tommy/homelab-configs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

LubeLogger: back up data+keys volumes to PBS via the playbook

Browse Source 
Close the volume-backup gap: the pg_dump covered Postgres only; the ASP.NET
DataProtection keyring (root-user credential) and uploaded docs live in the
lubelogger-{data,keys} volumes. The docker-volume-backup sidecar can't target PBS
natively, so both volumes now ride the same proxmox-backup-client job as the SQL
dump — one host/lubelogger snapshot, three .pxar archives, keep-daily 14. Backup
script+units are now installed by the Ansible playbook (idempotent, changed=0);
PBS token from ansible-vault. Restore verified: keyring XML + sentinel doc
byte-identical (sha256). Removes the now-playbook-managed standalone script/units.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
tommy
2026-07-02 15:28:31 -05:00
parent c9aac20e73
commit 6de37c8712
5 changed files with 116 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lubelogger/README.md
+14 -8
View File
@@ -18,14 +18,20 @@ Inline-compose house style: `copy:` the compose + `community.docker.docker_compo
DB password is sourced from ansible-vault (`vault_lubelogger_db_password`) — never inline.
Second converge is `changed=0`.
## Backup (PBS)
`lubelogger-backup.{sh,service,timer}` on node01 — daily 03:30, `pg_dump` → PBS
(`rust-usb`, host/lubelogger), prune `--keep-daily 14`. PBS creds live in
`/etc/lubelogger-backup.env` (root:600, NOT in git). Restore verified via full
PBS round-trip into a throwaway postgres:18 (live↔restored row-count parity).
NOTE: the `lubelogger-data`/`lubelogger-keys` volumes (uploads, config, the ROOT USER
credential, ASP.NET keyring) are a SEPARATE layer — covered by docker-volume-backup
(`stop-during-backup` labels already set). pg_dump captures Postgres data only.
## Backup (PBS) — deployed BY the playbook
The backup script + systemd units are installed and enabled by `deploy-lubelogger.yml`
(inline, idempotent). node01, daily 03:30, one PBS snapshot (`rust-usb`, host/lubelogger)
with **three archives** in a single `proxmox-backup-client` job, prune `--keep-daily 14`:
- `lubelogger-db.pxar` — `pg_dump` (app schema + data)
- `lubelogger-data.pxar` — `/App/data` volume (uploads, config, cartracker.db)
- `lubelogger-keys.pxar` — ASP.NET DataProtection keyring (the ROOT USER credential + keys)
The `docker-volume-backup` sidecar can't target a PBS datastore natively, so the volumes
ride the same pbc job as the SQL dump (one datastore, one retention). PBS token comes from
ansible-vault (`vault_lubelogger_pbs_token`) → templated to `/etc/lubelogger-backup.env`
(root:600, NOT in git). Restore VERIFIED: SQL round-trip into throwaway postgres:18
(row-count parity) + data/keys restore (keyring XML + a sentinel doc, byte-identical sha256).
The `stop-during-backup` labels remain in case a sidecar is later added for a second target.
## Reminders → ntfy
`lubelogger-reminders-probe.{sh}` + units on ansible-control (.190) — daily 07:30.