tasks(ruvds-backup-daily-kreknin): close 🟢 — live на 04:30 MSK daily

End-to-end pipeline отработан, run #1 verified 20 sec, 8.8 GB snolla +
IIS configs + 14 certs + sshd state → /volume1/NetBackup/ruvds-iis/<date>/
на kreknin. Retention 7 daily, ntfy vds-backup topic.

Scripts checked into scripts/ruvds-backup-daily-kreknin/:
- setup.ps1 (one-time install: SSH key + rclone + configs + ScheduledTask)
- run.ps1 (live backup logic; Invoke-Rclone wrapper для NOTICE-on-stderr)
- README.md (decisions log, smoke instructions, atomic revert)

Bugs found and fixed during smoke (см. README Decisions log):
1. Backup-WebConfiguration -Force параметра нет → check + Remove first
2. rclone --log-file lock с PS Start-Transcript → drop --log-file
3. rclone NOTICE на stderr + $ErrorActionPreference=Stop → Invoke-Rclone
   wrapper temporarily switches к Continue
4. ssh-keyscan known_hosts не parsится rclone go-sftp → drop pinning,
   rely on key-auth

Закрывает "Backup strategy для RUVDS IIS" Open question в
[iis-migration-to-ruvds].

Open follow-ups (не блокер):
- PFX export pass plaintext в скрипте — TODO move to gpg/DPAPI
- Retention prune (kept 1 today) — verify в day 8
- Phone-side ntfy push — user verifies

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.tasks/STATUS.md

@@ -1,5 +1,5 @@
 # Admin Task Board
-_Updated: 2026-05-24 (IIS migration to RUVDS — **partial cutover live**: snolla site (8.66 GB / 44725 files) transferred via scp (после ISP outbound-445 block обнаружен), IIS recreated, 25 HTTPS SNI bindings с LE certs (re-used from traefik acme.json), 7 prod hostnames live-smoked через VDS (третья сеть) → 200 OK + correct content. DNS A для kupimknigi.spb.ru flipped на 80.64.31.36 (после initial misroute на VDS). Soak window: 24h+. Source IIS:8089 + traefik routes ALIVE — rollback ready. Previous: temp admin start 2026-05-23 09:37-18:08, dropped на UNC-robocopy exit 16; secrets-leak в `.secrets/` fixed → `pass`. См. также 2026-05-22 chain: MSSQL Express 2022 live на `mssql.kzntsv.site:1433` (5 DBs, 8 prod hosts 200 OK), MinIO/imgproxy VDS standby.)_
+_Updated: 2026-05-24 (RUVDS backup pipeline live — `[ruvds-backup-daily-kreknin]` 🟢: rclone SFTP daily 04:30 MSK, 5 components synced (8.8 GB snolla + IIS configs + certs + sshd state) to `/volume1/NetBackup/ruvds-iis/<date>/` на kreknin, retention 7 daily, ntfy `vds-backup` topic shared с VDS backup. Run #1 verified 11:46:51 — 20 sec full sync. Earlier today: IIS migration partial cutover — snolla site (8.66 GB) transferred via scp (после ISP outbound-445 block), IIS recreated, 25 HTTPS SNI bindings с LE certs (re-used from traefik acme.json), 7 prod hostnames live-smoked через VDS (третья сеть) → 200 OK. DNS A для kupimknigi.spb.ru flipped → 80.64.31.36. Soak window 24h+, source IIS:8089 + traefik routes ALIVE — rollback ready.)_
 
 <!--
   Status legend:
@@ -698,15 +698,40 @@ Copy-Item C:\sites\snolla\Web.config.bak-pre-vds-cutover-20260522 C:\sites\snoll
 
 ---
 
-## ⚪ [ruvds-backup-daily-kreknin] — ежедневный backup RUVDS → kreknin (rclone SFTP), параллель `[vds-backup-rsync-kreknin]`
+## 🟢 [ruvds-backup-daily-kreknin] — daily rclone SFTP RUVDS → kreknin live (run #1 ✓ 2026-05-24 11:46:51, 20 sec, all 5 components synced)
 
