tasks(windows-host-fallback-backup-daily): close 🟢 — daily live, smoke #1 ✓

End-to-end pipeline verified — windows-host (DESKTOP-NSEF0UK) → kreknin
SFTP daily 03:00 MSK live. Smoke run #1 на 14:03-15:25 = 4868 sec
(81 min). Total 23 GB на kreknin /volume1/NetBackup/windows-host/<date>/.

Components synced (6 paths):
- mssql/ 486 MB (5 .bak FULL+COMPRESSION+INIT for MoreThenCms,
  StayerCalculator, StayerPrice, stostayer, TireService)
- sites/ 20 GB (C:\sites\* всё содержимое)
- minio/ 3.1 GB (windows-host MinIO data dir)
- traefik/ 1.1 MB (config + acme.json)
- iis-config/ 68 KB (applicationHost.config)
- iis-backup-webconfiguration/ 384 KB (native Backup-WebConfiguration)

ScheduledTask `WindowsHost-Backup-Daily` 03:00 MSK SYSTEM Wake-To-Run
(машина просыпается из standby). Все 3 host backups (windows 03:00 →
RUVDS 04:30 → VDS 05:00) sequential — аккумулируются за одну ночь.

Notifications dual-channel ntfy `vds-backup` + email Yandex 587 STARTTLS
fired clean (no WARNING/FAILED в log).

Acceptance check 5/6:
✅ ScheduledTask, components, retention, notify, README
⚠ Smoke recovery test (restore .bak в чистый container + SELECT) —
   deferred как "DR drill" follow-up, не блокер.

Decisions captured в .tasks/ARCHIVE.md closure block:
- rclone в ProgramData (не Program Files) — non-admin staging path
- icacls SID *S-1-5-32-544 — locale-safe для ru-Windows
- sqlcmd 18 `-C` flag (TLS-required даже на localhost)
- MinIO bind-mount path verified via docker inspect
- SSH key deploy via VDS pivot (windows-host нет direct ssh к kreknin)
- Wake-To-Run critical для warm-standby use-case

Block moved: STATUS.md ⚪ → ARCHIVE.md 🟢 + header refresh. STATUS.md
теперь 2 active tasks (iis-migration-to-ruvds 🟡, infra-inventory ⚪).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.tasks/ARCHIVE.md

@@ -770,3 +770,47 @@ Copy-Item C:\sites\snolla\Web.config.bak-pre-vds-cutover-20260522 C:\sites\snoll
   - VM в bridged-WiFi была нестабильной → переехали на NAT + port forwards.
   - acme.json renewal через HTTP-01 фейлится для доменов с DNS не на нашем IP — нужно переключить на DNS-01 через REGRU (creds в env уже).
 **Branch:** master
+
+---
+
+## 🟢 [windows-host-fallback-backup-daily] — Closed 2026-05-24 — daily 03:00 MSK rclone SFTP windows-host → kreknin live; smoke #1 ✓ (4868 sec / 23 GB / 5 DBs)
+
+**Closed:** 2026-05-24 15:25:09 — end-to-end pipeline verified, ntfy + email fired clean.
+
+**Components synced (6 paths) on kreknin `/volume1/NetBackup/windows-host/2026-05-24/`:**
+- `mssql/` 486 MB (5 .bak FULL+COMPRESSED+INIT: MoreThenCms 234.7 + StayerCalculator 49.8 + StayerPrice 6.3 + stostayer 193.6 + TireService 0.7)
+- `sites/` 20 GB (`C:\sites\*` — snolla + stostayer.old + stostayer + snolla-identity-manager)
+- `minio/` 3.1 GB (windows-host MinIO data dir)
+- `traefik/` 1.1 MB (config + acme.json)
+- `iis-config/` 68 KB (applicationHost.config)
+- `iis-backup-webconfiguration/` 384 KB (Backup-WebConfiguration snapshot `daily-<date>`)
+
+**TOTAL: 23 GB / 4868 sec (~81 min) на home uplink → kreknin (1.5 TB used / 5.6 TB free).**
+
+**Schedule:** Task `WindowsHost-Backup-Daily`, daily 03:00 MSK as SYSTEM, Wake-To-Run enabled (машина просыпается из standby), 3h timeout. Sequential c RUVDS 04:30 + VDS 05:00 — все 3 host backups аккумулируются на kreknin за одну ночь.
+
+**Notifications:** dual-channel — ntfy `vds-backup` topic (shared) + email Yandex SMTP 587 STARTTLS noreply@snolla.com → vitya.kuznetsov@gmail.com. Subject `windows-host backup <date> -- SUCCESS / FAILED`.
+
+**Scripts:** `scripts/windows-host-fallback-backup-daily/` — `setup.ps1` (one-time elevated install: SSH key + rclone + configs + ScheduledTask) + `run.ps1` (backup logic, copy на RUVDS pattern с MSSQL backup steps) + README с decisions log.
+
+**Findings (Decisions log → scripts README):**
+- rclone в `C:\ProgramData\backup\rclone.exe` (не Program Files) — non-admin staging без admin elevation.
+- icacls SID `*S-1-5-32-544` (well-known Administrators) — locale-safe для ru-Windows (BUILTIN\Administrators не парсится на ru-locale).
+- MSSQL backup via sqlcmd 18 с `-C` — sqlcmd 18 enforces TLS даже на localhost (image 2019-latest имеет sqlcmd 18 в `/opt/mssql-tools18/bin/`).
+- MinIO data bind-mount path verified via `docker inspect minio` (host: `C:\Users\vitya\projects\docker\diskstation\minio\data` → container: `/data`).
+- MSSQL_SA_PASS в config.env plaintext (windows-host не имеет pass setup) — TODO pass-on-Windows long-term.
+- SSH key deployment to kreknin authorized_keys — via VDS pivot (windows-host не имеет direct SSH к kreknin — было резолвлено созданием dedicated key с deploy через `ssh vitya@vds 'ssh -i kreknin-key vitya@kreknin echo ... >> authorized_keys'`).
+- Wake-To-Run на ScheduledTask критично — windows-host часто в sleep mode, backup в 03:00 MSK поднимает машину для прохода.
+- Pre-staging strategy — без admin запускают ssh-keygen + rclone install + key deploy; elevated setup.ps1 потом только Register-ScheduledTask + lock-down ACL. Минимизирует admin surface.
+
+**Open follow-ups (не блокеры):**
+- Smoke recovery test (restore `.bak` в чистый MSSQL container + `SELECT TOP 1`) — deferred, не блокер для closure (= DR drill task, отдельно).
+- MSSQL_SA_PASS в config.env plaintext → pass-on-Windows long-term.
+- Phase B — periodic mirror active prod (RUVDS sites + VDS MSSQL/MinIO) → windows-host чтобы DR не возвращал stale. Decision after 1-2 недели Phase A.
+- Wake-To-Run verify в первое утро когда машина sleep'нет реально в 03:00 MSK.
+
+**Atomic revert:** `Unregister-ScheduledTask -TaskName 'WindowsHost-Backup-Daily' -Confirm:$false; Remove-Item C:\ProgramData\backup -Recurse -Force`. На kreknin (via VDS pivot): `rm -rf /volume1/NetBackup/windows-host`. Удалить windows-host-backup pubkey из kreknin authorized_keys.
+
+**Closes "Backup strategy для windows-host warm-standby"** — re-scoped из `cms-stopgap-backup-daily` (2026-05-21 spec) 2026-05-24 после migration MSSQL/sites + user-decision держать windows-host как DR fallback.
+
+**Branch:** master