0e54b86dac
- docker-compose: CODER_OIDC_* wired to Authelia (password login kept as break-glass) - scripts/backup-stacks.sh + stacks-backup.timer: nightly pg_dump, Continue state, stack configs - vault: verification items 13/14, auth-model OIDC section, limits DNS-01 runbook
35 lines
1.4 KiB
Bash
Executable File
35 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Nightly backup for the dual IDE stacks (cdsr = code-server, code = Coder v2).
|
|
#
|
|
# Deliberately NOT backed up: /home/loca/dev/coder/.env and
|
|
# /home/loca/dev/coder/.admin-credentials, and
|
|
# /home/loca/dev/code-server/.ai-credentials. Those are keys, not data. Losing
|
|
# them is recoverable (re-bootstrap the Coder owner via container exec, re-mint
|
|
# the LiteLLM virtual key); copying them in plaintext into a nightly archive
|
|
# only widens the exposure surface.
|
|
#
|
|
# Runs as root from stacks-backup.service, so no sudo prefixes here.
|
|
set -euo pipefail
|
|
|
|
DEST="/home/loca/backups/stacks/$(date +%F)"
|
|
mkdir -p "$DEST"
|
|
|
|
# (a) Coder control-plane database
|
|
docker compose -f /home/loca/dev/coder/docker-compose.yml exec -T database \
|
|
pg_dump -U coder coder | gzip > "$DEST/coder-db.sql.gz"
|
|
|
|
# (b) Continue's real state (config + chat sessions live outside the project)
|
|
tar czf "$DEST/continue-config.tgz" -C /home/loca .continue
|
|
|
|
# (c) Stack configuration (source of truth for both deployments)
|
|
tar czf "$DEST/stack-configs.tgz" --exclude .git -C /home/loca/dev \
|
|
code-server/config code-server/scripts code-server/deploy \
|
|
coder/docker-compose.yml coder/deploy coder/templates coder/config
|
|
|
|
# (d) Retention: keep 14 days of dated directories
|
|
find /home/loca/backups/stacks -maxdepth 1 -mindepth 1 -type d -mtime +14 \
|
|
-exec rm -rf {} +
|
|
|
|
printf 'backup complete: %s\n' "$DEST"
|
|
ls -l "$DEST"
|