halkyon/deploy/backup/halkyon-backup.service

# The hourly off-site backup of learn.halkyon.eu, on its server: deploy/backup.sh, as
# deploy, started by halkyon-backup.timer. Installed with the timer as
# /etc/systemd/system/halkyon-backup.service; deploy/backups.md has the steps.
#
# deploy is in the docker group, which is as good as root, so sandboxing this unit
# would protect little: it keeps to the basics.
[Unit]
Description=Off-site backup of learn.halkyon.eu's database
Documentation=file:///home/deploy/halkyon/deploy/backups.md
After=network-online.target docker.service
Wants=network-online.target

[Service]
Type=oneshot
User=deploy
Group=deploy
ExecStart=/home/deploy/halkyon/deploy/backup.sh
PrivateTmp=yes
NoNewPrivileges=yes
ProtectSystem=full
# Behind the instance for CPU and disk.
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=7
chore: the servers are named by the domain they serve Files called the servers by their own host names, which are the operator's and say nothing a reader needs. They now say which domain a server serves: learn.halkyon.eu's server (the instance and its CI runner), the halkyon.app server (Forgejo and the F-Droid repository). Two names are settings rather than words. CI's runner label becomes `instance` (`runs-on: instance`, `labels: ["instance:host"]`): the runner reads its installed copy of deploy/runner/config.yml, so jobs wait in the queue until that copy is updated and the runner restarted. The SSH aliases the scripts and docs use become `learn-deploy` and `fdroid-upload`. AGENTS.md says to keep it so. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-10-13 23:11:40 +02:00			`# The hourly off-site backup of learn.halkyon.eu, on its server: deploy/backup.sh, as`
feat(deploy): hourly off-site backups with restic learn.halkyon.eu dumps its database every hour (people's files are in it too) and restic stores the dump encrypted in a Hetzner Storage Box, keeping 24 hourly, 7 daily, 4 weekly and 3 monthly snapshots. The box's own snapshots, removable only in Hetzner's Console, protect the backups from a taken-over server. A systemd timer runs it as deploy; once a day it also prunes and checks the repository. Failures go to the journal. Hourly, because a restore costs people who started after the backup what their device held: the app no longer finds its session and starts anew. deploy/backups.md describes the setup, the restore and what a restore loses; both were rehearsed on the local Compose stack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-10-03 16:45:40 +02:00			`# deploy, started by halkyon-backup.timer. Installed with the timer as`
			`# /etc/systemd/system/halkyon-backup.service; deploy/backups.md has the steps.`
			`#`
			`# deploy is in the docker group, which is as good as root, so sandboxing this unit`
			`# would protect little: it keeps to the basics.`
			`[Unit]`
			`Description=Off-site backup of learn.halkyon.eu's database`
build(deploy): the server's checkout is ~deploy/halkyon, the repository's name The folder kept its name from before the monorepo (ADR 0015), though Train and Todo deploy from it too. redeploy.sh, the backup's units and the operator's steps name ~deploy/halkyon; the Compose project keeps the name halkyon-learn, as Docker names its volumes after it. The server moves after this is deployed: the running redeploy.sh is read whole before it runs, so the deploy of this commit still works in the old folder; then the folder is moved, the pinned commands in deploy's authorized_keys and the backup's units changed, and the containers recreated on the new paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-11-02 18:53:11 +01:00			`Documentation=file:///home/deploy/halkyon/deploy/backups.md`
feat(deploy): hourly off-site backups with restic learn.halkyon.eu dumps its database every hour (people's files are in it too) and restic stores the dump encrypted in a Hetzner Storage Box, keeping 24 hourly, 7 daily, 4 weekly and 3 monthly snapshots. The box's own snapshots, removable only in Hetzner's Console, protect the backups from a taken-over server. A systemd timer runs it as deploy; once a day it also prunes and checks the repository. Failures go to the journal. Hourly, because a restore costs people who started after the backup what their device held: the app no longer finds its session and starts anew. deploy/backups.md describes the setup, the restore and what a restore loses; both were rehearsed on the local Compose stack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-10-03 16:45:40 +02:00			`After=network-online.target docker.service`
			`Wants=network-online.target`

			`[Service]`
			`Type=oneshot`
			`User=deploy`
			`Group=deploy`
build(deploy): the server's checkout is ~deploy/halkyon, the repository's name The folder kept its name from before the monorepo (ADR 0015), though Train and Todo deploy from it too. redeploy.sh, the backup's units and the operator's steps name ~deploy/halkyon; the Compose project keeps the name halkyon-learn, as Docker names its volumes after it. The server moves after this is deployed: the running redeploy.sh is read whole before it runs, so the deploy of this commit still works in the old folder; then the folder is moved, the pinned commands in deploy's authorized_keys and the backup's units changed, and the containers recreated on the new paths. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-11-02 18:53:11 +01:00			`ExecStart=/home/deploy/halkyon/deploy/backup.sh`
feat(deploy): hourly off-site backups with restic learn.halkyon.eu dumps its database every hour (people's files are in it too) and restic stores the dump encrypted in a Hetzner Storage Box, keeping 24 hourly, 7 daily, 4 weekly and 3 monthly snapshots. The box's own snapshots, removable only in Hetzner's Console, protect the backups from a taken-over server. A systemd timer runs it as deploy; once a day it also prunes and checks the repository. Failures go to the journal. Hourly, because a restore costs people who started after the backup what their device held: the app no longer finds its session and starts anew. deploy/backups.md describes the setup, the restore and what a restore loses; both were rehearsed on the local Compose stack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me> 2026-10-03 16:45:40 +02:00			`PrivateTmp=yes`
			`NoNewPrivileges=yes`
			`ProtectSystem=full`
			`# Behind the instance for CPU and disk.`
			`Nice=10`
			`IOSchedulingClass=best-effort`
			`IOSchedulingPriority=7`