M2c-pi: Pi bundle (infra/pi), cert-sync, Drive backup upload, Gitea workflow
The owner copies infra/pi/ to the Kvitt Pi and runs it there (D-100); nothing
on the Mac connects to the Pis. compose stack of SPEC §10.2 with images
${KVITT_REGISTRY}/kvitt-{server,cert-sync,backup}, Caddyfile §10.5.2 verbatim,
.env.example with the OQ-3 values as CHANGE_ME placeholders, install.sh,
deploy.sh (backup before every deploy), bootstrap.sh, backup-now.sh,
install-apk.sh. cert-sync image and sync.sh (§10.5.1, tar stream for both
authorized_keys variants); backup.sh uploads with rclone copy --immutable and
deletes local files once both are confirmed on Drive (D-002); both sidecars
schedule with supercronic because busybox crond runs no jobs as non-root;
backup runs as uid 10001. .gitea/workflows/build-images.yaml from the owner's
example (not yet run); infra/build-images.sh and infra/publish-apk.sh (R8
mapping kept, version per §10.6) on the Mac; README checklist and RESTORE.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
This commit is contained in:
+16
-9
@@ -1,20 +1,27 @@
|
||||
# Kvitt backup job image (SPEC §10.3, §10.9): alpine with sqlite, gzip, tar, rclone and backup.sh run by crond.
|
||||
# Kvitt backup job image (SPEC §10.3, §10.9): alpine with sqlite, gzip, tar, rclone and backup.sh on a daily schedule.
|
||||
# Versions resolved 2026-10-17: alpine 3.24.2 (Docker Hub official image, multi-arch index digest below);
|
||||
# packages from Alpine v3.24 main/community: sqlite 3.53.4, rclone 1.74.1, tar 1.35, tzdata 2026e.
|
||||
# packages from Alpine v3.24 main/community: sqlite 3.53.4, rclone 1.74.1, tar 1.35, tzdata 2026e;
|
||||
# 2026-10-18: supercronic 0.2.49.
|
||||
# The scheduler is supercronic, not busybox crond: on the Pi the container runs as uid 10001, not root (README,
|
||||
# "Backup uid"), and busybox crond cannot run jobs as a non-root user (checked 2026-10-18). See D-104.
|
||||
FROM docker.io/library/alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
|
||||
|
||||
RUN apk add --no-cache \
|
||||
"sqlite~3.53" \
|
||||
"rclone~1.74" \
|
||||
"tar~1.35" \
|
||||
"supercronic~0.2" \
|
||||
gzip \
|
||||
tzdata
|
||||
tzdata \
|
||||
&& adduser -D -u 10001 -g "Kvitt backup" kvitt \
|
||||
&& mkdir -p /backups /data \
|
||||
&& chown 10001:10001 /backups /data
|
||||
|
||||
COPY backup.sh /backup.sh
|
||||
RUN chmod 0755 /backup.sh \
|
||||
&& echo '30 3 * * * /backup.sh' > /etc/crontabs/root
|
||||
COPY backup.sh healthcheck.sh /
|
||||
RUN chmod 0755 /backup.sh /healthcheck.sh \
|
||||
&& echo '30 3 * * * /backup.sh' > /etc/kvitt-backup.crontab
|
||||
|
||||
ENV TZ=Europe/Stockholm
|
||||
# Daily at 03:30 Europe/Stockholm. The development stack runs it on demand instead
|
||||
# (`docker compose run --rm backup /backup.sh`, see infra/README.md).
|
||||
CMD ["crond", "-f", "-l", "8"]
|
||||
# Daily at 03:30 Europe/Stockholm; /tmp/kvitt-started feeds the healthcheck's "no run yet since start".
|
||||
# The development stack runs it on demand instead (`docker compose run --rm backup /backup.sh`, see infra/README.md).
|
||||
CMD ["sh", "-c", "date +%s > /tmp/kvitt-started && exec supercronic -quiet /etc/kvitt-backup.crontab"]
