tasks(ruvds-backup-daily-kreknin): close 🟢 — live на 04:30 MSK daily

End-to-end pipeline отработан, run #1 verified 20 sec, 8.8 GB snolla +
IIS configs + 14 certs + sshd state → /volume1/NetBackup/ruvds-iis/<date>/
на kreknin. Retention 7 daily, ntfy vds-backup topic.

Scripts checked into scripts/ruvds-backup-daily-kreknin/:
- setup.ps1 (one-time install: SSH key + rclone + configs + ScheduledTask)
- run.ps1 (live backup logic; Invoke-Rclone wrapper для NOTICE-on-stderr)
- README.md (decisions log, smoke instructions, atomic revert)

Bugs found and fixed during smoke (см. README Decisions log):
1. Backup-WebConfiguration -Force параметра нет → check + Remove first
2. rclone --log-file lock с PS Start-Transcript → drop --log-file
3. rclone NOTICE на stderr + $ErrorActionPreference=Stop → Invoke-Rclone
   wrapper temporarily switches к Continue
4. ssh-keyscan known_hosts не parsится rclone go-sftp → drop pinning,
   rely on key-auth

Закрывает "Backup strategy для RUVDS IIS" Open question в
[iis-migration-to-ruvds].

Open follow-ups (не блокер):
- PFX export pass plaintext в скрипте — TODO move to gpg/DPAPI
- Retention prune (kept 1 today) — verify в day 8
- Phone-side ntfy push — user verifies

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/ruvds-backup-daily-kreknin/README.md

@@ -0,0 +1,75 @@
+# ruvds-backup-daily-kreknin — scripts
+
+Ежедневный backup RUVDS (`80.64.31.36` Win Server 2025 Core) → kreknin Synology (`195.19.90.188:/volume1/NetBackup/ruvds-iis/<date>/`) via rclone SFTP.
+
+Live since **2026-05-24**. Schedule: daily **04:30 MSK**. Task name: `RUVDS-Backup-Daily`.
+
+## Files
+
+- `setup.ps1` — one-time install: SSH key, rclone, configs, ScheduledTask.
+- `run.ps1` — backup logic (synced to `C:\ProgramData\backup\run.ps1` by setup.ps1).
+
+## Initial install (rebuilding RUVDS from scratch)
+
+```powershell
+# На RUVDS, PowerShell as Administrator
+mkdir C:\backup-scripts -Force
+# Копируем оба файла из source repo:
+Copy-Item \\tsclient\C\Users\vitya\projects\.admin\scripts\ruvds-backup-daily-kreknin\*.ps1 C:\backup-scripts\
+C:\backup-scripts\setup.ps1
+```
+
+Setup паузится после генерации SSH key — нужно добавить `kreknin-key.pub` в `/volume1/homes/vitya/.ssh/authorized_keys` на kreknin (через SSH/DSM File Station), потом Enter.
+
+## What's backed up (5 components)
+
+| Component | Source | Remote path on kreknin |
+|---|---|---|
+| snolla site content | `C:\sites\snolla\` (~8.7 GB) | `NetBackup/ruvds-iis/<date>/sites/snolla/` |
+| applicationHost.config | `C:\Windows\System32\inetsrv\config\applicationHost.config` | `NetBackup/ruvds-iis/<date>/iis-config/` |
+| IIS native config backup | `Backup-WebConfiguration -Name daily-<date>` | `NetBackup/ruvds-iis/<date>/iis-backup-webconfiguration/` |
+| LE certs (PFX export) | `Cert:\LocalMachine\My` private-key certs (14 PFX, pass `ruvds-backup-pfx`) | `NetBackup/ruvds-iis/<date>/certs/` |
+| SSH state | `C:\ProgramData\ssh\` (sshd_config + administrators_authorized_keys) | `NetBackup/ruvds-iis/<date>/ssh-config/` |
+
+Retention: **7 daily snapshots**. Older — pruned by `rclone purge` in step 4.
+
+## Notifications
+
+ntfy topic `vds-backup` (shared with VDS backup) — phone push:
+- Success: title `RUVDS backup OK (<date>)`, tag `green_circle`, priority `default`
+- Fail: title `RUVDS backup FAILED (<date>)`, tag `red_circle`, priority `high`
+
+## Decisions log
+
+- **rclone, not rsync** — Win Server Core нет cygwin/WSL, rsync.exe = пакет, security surface. rclone single .exe.
+- **SFTP без host-key validation** — rclone go-sftp library не parsит SSH known_hosts с keyscan format корректно (key mismatch error даже на fresh keyscan). Path RUVDS↔kreknin через public internet, но key auth достаточно для нашего threat model. Если threat model меняется — populate known_hosts file from `ssh-keyscan` в правильном format.
+- **`Invoke-Rclone` wrapper** — `$ErrorActionPreference = 'Stop'` + rclone NOTICE на stderr = native command terminating-error в PS. Wrapper temporarily switches к Continue для rclone calls, restores after. Без этого `2>$null` не помогает (PS видит non-empty stderr stream как error).
+- **`Backup-WebConfiguration -Force`** — параметра нет в этой версии WebAdministration module. Используем `Get-WebConfigurationBackup + Remove-WebConfigurationBackup` если exist + plain `Backup-WebConfiguration`.
+- **Cert PFX export pass = `ruvds-backup-pfx`** — temporary. TODO: pass-equivalent на Windows (gpg4win + pass-bash) или derived от machine-creds.
+- **SYSTEM principal, не user account** — Task Scheduler SYSTEM имеет full access к C:\sites\, Cert:\LocalMachine\My, %SystemRoot%\System32\inetsrv\, не требует stored-password. Pattern matches VDS root-cron decision.
+
+## Smoke run (manual)
+
+```powershell
+Start-ScheduledTask -TaskName 'RUVDS-Backup-Daily'
+# Watch:
+Get-Content C:\ProgramData\backup\logs\(Get-Date -Format yyyy-MM-dd).log -Wait
+```
+
+Verify on kreknin:
+```powershell
+ssh vitya@195.19.90.188 'du -sh /volume1/NetBackup/ruvds-iis/*/sites/snolla/'
+```
+
+## Atomic revert (uninstall)
+
+```powershell
+# On RUVDS:
+Unregister-ScheduledTask -TaskName 'RUVDS-Backup-Daily' -Confirm:$false
+Remove-Item C:\ProgramData\backup -Recurse -Force
+# Optionally: Remove-Item 'C:\Program Files\rclone' -Recurse -Force
+
+# On kreknin (via SSH):
+ssh vitya@195.19.90.188 'rm -rf /volume1/NetBackup/ruvds-iis'
+# Remove the RUVDS pubkey line from authorized_keys (one line with 'ruvds-backup' comment).
+```