vh
d8f59a15d9
esh-ml1 is outside vzdump, so augaman's face gallery reaches backup only through restic. New playbooks/esh-ml1-restic.yaml installs restic 0.14.0 (the same Debian package as the other ESH hosts) and resticprofile 0.33.1 (pinned, sha256-checked). It uploads configs/restic/esh-ml1/ and schedules a daily 0100 PT backup plus a Sunday 0500 PT check to rest-server-ana. The CT runs UTC, so both schedules name the zone explicitly. pre-backup.sh is fail-closed: it runs augaman's own backup CLI, and any failure, including a stopped container, aborts the run. Tested with a stub docker that exits 1: the run returned 1, and neither the snapshot count nor last-success moved. The restore was verified at identity level against augaman-dev's public-domain canary (snapshot fd3061a1: the restored copy's digest over identities and samples matches the live gallery). That meets the operator gate for real enrollments. The repository URL is read through repository-file rather than restic.env. resticprofile schedule copies env-file values into world-readable systemd units, which publishes the rest-server password on the env-file hosts (observed on esh-docker-vm). This is recorded in the backups runbook under Known gaps, and the playbook verifies no generated unit contains the URL. esh-ml1 is added to the freshness check's expected ana-side repos and to the runbook tables. augaman moves to v0.1.2 (dependency layer keyed on the lock without the project; per-crop embedding). pytest -m gpu tests/vision passes 3/3 on the card, and the canary survived the container recreate.
22 lines
865 B
Bash
22 lines
865 B
Bash
# augaman — copy to .env on the host at /opt/docker/compose/augaman/.env (mode 0600).
|
|
# Real .env is gitignored and lives only on esh-ml1.
|
|
#
|
|
# ⚠ Compose's own variables carry NO `AUGAMAN_` prefix on purpose: the app refuses any
|
|
# AUGAMAN_* variable it does not know, and compose passes only the ones named in
|
|
# compose.yaml. Do not add an env_file.
|
|
|
|
# Built locally on esh-ml1 from the release tag (see README "Building").
|
|
IMAGE=augaman:0.1.2
|
|
|
|
PORT=8040
|
|
HOST_IP=10.0.50.80
|
|
|
|
# Where the backup CLI writes gallery.db. Owned 10001:10001 (the container user),
|
|
# mode 0700. It is the restic stage dir, so the backup run that copies the gallery here
|
|
# is the same run that ships it off-box (README "Backup").
|
|
BACKUP_DIR=/var/lib/restic/stage/augaman
|
|
|
|
# >= 32 visible-ASCII characters. Source of truth is the vault:
|
|
# secret get augaman/api-token
|
|
AUGAMAN_API_TOKEN=
|