Repair ana-docker database backups and bound CI build caches

2026-09-10 09:10:01 -07:00
parent eb75713c1b
commit 44c853cd20
11 changed files with 277 additions and 26 deletions
@@ -0,0 +1,23 @@
+steps:
+  - name: Preserve the previous hook
+    sudo: true
+    shell: cp -p /etc/restic/pre-backup.sh /etc/restic/pre-backup.sh.before-repair-20260910
+    creates: /etc/restic/pre-backup.sh.before-repair-20260910
+  - name: Install corrected canonical hook
+    sudo: true
+    upload:
+      src: configs/restic/ana-docker/pre-backup.sh
+      dest: /etc/restic/pre-backup.sh
+      mode: '0700'
+  - name: Validate and produce fresh staged database backups
+    sudo: true
+    shell: bash -n /etc/restic/pre-backup.sh && /etc/restic/pre-backup.sh
+verify:
+  - name: Verify Gitea and Vaultwarden archive structure
+    sudo: true
+    shell: |
+      set -euo pipefail
+      pg_restore --list /var/lib/restic/stage/vaultwarden.pg_dump >/dev/null
+      tar -tf /var/lib/restic/stage/gitea-dump.tar | grep -x 'gitea-db.sql'
+      ls -lh /var/lib/restic/stage/gitea-dump.tar /var/lib/restic/stage/vaultwarden.pg_dump
+      test -z "$(docker exec gitea find /tmp -maxdepth 1 -type d -name 'gitea-backup.*')"
@@ -0,0 +1,25 @@
+steps:
+  - name: Install cache budget enforcer
+    sudo: true
+    upload:
+      src: configs/buildkit/ana-docker/prune.sh
+      dest: /usr/local/sbin/pfi-buildkit-cache-prune
+      mode: '0755'
+  - name: Install cache budget service
+    sudo: true
+    upload:
+      src: configs/buildkit/ana-docker/buildkit-cache-prune.service
+      dest: /etc/systemd/system/buildkit-cache-prune.service
+      mode: '0644'
+  - name: Install cache budget timer
+    sudo: true
+    upload:
+      src: configs/buildkit/ana-docker/buildkit-cache-prune.timer
+      dest: /etc/systemd/system/buildkit-cache-prune.timer
+      mode: '0644'
+  - name: Enable hourly budget enforcement
+    sudo: true
+    shell: systemctl daemon-reload && systemctl enable --now buildkit-cache-prune.timer
+verify:
+  - name: Verify scheduled cache enforcement
+    shell: systemctl is-active buildkit-cache-prune.timer && systemctl list-timers buildkit-cache-prune.timer --no-pager