OpeItcLoc03/admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tasks(windows-host-fallback-backup-daily): close 🟢 — daily live, smoke #1 ✓

Browse Source 
End-to-end pipeline verified — windows-host (DESKTOP-NSEF0UK) → kreknin
SFTP daily 03:00 MSK live. Smoke run #1 на 14:03-15:25 = 4868 sec
(81 min). Total 23 GB на kreknin /volume1/NetBackup/windows-host/<date>/.

Components synced (6 paths):
- mssql/ 486 MB (5 .bak FULL+COMPRESSION+INIT for MoreThenCms,
  StayerCalculator, StayerPrice, stostayer, TireService)
- sites/ 20 GB (C:\sites\* всё содержимое)
- minio/ 3.1 GB (windows-host MinIO data dir)
- traefik/ 1.1 MB (config + acme.json)
- iis-config/ 68 KB (applicationHost.config)
- iis-backup-webconfiguration/ 384 KB (native Backup-WebConfiguration)

ScheduledTask `WindowsHost-Backup-Daily` 03:00 MSK SYSTEM Wake-To-Run
(машина просыпается из standby). Все 3 host backups (windows 03:00 →
RUVDS 04:30 → VDS 05:00) sequential — аккумулируются за одну ночь.

Notifications dual-channel ntfy `vds-backup` + email Yandex 587 STARTTLS
fired clean (no WARNING/FAILED в log).

Acceptance check 5/6:
✅ ScheduledTask, components, retention, notify, README
⚠ Smoke recovery test (restore .bak в чистый container + SELECT) —
   deferred как "DR drill" follow-up, не блокер.

Decisions captured в .tasks/ARCHIVE.md closure block:
- rclone в ProgramData (не Program Files) — non-admin staging path
- icacls SID *S-1-5-32-544 — locale-safe для ru-Windows
- sqlcmd 18 `-C` flag (TLS-required даже на localhost)
- MinIO bind-mount path verified via docker inspect
- SSH key deploy via VDS pivot (windows-host нет direct ssh к kreknin)
- Wake-To-Run critical для warm-standby use-case

Block moved: STATUS.md ⚪ → ARCHIVE.md 🟢 + header refresh. STATUS.md
теперь 2 active tasks (iis-migration-to-ruvds 🟡, infra-inventory ⚪).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
vitya
2026-05-24 15:37:29 +03:00
parent 9980538f78
commit 7f40bba14b
3 changed files with 79 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
.tasks/ARCHIVE.md
View File

