jacobh2/kvitt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M2c-pi: Pi bundle (infra/pi), cert-sync, Drive backup upload, Gitea workflow

Browse Source 
The owner copies infra/pi/ to the Kvitt Pi and runs it there (D-100); nothing
on the Mac connects to the Pis. compose stack of SPEC §10.2 with images
${KVITT_REGISTRY}/kvitt-{server,cert-sync,backup}, Caddyfile §10.5.2 verbatim,
.env.example with the OQ-3 values as CHANGE_ME placeholders, install.sh,
deploy.sh (backup before every deploy), bootstrap.sh, backup-now.sh,
install-apk.sh. cert-sync image and sync.sh (§10.5.1, tar stream for both
authorized_keys variants); backup.sh uploads with rclone copy --immutable and
deletes local files once both are confirmed on Drive (D-002); both sidecars
schedule with supercronic because busybox crond runs no jobs as non-root;
backup runs as uid 10001. .gitea/workflows/build-images.yaml from the owner's
example (not yet run); infra/build-images.sh and infra/publish-apk.sh (R8
mapping kept, version per §10.6) on the Mac; README checklist and RESTORE.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
This commit is contained in:
Jacob Hagstedt
2026-10-18 21:46:44 +02:00
parent bfc3acbbe0
commit 2476667510
21 changed files with 1409 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/backup/Dockerfile
+16 -9
View File
@@ -1,20 +1,27 @@
# Kvitt backup job image (SPEC §10.3, §10.9): alpine with sqlite, gzip, tar, rclone and backup.sh run by crond.
# Kvitt backup job image (SPEC §10.3, §10.9): alpine with sqlite, gzip, tar, rclone and backup.sh on a daily schedule.
# Versions resolved 2026-10-17: alpine 3.24.2 (Docker Hub official image, multi-arch index digest below);
# packages from Alpine v3.24 main/community: sqlite 3.53.4, rclone 1.74.1, tar 1.35, tzdata 2026e.
# packages from Alpine v3.24 main/community: sqlite 3.53.4, rclone 1.74.1, tar 1.35, tzdata 2026e;
# 2026-10-18: supercronic 0.2.49.
# The scheduler is supercronic, not busybox crond: on the Pi the container runs as uid 10001, not root (README,
# "Backup uid"), and busybox crond cannot run jobs as a non-root user (checked 2026-10-18). See D-104.
FROM docker.io/library/alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6
RUN apk add --no-cache \
"sqlite~3.53" \
"rclone~1.74" \
"tar~1.35" \
"supercronic~0.2" \
gzip \
tzdata
tzdata \
&& adduser -D -u 10001 -g "Kvitt backup" kvitt \
&& mkdir -p /backups /data \
&& chown 10001:10001 /backups /data
COPY backup.sh /backup.sh
RUN chmod 0755 /backup.sh \
&& echo '30 3 * * * /backup.sh' > /etc/crontabs/root
COPY backup.sh healthcheck.sh /
RUN chmod 0755 /backup.sh /healthcheck.sh \
&& echo '30 3 * * * /backup.sh' > /etc/kvitt-backup.crontab
ENV TZ=Europe/Stockholm
# Daily at 03:30 Europe/Stockholm. The development stack runs it on demand instead
# (`docker compose run --rm backup /backup.sh`, see infra/README.md).
CMD ["crond", "-f", "-l", "8"]
# Daily at 03:30 Europe/Stockholm; /tmp/kvitt-started feeds the healthcheck's "no run yet since start".
# The development stack runs it on demand instead (`docker compose run --rm backup /backup.sh`, see infra/README.md).
CMD ["sh", "-c", "date +%s > /tmp/kvitt-started && exec supercronic -quiet /etc/kvitt-backup.crontab"]