Tizian 「ティツィアーン」
999a3ce0b0
learn.halkyon.eu dumps its database every hour (people's files are in it too) and restic stores the dump encrypted in a Hetzner Storage Box, keeping 24 hourly, 7 daily, 4 weekly and 3 monthly snapshots. The box's own snapshots, removable only in Hetzner's Console, protect the backups from a taken-over server. A systemd timer runs it as deploy; once a day it also prunes and checks the repository. Failures go to the journal. Hourly, because a restore costs people who started after the backup what their device held: the app no longer finds its session and starts anew. deploy/backups.md describes the setup, the restore and what a restore loses; both were rehearsed on the local Compose stack. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
24 lines
829 B
Desktop File
24 lines
829 B
Desktop File
# The hourly off-site backup of learn.halkyon.eu, on sahaquiel: deploy/backup.sh, as
|
|
# deploy, started by halkyon-backup.timer. Installed with the timer as
|
|
# /etc/systemd/system/halkyon-backup.service; deploy/backups.md has the steps.
|
|
#
|
|
# deploy is in the docker group, which is as good as root, so sandboxing this unit
|
|
# would protect little: it keeps to the basics.
|
|
[Unit]
|
|
Description=Off-site backup of learn.halkyon.eu's database
|
|
Documentation=file:///home/deploy/halkyon-learn/deploy/backups.md
|
|
After=network-online.target docker.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=deploy
|
|
Group=deploy
|
|
ExecStart=/home/deploy/halkyon-learn/deploy/backup.sh
|
|
PrivateTmp=yes
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=full
|
|
# Behind the instance for CPU and disk.
|
|
Nice=10
|
|
IOSchedulingClass=best-effort
|
|
IOSchedulingPriority=7
|