counterweight/personal_infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

brushing up backups

Browse source
This commit is contained in:
counterweight 2026-09-12 17:57:43 +02:00
parent e9bb90f8f8
commit 2ebb2f9a64
Signed by: counterweight
GPG key ID: 883EDBAA726BD96C
5 changed files with 185 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
ansible/roles/backup_source/templates/backup.sh.j2
View file

@ -53,6 +53,12 @@ trap 'log "Restarting ${SERVICE}..."; eval "$START_CMD" || true' EXIT
# --- Dump straight into age; plaintext never touches the disk ---
log "Writing ${ARTIFACT}..."
{{ backup_source_dump_command }} | age -r "$RECIPIENT" -o "${ARTIFACT}.partial"
{% if backup_source_pull_user %}
# Match the final ownership immediately, so even a partial left by a later
# failure is not an unreadable obstacle to the pull.
chown root:{{ backup_source_pull_user }} "${ARTIFACT}.partial"
chmod 640 "${ARTIFACT}.partial"
{% endif %}
mv "${ARTIFACT}.partial" "$ARTIFACT"
{% if backup_source_pull_user %}
# Readable by the pull account and nobody else. The contents are age-encrypted