$TMP/cayce-ops-db.dump" "cayce-ops-db.dump.age"
 log "database dump: $(du -h "$TMP/cayce-ops-db.dump" | cut -f1) plaintext, encrypted ok"