vh
349f684d0b
Audit surfaced three DB-backed services not being dumped consistently
by the existing pre-backup.sh:
- vaultwarden — migrated to external Postgres on PFI-Postgres
(10.250.50.80); old sqlite block was dumping stale pre-migration
files. Replace with pg_dump against the live database. Requires
postgresql-client on ana-docker and VW_PG* creds in
/etc/restic/dbcreds.env.
- gitea — also on PFI-Postgres; no hook existed at all. Use
`gitea dump` for a single zip that captures DB + repos + config +
LFS + attachments consistently. No explicit creds needed; the
container reads its own GITEA__database__* env.
- openwebui — two local SQLite databases (webui.db + the ChromaDB
vector store). .backup command if sqlite3 is in the image, volume-
level fallback otherwise.
Refactor: each block now logs a WARN on failure instead of aborting the
whole script — partial dumps > no dumps when one service has an issue.
dbcreds.env.example committed as a template; real file goes to
/etc/restic/dbcreds.env root:600 on the host and is never in the repo.
Mattermost retired (user confirmed 2026-04-21); removed from the
pre-backup.sh list and flagged in README's stacks section. Mattermost
container was not running regardless; the audit surfaced that it was
already effectively gone. Compose dir on ana-docker can be removed as
separate cleanup.
26 lines
917 B
Bash
26 lines
917 B
Bash
# /etc/restic/dbcreds.env on ana-docker — consumed by pre-backup.sh.
|
|
#
|
|
# Deploy to the host as:
|
|
# sudo install -o root -g root -m 0600 dbcreds.env /etc/restic/dbcreds.env
|
|
#
|
|
# Never commit the real file — it carries production DB passwords. This
|
|
# template is the only thing tracked in the repo.
|
|
|
|
# --- Vaultwarden → external Postgres on PFI-Postgres (10.250.50.80) ---------
|
|
VW_PGHOST=10.250.50.80
|
|
VW_PGPORT=5432
|
|
VW_PGUSER=vaultwarden
|
|
VW_PGDB=vaultwarden
|
|
VW_PGPASS=replace-with-postgres-password
|
|
|
|
# --- Gitea → external Postgres on PFI-Postgres -------------------------------
|
|
# Not needed: pre-backup.sh uses `gitea dump` which reads DB creds from the
|
|
# container's own GITEA__database__* env vars. Listed here for awareness
|
|
# in case we switch to direct pg_dump later.
|
|
#
|
|
# GITEA_PGHOST=10.250.50.80
|
|
# GITEA_PGPORT=5432
|
|
# GITEA_PGUSER=gitea
|
|
# GITEA_PGDB=gitea
|
|
# GITEA_PGPASS=replace-with-postgres-password
|