vh
1e24e0f799
Closes the last file-level backup gap. Primary ESH home-lab Docker host
— five services with state worth consistent dumps:
- paperless-ngx → external Postgres on 10.0.50.60 (host pg_dump)
- home-assistant → local SQLite ~50MB (host sqlite3 .backup)
- calibre-web-automated → local SQLite (in-container sqlite3)
- pgadmin → local SQLite (host sqlite3)
- uptime-kuma → local SQLite (host sqlite3; container name may vary
after force-recreate, detect by label)
Unique to this host: HA/pgadmin/uptime-kuma images don't bundle sqlite3.
Rather than maintaining custom images, pre-backup.sh runs sqlite3 from
the HOST against the volume bind-mount paths. Requires sqlite3 +
postgresql-client installed on esh-docker-vm.
Cross-site writes to rest-server-ana since ESH has no local rest-server.
NFS mounts (/mnt/{backup,books,compose,documents}) explicitly excluded
— hundreds of GB of NAS-side content backed up at the NAS layer. Also
excludes offen-sidecar buffer volumes (paperless + pgadmin currently
run offen/docker-volume-backup alongside — retire once restic has a
week of clean runs).
Found in audit (non-blocking but noted in README follow-ups):
- paperless-ngx Postgres password is literally "paperless-ng" —
trivially weak, rotate at next opportunity.
23 lines
992 B
Bash
23 lines
992 B
Bash
# /etc/restic/dbcreds.env on esh-docker-vm — consumed by pre-backup.sh.
|
|
#
|
|
# Deploy to the host as:
|
|
# sudo install -o root -g root -m 0600 dbcreds.env /etc/restic/dbcreds.env
|
|
#
|
|
# Never commit the real file — it carries production DB passwords. This
|
|
# template is the only thing tracked in the repo.
|
|
|
|
# --- Paperless-ngx → external Postgres on PFI-Postgres VM (10.0.50.60) ------
|
|
# NOTE (2026-04-21): the current password in the paperless-ngx compose is
|
|
# literally "paperless-ng" — trivially weak. Rotate at the DB side before
|
|
# this backup is considered secure.
|
|
PAPERLESS_PGHOST=10.0.50.60
|
|
PAPERLESS_PGPORT=5432
|
|
PAPERLESS_PGUSER=paperless-ng
|
|
PAPERLESS_PGDB=paperless-ng
|
|
PAPERLESS_PGPASS=replace-with-postgres-password
|
|
|
|
# --- All other services on this host use local SQLite ------------------------
|
|
# (home-assistant, pgadmin, uptime-kuma, calibre-web-automated)
|
|
# No external creds required — sqlite3 runs as root either on the host or
|
|
# inside the container depending on image.
|