2026-09-12 16:20:42 +02:00
|
|
|
---
|
|
|
|
|
# Memos backup: dumps locally on memos-box, encrypted with age.
|
|
|
|
|
# Replaces the lapy pull, which had been writing EMPTY directories since
|
|
|
|
|
# 2025-12-27 — its script hardcoded 192.168.1.130, which DHCP later reassigned
|
|
|
|
|
# to a different machine that has no rsync.
|
|
|
|
|
- name: Configure the Memos backup on its own host
|
|
|
|
|
hosts: memos
|
|
|
|
|
become: yes
|
|
|
|
|
vars_files:
|
|
|
|
|
- ./memos_vars.yml
|
|
|
|
|
|
|
|
|
|
tasks:
|
|
|
|
|
- name: Ensure Memos dumps itself, encrypted, on a timer
|
|
|
|
|
ansible.builtin.include_role:
|
|
|
|
|
name: backup_source
|
|
|
|
|
vars:
|
|
|
|
|
backup_source_name: memos
|
|
|
|
|
backup_source_description: "Memos"
|
|
|
|
|
backup_source_dump_command: "tar -czf - -C / var/lib/memos"
|
|
|
|
|
# sqlite in WAL mode: stopping checkpoints the WAL, so the artefact is a
|
|
|
|
|
# consistent database rather than a torn mid-write copy. The old rsync
|
|
|
|
|
# job did not stop it.
|
|
|
|
|
backup_source_stop_service: memos
|
|
|
|
|
backup_source_retention_days: 7
|
|
|
|
|
backup_source_on_calendar: "*-*-* 02:00:00"
|
backups: monitor both the dump and the pull, per source
Twelve endpoints in two groups, because they answer different questions and
fail for different reasons:
backup-dump_<svc> pushed by the SOURCE right after its dump runs
backup-store_<svc> pushed by the BOX at 05:30, per source
backup-store_pull-job pushed by the BOX, about the box itself
The store alone could catch almost everything, because the artefact filename
carries the source's dump timestamp - a source whose timer died still pulls
"ok" forever, but the timestamp gives it away. What the source side adds is
LATENCY and DIAGNOSIS: the store only learns at the next 04:00 pull, and it
cannot tell you whether the dump broke or the pull did.
pull-job is separate from the per-source checks because it is a LEADING
indicator where those are lagging ones. A disabled pull timer, a failed pull
job, or a filling disk are all visible immediately, while the per-source checks
only fire once an artefact is >26h stale - about a day later. Disable the timer
at 10:00 and every source stays green until tomorrow; pull-job goes red this
morning and names the cause instead of showing six stale sources.
Frequencies: dumps 02:00-02:30 staggered, pull 04:00, verification 05:30, all
daily and Persistent. 26h staleness decides red; a 30h Gatus heartbeat catches
the verification itself having stopped, so a dead check-backups.timer cannot
hide a stale backup.
arbret has no dump endpoint: prd-arbret is in [arbret], which `managed`
deliberately excludes, so nothing of ours runs there. Store-checked only.
check-backups.sh was manual-only; it now runs on a timer and reports per source
rather than only printing. The human-readable report is unchanged.
A SERIOUS bug introduced and fixed in this change, recorded because the shape
is easy to repeat: the reporting hook was added to backup.sh as a second
`trap ... EXIT`. Bash REPLACES the EXIT handler rather than adding to it, so
that silently deleted the trap which restarts the stopped service - the one the
script's own comment calls "the point", and the bug the role was written to
eliminate. Every backup then stopped its service and left it stopped. It took
forgejo, lnbits, headscale and memos down for several minutes each, and nothing
caught it: the dumps exit 0, the artefacts are correct, the deploy reports
failed=0, and liveness only proves the HOST is up. There is now ONE EXIT
handler doing both jobs, armed BEFORE the stop so a failure during the stop
still restarts. Verified by rendering both variants, asserting exactly one EXIT
trap in each, and simulating a mid-way failure to confirm the restart fires.
Verified: all 12 endpoints UP; six sources pulled cleanly (arbret 31M,
headscale 198K, memos 7.8M, vaultwarden 2.1M, lnbits 30M, forgejo 2.6G), store
16% full, "RESULT: all checks passed".
Known gaps, deliberately not closed here:
* `yell` warnings - disk 75-90%, an artefact under half the previous size,
retention not pruning - never reach Gatus, because a push is binary.
* Nothing verifies a backed-up service came back UP. That is the gap that let
the trap bug run unnoticed, and it is what the next change addresses.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-14 09:22:12 +02:00
|
|
|
# Reported to Gatus as backup-dump_memos. The token is this HOST's token,
|
|
|
|
|
# shared with its other checks - see infra/400_host_monitoring.yml.
|
|
|
|
|
backup_source_push_url: "https://{{ subdomains.gatus }}.{{ root_domain }}/api/v1/endpoints/backup-dump_memos/external"
|
|
|
|
|
backup_source_push_token: "{{ gatus_push_tokens[inventory_hostname] }}"
|