vh
5fee7868b3
/etc/restic is 0700 root, so before elway 754db4b this step's creates: guard
evaluated unprivileged, always reported the file absent, and the step re-ran
on every invocation. A plain cp -p would then have overwritten the preserved
ORIGINAL with the current post-repair file -- destroying the one thing the
step exists to keep.
Verified it never fired: the preserved copy still holds the original
(md5 7b42324c, mtime 2026-04-21) and differs from the live hook (c79bef9a,
2026-09-15). The guard is fixed now, but a destructive step should not depend
on its guard being right.
30 lines
1.4 KiB
YAML
30 lines
1.4 KiB
YAML
steps:
|
|
- name: Preserve the previous hook
|
|
sudo: true
|
|
# ⚠ -n as well as -p. /etc/restic is 0700 root, so before elway 754db4b
|
|
# the `creates:` guard evaluated unprivileged, always said "absent", and
|
|
# this step re-ran on every invocation — a plain `cp -p` would then have
|
|
# overwritten the preserved ORIGINAL with the current post-repair file,
|
|
# destroying the one thing the step exists to keep. The guard is fixed,
|
|
# but a destructive step should not depend on its guard being right.
|
|
shell: cp -np /etc/restic/pre-backup.sh /etc/restic/pre-backup.sh.before-repair-20260910
|
|
creates: /etc/restic/pre-backup.sh.before-repair-20260910
|
|
- name: Install corrected canonical hook
|
|
sudo: true
|
|
upload:
|
|
src: configs/restic/ana-docker/pre-backup.sh
|
|
dest: /etc/restic/pre-backup.sh
|
|
mode: '0700'
|
|
- name: Validate and produce fresh staged database backups
|
|
sudo: true
|
|
shell: bash -n /etc/restic/pre-backup.sh && /etc/restic/pre-backup.sh
|
|
verify:
|
|
- name: Verify Gitea and Vaultwarden archive structure
|
|
sudo: true
|
|
shell: |
|
|
set -euo pipefail
|
|
pg_restore --list /var/lib/restic/stage/vaultwarden.pg_dump >/dev/null
|
|
tar -tf /var/lib/restic/stage/gitea-dump.tar | grep -x 'gitea-db.sql'
|
|
ls -lh /var/lib/restic/stage/gitea-dump.tar /var/lib/restic/stage/vaultwarden.pg_dump
|
|
test -z "$(docker exec gitea find /tmp -maxdepth 1 -type d -name 'gitea-backup.*')"
|