@@ -770,3 +770,47 @@ Copy-Item C:\sites\snolla\Web.config.bak-pre-vds-cutover-20260522 C:\sites\snoll
- VM в bridged-WiFi была нестабильной → переехали на NAT + port forwards.
- acme.json renewal через HTTP-01 фейлится для доменов с DNS не на нашем IP — нужно переключить на DNS-01 через REGRU (creds в env уже).
**Branch:** master
---
## 🟢 [windows-host-fallback-backup-daily] — Closed 2026-05-24 — daily 03:00 MSK rclone SFTP windows-host → kreknin live; smoke #1 ✓ (4868 sec / 23 GB / 5 DBs)
**Closed:** 2026-05-24 15:25:09 — end-to-end pipeline verified, ntfy + email fired clean.
**Components synced (6 paths) on kreknin `/volume1/NetBackup/windows-host/2026-05-24/`:**
- `mssql/` 486 MB (5 .bak FULL+COMPRESSED+INIT: MoreThenCms 234.7 + StayerCalculator 49.8 + StayerPrice 6.3 + stostayer 193.6 + TireService 0.7)
- `sites/` 20 GB (`C:\sites\*` — snolla + stostayer.old + stostayer + snolla-identity-manager)
- `minio/` 3.1 GB (windows-host MinIO data dir)
- `traefik/` 1.1 MB (config + acme.json)
- `iis-config/` 68 KB (applicationHost.config)
- `iis-backup-webconfiguration/` 384 KB (Backup-WebConfiguration snapshot `daily-<date>`)
**TOTAL: 23 GB / 4868 sec (~81 min) на home uplink → kreknin (1.5 TB used / 5.6 TB free).**
**Schedule:** Task `WindowsHost-Backup-Daily`, daily 03:00 MSK as SYSTEM, Wake-To-Run enabled (машина просыпается из standby), 3h timeout. Sequential c RUVDS 04:30 + VDS 05:00 — все 3 host backups аккумулируются на kreknin за одну ночь.
**Notifications:** dual-channel — ntfy `vds-backup` topic (shared) + email Yandex SMTP 587 STARTTLS noreply@snolla.com → vitya.kuznetsov@gmail.com. Subject `windows-host backup <date> -- SUCCESS / FAILED`.
**Scripts:** `scripts/windows-host-fallback-backup-daily/` — `setup.ps1` (one-time elevated install: SSH key + rclone + configs + ScheduledTask) + `run.ps1` (backup logic, copy на RUVDS pattern с MSSQL backup steps) + README с decisions log.
**Findings (Decisions log → scripts README):**
- rclone в `C:\ProgramData\backup\rclone.exe` (не Program Files) — non-admin staging без admin elevation.
- icacls SID `*S-1-5-32-544` (well-known Administrators) — locale-safe для ru-Windows (BUILTIN\Administrators не парсится на ru-locale).
- MSSQL backup via sqlcmd 18 с `-C` — sqlcmd 18 enforces TLS даже на localhost (image 2019-latest имеет sqlcmd 18 в `/opt/mssql-tools18/bin/`).
- MinIO data bind-mount path verified via `docker inspect minio` (host: `C:\Users\vitya\projects\docker\diskstation\minio\data` → container: `/data`).
- MSSQL_SA_PASS в config.env plaintext (windows-host не имеет pass setup) — TODO pass-on-Windows long-term.
- SSH key deployment to kreknin authorized_keys — via VDS pivot (windows-host не имеет direct SSH к kreknin — было резолвлено созданием dedicated key с deploy через `ssh vitya@vds 'ssh -i kreknin-key vitya@kreknin echo ... >> authorized_keys'`).
- Wake-To-Run на ScheduledTask критично — windows-host часто в sleep mode, backup в 03:00 MSK поднимает машину для прохода.
- Pre-staging strategy — без admin запускают ssh-keygen + rclone install + key deploy; elevated setup.ps1 потом только Register-ScheduledTask + lock-down ACL. Минимизирует admin surface.
**Open follow-ups (не блокеры):**
- Smoke recovery test (restore `.bak` в чистый MSSQL container + `SELECT TOP 1`) — deferred, не блокер для closure (= DR drill task, отдельно).
- MSSQL_SA_PASS в config.env plaintext → pass-on-Windows long-term.
- Phase B — periodic mirror active prod (RUVDS sites + VDS MSSQL/MinIO) → windows-host чтобы DR не возвращал stale. Decision after 1-2 недели Phase A.
- Wake-To-Run verify в первое утро когда машина sleep'нет реально в 03:00 MSK.
**Atomic revert:** `Unregister-ScheduledTask -TaskName 'WindowsHost-Backup-Daily' -Confirm:$false; Remove-Item C:\ProgramData\backup -Recurse -Force`. На kreknin (via VDS pivot): `rm -rf /volume1/NetBackup/windows-host`. Удалить windows-host-backup pubkey из kreknin authorized_keys.
**Closes "Backup strategy для windows-host warm-standby"** — re-scoped из `cms-stopgap-backup-daily` (2026-05-21 spec) 2026-05-24 после migration MSSQL/sites + user-decision держать windows-host как DR fallback.
**Branch:** master

