fscotto/infra
1
0
Fork 0
mirror of https://github.com/fscotto/infra.git synced 2026-09-27 11:02:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Document validated Atlas Borg backup activation

Browse Source
This commit is contained in:
Fabio Scotto di Santolo
2026-09-18 10:09:12 +02:00
parent 7e498514dd
commit e837b0059b
2 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
AGENTS.md
View File

@@ -180,13 +180,13 @@ scheduled retention prune and monthly scrub remain runtime checks.
generations, plus a monthly scrub on the first Sunday at 03:00. The timers and first hourly snapshot were
verified on Atlas. Still observe the first scheduled retention prune and scrub; Cockpit Scheduler is for
visibility or manual operations only, and snapshot rollback is never automated.
- [ ] Complete runtime activation of the encrypted offsite Borg backup to the Hetzner Storage Box. The
playbook now declares the dedicated SSH identity, pinned ED25519 host key, Vault-backed `repokey`
encryption, a locked non-login `borg` account with no sudo or supplementary groups, snapshot-consistent
sources prepared only by the root wrapper, Borg execution without ZFS privileges, daily retries and
logging, 30 daily, 8 weekly and 12 monthly archives, compaction, and monthly repository checks. Still
add the Vault passphrase, install the generated public key in the sub-account, run the initial backup
and check, preserve the exported recovery key offline, and validate a restore before relying on it.
- [x] Activate and validate the encrypted offsite Borg backup to the Hetzner Storage Box. Atlas uses the
dedicated SSH identity, pinned ED25519 host key, Vault-backed `repokey` encryption, and a locked
non-login `borg` account with no sudo or supplementary groups. The initial snapshot-consistent backup,
Borg repository check, and temporary-directory restore completed successfully; the restored `Archive`
tree matched the live data, and temporary snapshots and mounts were removed. The exported recovery key
was copied offline. Daily backup retries and logging, 30 daily, 8 weekly and 12 monthly archives,
compaction, and monthly repository checks are enabled.
- [ ] Add the UUID-bound offline USB backup with versioned rsync, locking, capacity checks, verification,
safe unmounting and a tested restore procedure; never trigger it for an arbitrary USB disk.
- [ ] Test restores independently from a ZFS snapshot, Borg, and the offline USB backup before relying on

9
README.md
View File

@@ -347,14 +347,17 @@ ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
ansible-playbook ansible/site.yml --limit atlas --tags packages,borg --check --diff
```
Atlas runtime activation is complete: the initial backup and repository check succeeded, a full restore
to a temporary directory was validated against the live `Archive` tree, the recovery-key export was copied
to offline storage, and the temporary snapshot and bind mounts were cleaned up.
A temporary Nextcloud deployment on Atlas is also planned before Uranus: it requires separately
declared persistent application, database, and cache storage, Vault-backed credentials, NPM-only
publishing through Aegis, and defined backup, upgrade, and eventual migration procedures. Do not deploy
it before the data-protection checklist is complete.
Runtime activation and restore validation of the Borg backup, Prometheus backup pulls, USB backup,
monitoring, and disaster-recovery tests remain follow-up work. The prioritized operational backlog is
kept in `AGENTS.md`.
Prometheus backup pulls, USB backup, monitoring, and disaster-recovery tests remain follow-up work. The
prioritized operational backlog is kept in `AGENTS.md`.
## How layering works