-**Status:** ready
-**Where I stopped:** (not started — создан 2026-05-24 параллельно soak'у `[iis-migration-to-ruvds]`)
-**Next action:** см. [ruvds-backup-daily-kreknin.md](ruvds-backup-daily-kreknin.md) полный sketch. Order: (1) install rclone single-binary на RUVDS, (2) generate SSH key для kreknin auth + user добавляет pubkey в kreknin `/volume1/homes/vitya/.ssh/authorized_keys`, (3) написать `C:\ProgramData\backup\run.ps1` (snolla sync + IIS config snapshot + cert export + ntfy notification + retention prune 7 daily), (4) Register-ScheduledTask `RUVDS-Backup-Daily` SYSTEM-account, 04:30 MSK (за 30 мин до VDS backup 05:00), (5) manual smoke run + verify kreknin path + ntfy push в vds-backup topic.
+**Closed:** 2026-05-24 11:46:51 — full pipeline live, ntfy success fired.
 
-Pattern параллель `[vds-backup-rsync-kreknin]` 🟢 (VDS Ubuntu + rsync + cron). Differences: Win Server Core → rclone (single .exe) + Task Scheduler + SYSTEM principal. Trigger: пока soak window открыт — даже до full cutover backup нужен для rollback-evidence. **Закрывает Open question "Backup strategy для RUVDS IIS"** из `[iis-migration-to-ruvds]`.
+**Components synced (5):**
+- `sites/snolla` 8.8 GB / 44725 files (`C:\sites\snolla\`)
+- `iis-config/` (`applicationHost.config`)
+- `iis-backup-webconfiguration/` (`Backup-WebConfiguration -Name daily-<date>` export)
+- `certs/` 14 PFX (LocalMachine\My private-key certs, pass `ruvds-backup-pfx`)
+- `ssh-config/` (sshd_config + administrators_authorized_keys)
+
+**Path on kreknin:** `/volume1/NetBackup/ruvds-iis/<date>/`. Retention 7 daily snapshots (pruned by rclone purge step 4).
+
+**Schedule:** Task `RUVDS-Backup-Daily`, daily 04:30 MSK as SYSTEM, 2h timeout.
+
+**Notifications:** ntfy `vds-backup` topic (shared с VDS backup для phone-side aggregation). Title differentiator: `RUVDS backup OK/FAILED (<date>)`.
+
+**Scripts:** `scripts/ruvds-backup-daily-kreknin/` — `setup.ps1` (one-time install: SSH key + rclone + configs + ScheduledTask) + `run.ps1` (live backup logic) + README.
+
+**Findings (Decisions log):**
+- rclone SFTP без host-key validation (rclone go-sftp library не parsит ssh-keyscan format корректно — key mismatch даже на fresh keys; key-auth = sufficient для нашего threat model)
+- `Invoke-Rclone` wrapper нужен — `$ErrorActionPreference='Stop'` + rclone NOTICE на stderr = PS terminating error; wrapper switches к Continue для rclone calls
+- `Backup-WebConfiguration -Force` параметр отсутствует на этой версии IIS module — используем `Remove-WebConfigurationBackup` если exists + plain `Backup-WebConfiguration`
+
+**Open follow-ups (не блокер):**
+- PFX export pass `ruvds-backup-pfx` — temporary. TODO: pass-equivalent на Windows (gpg4win + pass-bash, или derived от machine-creds).
+- Retention prune ещё не сработал (1 snapshot today, < 7); проверится в day 8.
+
+**Atomic revert:** см. `scripts/ruvds-backup-daily-kreknin/README.md` §Atomic revert.
+
+**Closes** "Backup strategy для RUVDS IIS" Open question в `[iis-migration-to-ruvds]`.
 **Branch:** master
 <!-- created-by: vitya / 2026-05-24 / trigger: post-iis-migration-partial-cutover -->
+<!-- closed-by: vitya / 2026-05-24 11:46:51 / run #1 OK 20 sec; full backup 8.8 GB on kreknin -->
 
 ---