jacobh2
2476667510
The owner copies infra/pi/ to the Kvitt Pi and runs it there (D-100); nothing
on the Mac connects to the Pis. compose stack of SPEC §10.2 with images
${KVITT_REGISTRY}/kvitt-{server,cert-sync,backup}, Caddyfile §10.5.2 verbatim,
.env.example with the OQ-3 values as CHANGE_ME placeholders, install.sh,
deploy.sh (backup before every deploy), bootstrap.sh, backup-now.sh,
install-apk.sh. cert-sync image and sync.sh (§10.5.1, tar stream for both
authorized_keys variants); backup.sh uploads with rclone copy --immutable and
deletes local files once both are confirmed on Drive (D-002); both sidecars
schedule with supercronic because busybox crond runs no jobs as non-root;
backup runs as uid 10001. .gitea/workflows/build-images.yaml from the owner's
example (not yet run); infra/build-images.sh and infra/publish-apk.sh (R8
mapping kept, version per §10.6) on the Mac; README checklist and RESTORE.md.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
85 lines
4.0 KiB
Bash
Executable File
85 lines
4.0 KiB
Bash
Executable File
#!/bin/sh
|
|
# Kvitt backup job (SPEC §10.9). Runs inside the backup image with /data (server data) and /backups mounted.
|
|
# 1. online, consistent snapshot of /data/kvitt.sqlite with sqlite3 .backup
|
|
# 2. PRAGMA integrity_check on the snapshot must print ok, else abort
|
|
# 3. gzip -9 the snapshot and tar the pictures, both with the same UTC stamp
|
|
# 4. Drive upload when RCLONE_FOLDER_ID is set (the Pi): rclone copy --immutable of every kvitt-*.sqlite.gz and
|
|
# pictures-*.tar.gz in /backups (this run's pair and any left by an earlier failed upload), never sync, never
|
|
# delete on Drive; once every file is confirmed on Drive with rclone lsf (name and size) the local copies are
|
|
# deleted (D-002). Skipped with a log line when RCLONE_FOLDER_ID is empty (the development stack, D-001): files kept.
|
|
# 5. write /backups/last-success with the stamp (only after this run's pair is confirmed on Drive, when uploading)
|
|
# Logs carry file names and sizes only, never database content (SPEC §8.7).
|
|
set -eu
|
|
|
|
DATA_DIR=${KVITT_DATA_DIR:-/data}
|
|
BACKUP_DIR=${BACKUP_DIR:-/backups}
|
|
DB="$DATA_DIR/kvitt.sqlite"
|
|
STAGING="$BACKUP_DIR/staging"
|
|
|
|
log() { echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) backup: $*"; }
|
|
fail() { log "FAILED: $*"; rm -f "$STAGING/kvitt.sqlite"; exit 1; }
|
|
|
|
[ -f "$DB" ] || fail "no database at $DB"
|
|
mkdir -p "$STAGING"
|
|
rm -f "$STAGING/kvitt.sqlite"
|
|
|
|
# 1. Snapshot
|
|
sqlite3 -batch "$DB" ".backup '$STAGING/kvitt.sqlite'" || fail "sqlite3 .backup returned an error"
|
|
|
|
# 2. Integrity check
|
|
result=$(sqlite3 -batch -noheader -list "$STAGING/kvitt.sqlite" "PRAGMA integrity_check") || fail "integrity_check could not run"
|
|
[ "$result" = "ok" ] || fail "integrity_check did not print ok"
|
|
|
|
# 3. Compress with one UTC stamp
|
|
stamp=$(date -u +%Y%m%dT%H%M%SZ)
|
|
db_out="$BACKUP_DIR/kvitt-$stamp.sqlite.gz"
|
|
pics_out="$BACKUP_DIR/pictures-$stamp.tar.gz"
|
|
gzip -9 -c "$STAGING/kvitt.sqlite" > "$db_out.tmp" || fail "gzip failed"
|
|
mv "$db_out.tmp" "$db_out"
|
|
rm -f "$STAGING/kvitt.sqlite"
|
|
if [ -d "$DATA_DIR/pictures" ]; then
|
|
tar -czf "$pics_out.tmp" -C "$DATA_DIR" pictures || fail "tar of pictures failed"
|
|
else
|
|
log "no pictures directory yet; writing an empty pictures archive"
|
|
tar -czf "$pics_out.tmp" -T /dev/null || fail "tar of empty pictures archive failed"
|
|
fi
|
|
mv "$pics_out.tmp" "$pics_out"
|
|
log "wrote $(basename "$db_out") ($(wc -c < "$db_out") bytes) and $(basename "$pics_out") ($(wc -c < "$pics_out") bytes)"
|
|
|
|
# 4. Drive upload (D-002)
|
|
if [ -z "${RCLONE_FOLDER_ID:-}" ]; then
|
|
log "RCLONE_FOLDER_ID is empty: Drive upload skipped, local files kept"
|
|
else
|
|
remote=${RCLONE_REMOTE:-gdrive:}
|
|
conf_src=${RCLONE_CONFIG_SOURCE:-/config/rclone/rclone.conf}
|
|
[ -r "$conf_src" ] || fail "no readable rclone config at $conf_src; local files kept"
|
|
# rclone writes refreshed access tokens back to its config; the mounted one is read-only, so use a private copy.
|
|
conf=$(mktemp)
|
|
cp "$conf_src" "$conf"
|
|
export RCLONE_CONFIG="$conf"
|
|
trap 'rm -f "$conf"' EXIT
|
|
confirmed=""
|
|
for f in "$BACKUP_DIR"/kvitt-*.sqlite.gz "$BACKUP_DIR"/pictures-*.tar.gz; do
|
|
[ -f "$f" ] || continue
|
|
name=$(basename "$f")
|
|
size=$(wc -c < "$f" | tr -d ' ')
|
|
rclone copy "$f" "$remote" --drive-root-folder-id "$RCLONE_FOLDER_ID" --immutable --retries 3 --stats 0 --log-level ERROR \
|
|
|| fail "rclone copy of $name failed; local files kept"
|
|
listed=$(rclone lsf "$remote" --drive-root-folder-id "$RCLONE_FOLDER_ID" --files-only --format sp --separator ' ' \
|
|
--include "/$name" --log-level ERROR) || fail "rclone lsf could not confirm $name; local files kept"
|
|
[ "$listed" = "$size $name" ] || fail "$name is not on Drive with $size bytes; local file kept"
|
|
log "uploaded and confirmed on Drive: $name ($size bytes)"
|
|
confirmed="$confirmed $f"
|
|
done
|
|
# Every file is confirmed on Drive: delete the local copies (D-002). Nothing on Drive is ever deleted.
|
|
for f in $confirmed; do rm -f "$f"; done
|
|
log "local copies deleted after Drive confirmation"
|
|
rm -f "$conf"
|
|
trap - EXIT
|
|
fi
|
|
|
|
# 5. Success marker
|
|
echo "$stamp" > "$BACKUP_DIR/last-success.tmp"
|
|
mv "$BACKUP_DIR/last-success.tmp" "$BACKUP_DIR/last-success"
|
|
log "ok $stamp"
|