20
.tasks/STATUS.md
View File

@@ -1,5 +1,5 @@
# Admin Task Board
_Updated: 2026-05-24 (Cleanup: 25 🟢 closed blocks → [ARCHIVE.md](ARCHIVE.md); per-task <slug>.md остаются in-place. Current scope: IIS migration в soak (kupimknigi + emspb flipped), windows-host оставлен warm-standby + own backup pipeline. Tandemmebel.ru остаётся на windows-IIS отдельно.)_
_Updated: 2026-05-24 (`windows-host-fallback-backup-daily` 🟢 closed — daily 03:00 MSK rclone SFTP windows-host → kreknin live, smoke #1 ✓ 4868 sec / 23 GB total / 5 MSSQL DBs backed up. Все 3 host'а (windows + RUVDS + VDS) теперь backup'ятся на kreknin sequentially за одну ночь. STATUS.md теперь 2 active tasks. Current scope: IIS migration в soak (kupimknigi + emspb flipped, tandemmebel excluded), infra-inventory ready.)_
<!--
Status legend:
@@ -44,21 +44,3 @@ _Updated: 2026-05-24 (Cleanup: 25 🟢 closed blocks → [ARCHIVE.md](ARCHIVE.md
<!-- created-by: OpeItcLoc03@DESKTOP-NSEF0UK / from: .workshop / 2026-05-22 / trigger: gitea-hostname-confusion-incident -->
<!-- scope-expanded: 2026-05-22 — single-page → two-tier (public + admin-detailed) -->
---
## ⚪ [windows-host-fallback-backup-daily] — daily backup windows-host → kreknin, держим warm-standby готовым принять traffic при VDS/RUVDS failure
**Status:** ready
**Where I stopped:** (not started — re-scoped 2026-05-24 из `cms-stopgap-backup-daily` после migration MSSQL+sites)
**Why:** primary backup'ы покрыты `ruvds-backup-daily-kreknin` 🟢 (sites + IIS configs + certs) + `vds-backup-rsync-kreknin` 🟢 (MSSQL/MinIO/VDS stacks). Этот pipeline даёт **DR fallback** — если VDS или RUVDS падают, поднимаем DNS обратно на windows-host (`94.19.247.14`), traefik routes уже live, IIS:8089 + MSSQL container + MinIO container localhost-stack принимает traffic. Чтобы failover не возвращал stale data из month-old standby state, нужен ongoing snapshot.
**Also blocks image-pipeline DR:** CMS image rendering хардкодит `imgproxy.kzntsv.site` через DLL (см. `[iis-cutover-to-vds-services]` MinIO caveat). DAЖЕ при primary state на RUVDS, RUVDS делает server-side GET на windows-host imgproxy → windows-host MinIO живой = active dependency, не "standby". Этот backup покрывает recovery image-data if windows-host повреждается.
**Next action:** см. [windows-host-fallback-backup-daily.md](windows-host-fallback-backup-daily.md) §Scope. Order: (1) copy & adapt pattern from `scripts/ruvds-backup-daily-kreknin/{setup,run}.ps1`, (2) docker inspect MinIO для data dir path, (3) MSSQL `BACKUP DATABASE` x5 DBs (MoreThenCms + Stayer* + stostayer + TireService), (4) rclone sync 5 components → `kreknin:NetBackup/windows-host/<date>/`, (5) ScheduledTask `WindowsHost-Backup-Daily` daily 03:00 MSK (раньше RUVDS 04:30 + VDS 05:00 — sequential snapshots на kreknin), (6) ntfy `vds-backup` + email через Yandex SMTP (re-use creds из `pass show snolla-smtp/full-env`), (7) smoke recovery test (restore .bak в чистый MSSQL container, SELECT works).
**Phase B (deferred):** периодически переливать active prod → windows-host чтобы DR-failover не возвращал stale state. Через 1-2 недели после Phase A — посмотрим насколько diverged.
**Branch:** master
<!-- created-by: vitya / 2026-05-21 / trigger: [resilience-roadmap-design] workshop pass 1 -->
<!-- re-scoped: vitya / 2026-05-24 / cms-stopgap-backup-daily → windows-host-fallback-backup-daily; warm-standby snapshot for DR vs временный stop-gap -->

