vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

restic/ana-ml2: default to reusing existing repo + htpasswd entry

Browse Source 
An ana-ml2 user and repo were created during the original backup
pipeline pass. Reuse keeps snapshot history consolidated and avoids
duplicate infrastructure. Reworks the README to:

  - Skip `restic init` (repo exists) and the htpasswd step (user exists)
  - Install the two existing secrets (REST URL w/ htpasswd password,
    repo passphrase) into /etc/restic/{restic.env,password}
  - Verify credentials against the existing repo via `restic snapshots`

Fresh-setup flow retained below as a fallback for zero-state rebuilds.
This commit is contained in:
Vuong Hoang
2026-04-20 23:11:49 -07:00
parent d0c4e46e73
commit 445aa87cb7
1 changed files with 51 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/restic/ana-ml2/README.md
+51 -22
View File
@@ -35,36 +35,65 @@ where synapse/seafile/vaultwarden DB dumps run first.
## Deploy (one-time setup)
### 1. Add the client entry to the Anaheim rest-server .htpasswd
### 1. Credentials (repo already exists — reuse)
On ana-docker (where rest-server-ana runs):
The Anaheim rest-server already has an `ana-ml2` entry in its `.htpasswd`
and a repo at `/ana-ml2/` from a prior pass. Reusing both keeps the
snapshot history consolidated.
```bash
ssh -t ana-docker '
cd /opt/docker/data/rest-server-ana && # wherever the data dir is
sudo htpasswd -B /data/.htpasswd ana-ml2 && # prompts for a new password
docker restart rest-server
'
```
Store the password where ana-ml2 can grab it. This is the **HTTP basic
auth password**, not the restic repo passphrase — two separate secrets.
### 2. Create the restic repo
On ana-ml2, with a freshly generated encryption passphrase:
On ana-ml2, install the two secret files from the existing values (both
live in your password manager):
```bash
ssh -t ana-ml2 '
sudo install -d -o root -g root -m 0700 /etc/restic /var/lib/restic &&
echo "RESTIC_REPOSITORY=rest:http://ana-ml2:<htpasswd-password>@10.250.50.70:8000/ana-ml2/" | sudo tee /etc/restic/restic.env > /dev/null &&
sudo tee /etc/restic/restic.env > /dev/null <<EOF
RESTIC_REPOSITORY=rest:http://ana-ml2:<EXISTING-HTPASSWD-PASSWORD>@10.250.50.70:8000/ana-ml2/
EOF
sudo chmod 600 /etc/restic/restic.env &&
# Generate a fresh passphrase (print it to stdout exactly once — store
# it in your password manager immediately; losing it = losing this
# host´s entire backup history).
openssl rand -base64 48 | sudo tee /etc/restic/password > /dev/null &&
sudo chmod 600 /etc/restic/password &&
sudo tee /etc/restic/password > /dev/null <<EOF
<EXISTING-REPO-PASSPHRASE>
EOF
sudo chmod 600 /etc/restic/password
'
```
### 2. Verify creds against the existing repo
Before deploying the profile, prove the secrets are correct:
```bash
ssh -t ana-ml2 '
sudo env $(cat /etc/restic/restic.env) \
RESTIC_PASSWORD_FILE=/etc/restic/password \
restic snapshots
'
```
Expected: either a list of prior snapshots (from the earlier
docker-files pass) or `no snapshots found` — both mean auth is good.
If you see `Fatal: wrong password or no key found`, the passphrase in
`/etc/restic/password` doesn't match the repo — check your password
manager or rotate (see "Recreating the repo" below).
**Do not run `restic init`** — the repo is already initialized; init
against an existing repo errors out deliberately.
### If no repo exists yet (fresh setup)
Only applicable if you're starting from zero — otherwise skip.
```bash
ssh -t ana-docker '
sudo htpasswd -B /path/to/rest-server/data/.htpasswd ana-ml2 && # prompts for password
docker restart rest-server
'
ssh -t ana-ml2 '
# Write /etc/restic/restic.env and /etc/restic/password as above, using
# the fresh htpasswd password and a freshly generated passphrase:
openssl rand -base64 48 # save this in your password manager IMMEDIATELY
sudo env $(cat /etc/restic/restic.env) \
RESTIC_PASSWORD_FILE=/etc/restic/password \