fscotto/infra
1
0
Fork 0
mirror of https://github.com/fscotto/infra.git synced 2026-09-27 19:03:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Document validated Atlas Borg backup activation

Browse Source
This commit is contained in:
Fabio Scotto di Santolo
2026-09-18 10:09:12 +02:00
parent 7e498514dd
commit e837b0059b
2 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
AGENTS.md
View File

@@ -180,13 +180,13 @@ scheduled retention prune and monthly scrub remain runtime checks.
generations, plus a monthly scrub on the first Sunday at 03:00. The timers and first hourly snapshot were
verified on Atlas. Still observe the first scheduled retention prune and scrub; Cockpit Scheduler is for
visibility or manual operations only, and snapshot rollback is never automated.
- [ ] Complete runtime activation of the encrypted offsite Borg backup to the Hetzner Storage Box. The
playbook now declares the dedicated SSH identity, pinned ED25519 host key, Vault-backed `repokey`
encryption, a locked non-login `borg` account with no sudo or supplementary groups, snapshot-consistent
sources prepared only by the root wrapper, Borg execution without ZFS privileges, daily retries and
logging, 30 daily, 8 weekly and 12 monthly archives, compaction, and monthly repository checks. Still
add the Vault passphrase, install the generated public key in the sub-account, run the initial backup
and check, preserve the exported recovery key offline, and validate a restore before relying on it.
- [x] Activate and validate the encrypted offsite Borg backup to the Hetzner Storage Box. Atlas uses the
dedicated SSH identity, pinned ED25519 host key, Vault-backed `repokey` encryption, and a locked
non-login `borg` account with no sudo or supplementary groups. The initial snapshot-consistent backup,
Borg repository check, and temporary-directory restore completed successfully; the restored `Archive`
tree matched the live data, and temporary snapshots and mounts were removed. The exported recovery key
was copied offline. Daily backup retries and logging, 30 daily, 8 weekly and 12 monthly archives,
compaction, and monthly repository checks are enabled.
- [ ] Add the UUID-bound offline USB backup with versioned rsync, locking, capacity checks, verification,
safe unmounting and a tested restore procedure; never trigger it for an arbitrary USB disk.
- [ ] Test restores independently from a ZFS snapshot, Borg, and the offline USB backup before relying on