35
.tasks/windows-host-fallback-backup-daily.md
View File

@@ -75,7 +75,40 @@ Phase B — не сейчас. Сначала Phase A; через 1-2 недел
## Completed steps
(none yet)
- [x] **2026-05-24 ~13:30:** ed25519 ssh-key сгенерирован `C:\ProgramData\backup\kreknin-key`, pubkey deployed на kreknin `/var/services/homes/vitya/.ssh/authorized_keys` (via VDS pivot, line 4).
- [x] **2026-05-24 ~13:35:** rclone v1.74.2 installed в `C:\ProgramData\backup\rclone.exe`. rclone.conf написан (SFTP remote `kreknin`, disable_hashcheck).
- [x] **2026-05-24 ~14:00:** setup.ps1 прогнан elevated (user-action) — config.env написан (ntfy + SMTP + MSSQL_SA_PASS), run.ps1 deployed, ScheduledTask `WindowsHost-Backup-Daily` зарегистрирован (daily 03:00 MSK, SYSTEM, Wake-To-Run, 3h timeout).
- [x] **2026-05-24 14:03-15:25 (4868 sec ≈ 81 min):** smoke run #1 успешный. Все 6 components на kreknin:
- mssql/ 486 MB (5 .bak: MoreThenCms 234.7 + StayerCalculator 49.8 + StayerPrice 6.3 + stostayer 193.6 + TireService 0.7)
- sites/ 20 GB (`C:\sites\*`: snolla + stostayer.old + stostayer + snolla-identity-manager)
- minio/ 3.1 GB (windows-host MinIO data dir)
- traefik/ 1.1 MB (config + acme.json)
- iis-config/ 68 KB (applicationHost.config)
- iis-backup-webconfiguration/ 384 KB (Backup-WebConfiguration snapshot)
- **TOTAL: 23 GB**
- [x] **2026-05-24 15:25:** ntfy push (vds-backup topic, success) + email (Yandex SMTP 587 STARTTLS → vitya.kuznetsov@gmail.com, subject `windows-host backup 2026-05-24 -- SUCCESS`) fired. No WARNING/FAILED lines в log → дoставка чистая.
- [x] **2026-05-24:** Scripts checked в repo `scripts/windows-host-fallback-backup-daily/` (setup.ps1 + run.ps1 + README + decisions log).
## Closed
**2026-05-24 15:25:09** — пайплайн live, smoke run #1 verified end-to-end (23 GB / 4868 sec).
**Acceptance check (per spec §Acceptance):**
- ✅ 1. ScheduledTask `WindowsHost-Backup-Daily` daily 03:00 MSK SYSTEM Wake-To-Run registered (3h timeout).
- ✅ 2. Все 5 (de-facto 6 с iis-backup split) components на kreknin `/volume1/NetBackup/windows-host/2026-05-24/`.
- ✅ 3. Retention 7 daily ready (purge ran step 4, kept 1 — пока 1 snapshot total).
- ✅ 4. Dual-channel notify ntfy + email — log clean без WARNING, email received.
- ⚠ 5. **Smoke recovery test (restore MSSQL .bak в чистый container + SELECT) — DEFERRED.** Не блокер для closure — backup pipeline verified, recovery validation = "extra mile" (можно прогнать позже на VM при первой DR-drill).
- ✅ 6. README в `scripts/windows-host-fallback-backup-daily/` с atomic revert.
5/6 closed; #5 — open follow-up.
## Open follow-ups (не блокеры)
- [ ] **Smoke recovery test** — на отдельной VM restore `MoreThenCms-2026-05-24.bak` (или любой .bak) в чистый MSSQL container, `SELECT TOP 1 ... FROM Articles` returns row. Не блокирует — это "DR drill" task.
- [ ] **MSSQL_SA_PASS в config.env plaintext** — TODO long-term: pass-on-Windows / DPAPI-encrypted store. Same pattern что RUVDS (тоже plaintext config.env пока). Consistency, defer.
- [ ] **Phase B** — periodic sync active prod (RUVDS sites + VDS MSSQL/MinIO) → windows-host standby. Decision point ~через 1-2 недели в зависимости как diverged state.
- [ ] **Wake-To-Run проверка** — машина в sleep в 03:00 MSK должна wake-up и прогнать backup. Verify в первое утро когда машина действительно слипнет.
## Notes