|
||||
|
||||
+32
-7
@@ -3,9 +3,11 @@
|
||||
# 1. online, consistent snapshot of /data/kvitt.sqlite with sqlite3 .backup
|
||||
# 2. PRAGMA integrity_check on the snapshot must print ok, else abort
|
||||
# 3. gzip -9 the snapshot and tar the pictures, both with the same UTC stamp
|
||||
# 4. Drive upload: skipped when RCLONE_FOLDER_ID is empty (the development stack, D-001);
|
||||
# the upload itself and the D-002 local deletion are built by M2c-pi
|
||||
# 5. write /backups/last-success with the stamp
|
||||
# 4. Drive upload when RCLONE_FOLDER_ID is set (the Pi): rclone copy --immutable of every kvitt-*.sqlite.gz and
|
||||
# pictures-*.tar.gz in /backups (this run's pair and any left by an earlier failed upload), never sync, never
|
||||
# delete on Drive; once every file is confirmed on Drive with rclone lsf (name and size) the local copies are
|
||||
# deleted (D-002). Skipped with a log line when RCLONE_FOLDER_ID is empty (the development stack, D-001): files kept.
|
||||
# 5. write /backups/last-success with the stamp (only after this run's pair is confirmed on Drive, when uploading)
|
||||
# Logs carry file names and sizes only, never database content (SPEC §8.7).
|
||||
set -eu
|
||||
|
||||
@@ -44,13 +46,36 @@ fi
|
||||
mv "$pics_out.tmp" "$pics_out"
|
||||
log "wrote $(basename "$db_out") ($(wc -c < "$db_out") bytes) and $(basename "$pics_out") ($(wc -c < "$pics_out") bytes)"
|
||||
|
||||
# 4. Drive upload
|
||||
# 4. Drive upload (D-002)
|
||||
if [ -z "${RCLONE_FOLDER_ID:-}" ]; then
|
||||
log "RCLONE_FOLDER_ID is empty: Drive upload skipped, local files kept"
|
||||
else
|
||||
# TODO(M2c-pi): rclone copy --immutable to "${RCLONE_REMOTE:-gdrive:}" --drive-root-folder-id, confirm with
|
||||
# rclone lsf, then delete the local files (D-002). Not part of the development stack (D-001).
|
||||
fail "RCLONE_FOLDER_ID is set but the Drive upload is not built yet (M2c-pi); local files kept"
|
||||
remote=${RCLONE_REMOTE:-gdrive:}
|
||||
conf_src=${RCLONE_CONFIG_SOURCE:-/config/rclone/rclone.conf}
|
||||
[ -r "$conf_src" ] || fail "no readable rclone config at $conf_src; local files kept"
|
||||
# rclone writes refreshed access tokens back to its config; the mounted one is read-only, so use a private copy.
|
||||
conf=$(mktemp)
|
||||
cp "$conf_src" "$conf"
|
||||
export RCLONE_CONFIG="$conf"
|
||||
trap 'rm -f "$conf"' EXIT
|
||||
confirmed=""
|
||||
for f in "$BACKUP_DIR"/kvitt-*.sqlite.gz "$BACKUP_DIR"/pictures-*.tar.gz; do
|
||||
[ -f "$f" ] || continue
|
||||
name=$(basename "$f")
|
||||
size=$(wc -c < "$f" | tr -d ' ')
|
||||
rclone copy "$f" "$remote" --drive-root-folder-id "$RCLONE_FOLDER_ID" --immutable --retries 3 --stats 0 --log-level ERROR \
|
||||
|| fail "rclone copy of $name failed; local files kept"
|
||||
listed=$(rclone lsf "$remote" --drive-root-folder-id "$RCLONE_FOLDER_ID" --files-only --format sp --separator ' ' \
|
||||
--include "/$name" --log-level ERROR) || fail "rclone lsf could not confirm $name; local files kept"
|
||||
[ "$listed" = "$size $name" ] || fail "$name is not on Drive with $size bytes; local file kept"
|
||||
log "uploaded and confirmed on Drive: $name ($size bytes)"
|
||||
confirmed="$confirmed $f"
|
||||
done
|
||||
# Every file is confirmed on Drive: delete the local copies (D-002). Nothing on Drive is ever deleted.
|
||||
for f in $confirmed; do rm -f "$f"; done
|
||||
log "local copies deleted after Drive confirmation"
|
||||
rm -f "$conf"
|
||||
trap - EXIT
|
||||
fi
|
||||
|
||||
# 5. Success marker
|
||||
|
||||
Executable
+14
@@ -0,0 +1,14 @@
|
||||
#!/bin/sh
|
||||
# backup healthcheck (SPEC §10.2): healthy when /backups/last-success is newer than 26 hours, or when no run is due
|
||||
# yet since the container started (started less than 26 hours ago).
|
||||
limit=$((26 * 3600))
|
||||
now=$(date +%s)
|
||||
marker=${BACKUP_DIR:-/backups}/last-success
|
||||
if [ -f "$marker" ] && [ $((now - $(stat -c %Y "$marker"))) -lt "$limit" ]; then
|
||||
exit 0
|
||||
fi
|
||||
if [ -f /tmp/kvitt-started ] && [ $((now - $(cat /tmp/kvitt-started))) -lt "$limit" ]; then
|
||||
exit 0
|
||||
fi
|
||||
echo "no successful backup in the last 26 hours"
|
||||
exit 1
|
||||
Reference in New Issue
Block a user