janpeter/Ops-dashboard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(server-backup): restic dual-repo backup (NAS + B2) with dashboard UI

Browse source 
Adds a server-wide backup capability beyond the existing ops_dashboard
pg_dump flow:

- Daily systemd timer (03:30) runs pg_dumpall + Forgejo dump, then restic
  to a local NAS repo and an offsite Backblaze B2 repo with Object Lock.
  Phase-based script with single-instance flock, structured statusfile,
  systemd hardening, and live-datadir excludes (Postgres / Forgejo) so
  the dumps stay authoritative.
- Ops-agent gets nine new read-only/trigger commands (snapshots, stats,
  status, logs, plus two triggers) backed by sudoers-whitelisted wrapper
  scripts that source /etc/restic-backup.env so the agent never sees the
  restic password or B2 keys.
- Two new flows (server_backup_full, server_backup_restore_test) drive
  the dashboard's "Backup now" and "Restore test" buttons.
- /settings/backups gains a Server backup section with overall + per-phase
  status, NAS / B2 snapshot tables, restore-size / raw-data / dedup-ratio
  stats, and the last restore-test result. The existing pg_dump section
  is preserved unchanged.
- Runbook docs/runbooks/server-backup.md follows the tailscale-setup
  pattern (plan + addendum) and covers B2 Object Lock + scoped keys,
  Forgejo subplan with isolated restore-test stack, the off-server
  maintenance flow for B2 prune, and the integrity-check schedule.

Code-only change — installation on scrum4me-srv follows the runbook.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Madhura68 2026-05-15 13:03:00 +02:00
parent 27cba872a8
commit ab87c0fada
23 changed files with 2625 additions and 170 deletions
Download patch file Download diff file Expand all files Collapse all files

16
deploy/ops-agent/sudoers
View file

@ -1,9 +1,19 @@
# /etc/sudoers.d/ops-agent
# NOPASSWD for explicit systemctl restart invocations by the ops-agent service account.
# Only the service names whitelisted in commands.yml are listed here.
# NOPASSWD for explicit invocations by the ops-agent service account.
# Only the service names + wrapper scripts whitelisted in commands.yml are listed here.
# Installed by deploy/ops-agent/setup.sh.
ops-agent ALL=(root) NOPASSWD: \
/usr/bin/systemctl restart scrum4me-web, \
/usr/bin/systemctl restart ops-agent, \
/usr/bin/systemctl restart caddy
/usr/bin/systemctl restart caddy, \
/srv/backups/scripts/wrappers/read-status.sh, \
/srv/backups/scripts/wrappers/restic-snapshots.sh nas, \
/srv/backups/scripts/wrappers/restic-snapshots.sh b2, \
/srv/backups/scripts/wrappers/restic-stats.sh nas, \
/srv/backups/scripts/wrappers/restic-stats.sh b2, \
/srv/backups/scripts/wrappers/restic-check.sh nas, \
/srv/backups/scripts/wrappers/restic-check.sh b2, \
/srv/backups/scripts/wrappers/trigger-backup.sh, \
/srv/backups/scripts/wrappers/trigger-restore-test.sh nas, \
/srv/backups/scripts/wrappers/trigger-restore-test.sh b2