tommy/homelab-configs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lubelogger+homepage: dedicated PBS tokens

Browse Source 
- backup job -> dedicated root@pam!lubelogger-backup token (DatastoreBackup);
  prune made non-fatal pending a group-scoped PBS prune-job (Datastore.Prune deferred).
- Homepage PBS widget -> homepage@pbs!widget (Datastore.Audit); Proxmox Beast
  (root@pam!homepage) left intact, deferred. Secrets in vault/.env only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
tommy
2026-07-02 23:40:32 -05:00
parent 9559b219bf
commit 4b69f74f40
2 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
homepage/services.yaml
+1 -1
View File
@@ -142,7 +142,7 @@
widget: widget:
type: proxmoxbackupserver type: proxmoxbackupserver
url: https://192.168.99.153:8007 url: https://192.168.99.153:8007
username: "root@pam!homepage" username: "homepage@pbs!widget"
password: {{HOMEPAGE_VAR_PROXMOX_BACKUP_SERVER_PASSWORD}} password: {{HOMEPAGE_VAR_PROXMOX_BACKUP_SERVER_PASSWORD}}
verify_ssl: false verify_ssl: false
datastore: Synology-Remote datastore: Synology-Remote
lubelogger/deploy-lubelogger.yml
+6 -2
View File
@@ -123,7 +123,7 @@
# Managed by deploy-lubelogger.yml. PBS push creds — NOT in git. # Managed by deploy-lubelogger.yml. PBS push creds — NOT in git.
PBS_PASSWORD={{ vault_lubelogger_pbs_token }} PBS_PASSWORD={{ vault_lubelogger_pbs_token }}
PBS_FINGERPRINT=90:6B:3E:85:C4:E7:77:F0:24:25:1D:B0:2C:F9:6D:08:AA:CE:08:CE:7B:04:4C:C7:C9:E0:CF:DD:99:44:DB:21 PBS_FINGERPRINT=90:6B:3E:85:C4:E7:77:F0:24:25:1D:B0:2C:F9:6D:08:AA:CE:08:CE:7B:04:4C:C7:C9:E0:CF:DD:99:44:DB:21
PBS_REPOSITORY='root@pam!vaultwarden-backup@192.168.99.153:rust-usb' PBS_REPOSITORY='root@pam!lubelogger-backup@192.168.99.153:rust-usb'
no_log: true no_log: true
- name: Install lubelogger backup script - name: Install lubelogger backup script
@@ -159,9 +159,13 @@
--backup-type host \ --backup-type host \
--backup-id lubelogger --backup-id lubelogger
# Retention: token holds Datastore.Backup only (Prune deferred to a PBS
# group-scoped prune-job). Keep this non-fatal so nightly backups still
# succeed; it starts pruning automatically if Datastore.Prune is granted.
proxmox-backup-client prune "host/lubelogger" \ proxmox-backup-client prune "host/lubelogger" \
--repository "$PBS_REPOSITORY" \ --repository "$PBS_REPOSITORY" \
--keep-daily 14 --keep-daily 14 \
|| echo "NOTE: prune skipped (Datastore.Prune not granted; retention via deferred PBS prune-job)"
notify: reload systemd notify: reload systemd
- name: Install backup systemd service unit - name: Install backup systemd service unit