cayce/cayce-ops
1
0
Fork 0
Code Issues 1 Pull Requests 25 Actions 5 Packages Projects Releases 2 Wiki Activity

Tanda B punto 1: generación de backups cifrados #13

Open
cayce wants to merge 0 commits from backup-generation into main
pull from: backup-generation
merge into: :main
Conversation 0 Commits - Files Changed -
cayce commented 2026-10-28 20:59:28 +00:00
Owner
Copy Link
Copy Source

Script make-backup.sh + unidades systemd. Cifrado age por artefacto, tmpdir con trap, manifest.sha256 de los ficheros cifrados, retención 7 días. Timer habilitado (03:15 UTC). Falta la pubkey age del operador para la primera ejecución real.

Script make-backup.sh + unidades systemd. Cifrado age por artefacto, tmpdir con trap, manifest.sha256 de los ficheros cifrados, retención 7 días. Timer habilitado (03:15 UTC). Falta la pubkey age del operador para la primera ejecución real.
cayce added 1 commit 2026-10-28 20:59:29 +00:00
backup: encrypted daily backups — VPS generates, Mac pulls (Tanda B, point 1)
ci / lint-test-leaks (pull_request) Canceled after 0s
Details
b87a51afc0 
deploy/backup/make-backup.sh (installed as /usr/local/bin/cayce-make-backup):
- pg_dump custom-format of the cayce-ops DB (URL from env or .env,
  SQLAlchemy driver qualifier stripped, credentials never logged)
- gitea dump (repos + sqlite + attachments), live; consistency notes in RESTORE.md
- config tar: Caddyfile(+d), gitea app.ini + internal_token, cayce-* units, .env
- EACH artifact encrypted with age BEFORE leaving the tmpdir; recipient
  read from /etc/cayce-backup/age-recipient.pub (public key only). The
  private age key never touches this server.
- plaintext exists ONLY in a mktemp dir removed by an EXIT trap; a partial
  day directory is removed on failure; any step failure => exit != 0 =>
  journald entry
- manifest.sha256 over the encrypted artifacts (pull side verifies
  integrity WITHOUT the age private key)
- destination /var/backups/cayce/YYYY-MM-DD/ (750 root:backup-pull, 640)
- retention: 7 daily dirs, pruned by mtime

systemd: cayce-backup.service (oneshot, hardened: ProtectSystem=strict,
NoNewPrivileges, ProtectHome=read-only) + cayce-backup.timer (daily
03:15 UTC, Persistent). Timer ENABLED on the VPS per operator instruction;
runs fail loudly (exit 1, clear journald message) until the age recipient
is provided — that is the designed not-configured state.
Some required checks failed
ci / lint-test-leaks (pull_request) Canceled after 0s
Details
This branch is already included in the target branch. There is nothing to merge.
This branch is out-of-date with the base branch
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin backup-generation:backup-generation
git checkout backup-generation
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
pattern cayce (Cayce)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: cayce/cayce-ops#13