scripts(windows-host-fallback-backup-daily): add setup.ps1 + run.ps1 + README
Daily backup windows-host (DESKTOP-NSEF0UK) → kreknin via rclone SFTP. Pattern parallels ruvds-backup-daily-kreknin 🟢. Components (5): - MSSQL container: docker exec BACKUP DATABASE × 5 DBs (MoreThenCms, StayerCalculator, StayerPrice, stostayer, TireService) с COMPRESSION, INIT, FORMAT → docker cp → rclone sync - Sites: C:\sites\ - MinIO data: C:\Users\vitya\projects\docker\diskstation\minio\data - Traefik: C:\Users\vitya\projects\docker\diskstation\traefik\ - IIS config: applicationHost.config + Backup-WebConfiguration export Schedule: daily 03:00 MSK (sequential с RUVDS 04:30 + VDS 05:00). Wake-To-Run enabled — машина просыпается из standby на backup. SYSTEM principal (full access к C:\sites + Cert store + IIS metadata). Retention 7 daily snapshots. Notifications: dual-channel — ntfy `vds-backup` topic (shared) + email via Yandex SMTP 587 STARTTLS, noreply@snolla.com → ops gmail. Same creds как другие backup pipelines. Decisions log в README: - rclone в `C:\ProgramData\backup\rclone.exe` (не Program Files) — избегаем admin requirement на user-context staging. - icacls SID `*S-1-5-32-544` (well-known Administrators) — locale-safe для RU/EN Windows (BUILTIN\Administrators не парсится на ru-locale). - MSSQL backup via sqlcmd 18 с -C (trust cert) — TLS-required даже на localhost в новых mssql tools. - MSSQL_SA_PASS в config.env (windows-host не имеет pass setup); TODO pass-on-Windows long-term. Pre-staging уже сделано (ssh-key + kreknin authorized_keys via VDS pivot, rclone в ProgramData, SFTP smoke OK). setup.ps1 (elevated) пройдёт idempotent через staged steps, only Register-ScheduledTask fresh. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
95
scripts/windows-host-fallback-backup-daily/README.md
Normal file
95
scripts/windows-host-fallback-backup-daily/README.md
Normal file
@@ -0,0 +1,95 @@
|
||||
# windows-host-fallback-backup-daily — scripts
|
||||
|
||||
Daily backup `windows-host` (DESKTOP-NSEF0UK) → kreknin Synology (`/volume1/NetBackup/windows-host/<date>/`) via rclone SFTP.
|
||||
|
||||
**Purpose:** держать windows-host warm-standby state свежим для DR failover (см. `.tasks/windows-host-fallback-backup-daily.md` §Goal).
|
||||
|
||||
Schedule: daily **03:00 MSK** (раньше RUVDS 04:30 + VDS 05:00 — sequential snapshots). Task name: `WindowsHost-Backup-Daily`. Wake-To-Run enabled чтобы машина просыпалась на backup даже в sleep state.
|
||||
|
||||
## Files
|
||||
|
||||
- `setup.ps1` — one-time install: SSH key, rclone (в `C:\ProgramData\backup\rclone.exe`), configs, ScheduledTask. **Требует elevated PowerShell** (для ScheduledTask SYSTEM + icacls). Параметры `-SmtpPass <yandex-pass>` + `-MssqlSaPass <mssql-sa-pass>`.
|
||||
- `run.ps1` — backup logic (deployed by setup.ps1 to `C:\ProgramData\backup\run.ps1`). rclone берёт из `$base\rclone.exe`, ssh key из `$base\kreknin-key`.
|
||||
|
||||
## What's backed up (5 components)
|
||||
|
||||
| Component | Source on windows-host | Remote path on kreknin |
|
||||
|---|---|---|
|
||||
| MSSQL container | docker exec `BACKUP DATABASE` × 5 DBs → docker cp → sync | `NetBackup/windows-host/<date>/mssql/` |
|
||||
| Sites | `C:\sites\` (snolla 8.66 GB + stostayer + .old + identity-manager) | `NetBackup/windows-host/<date>/sites/` |
|
||||
| MinIO data | `C:\Users\vitya\projects\docker\diskstation\minio\data\` | `NetBackup/windows-host/<date>/minio/` |
|
||||
| Traefik | `C:\Users\vitya\projects\docker\diskstation\traefik\` (config + `acme.json`) | `NetBackup/windows-host/<date>/traefik/` |
|
||||
| IIS config | `applicationHost.config` + `Backup-WebConfiguration` snapshot | `NetBackup/windows-host/<date>/iis-config/` + `iis-backup-webconfiguration/` |
|
||||
|
||||
MSSQL DBs: `MoreThenCms`, `StayerCalculator`, `StayerPrice`, `stostayer`, `TireService`. Backup type: FULL daily, `WITH COMPRESSION, INIT`. Backups создаются внутри контейнера в `/var/opt/mssql/backup/`, потом `docker cp` на host в temp dir, потом rclone sync.
|
||||
|
||||
Retention: **7 daily snapshots**, prune step 4.
|
||||
|
||||
## Notifications
|
||||
|
||||
**Dual-channel** (oба после каждого run):
|
||||
|
||||
- **ntfy** topic `vds-backup` (shared с VDS+RUVDS backups) — phone push через ntfy mobile app
|
||||
- **Email** via Yandex SMTP 587 STARTTLS — `noreply@snolla.com` → `vitya.kuznetsov@gmail.com`
|
||||
|
||||
Subject formatting: `windows-host backup <date> -- SUCCESS / FAILED`.
|
||||
|
||||
Notify-functions wrapped в try/catch — backup itself не fail'ит при notify сбое.
|
||||
|
||||
## Initial install
|
||||
|
||||
```powershell
|
||||
# На windows-host, PowerShell as Administrator
|
||||
# (этот repo уже здесь)
|
||||
cd C:\Users\vitya\projects\.admin\scripts\windows-host-fallback-backup-daily
|
||||
|
||||
# Pull SMTP + SA creds из pass (или передать вручную)
|
||||
$smtpPass = bash -lc 'pass show snolla-smtp/full-env' | Select-String 'SMTP_PASS=' | %{ ($_ -split '=', 2)[1] }
|
||||
$saPass = docker inspect mssql --format '{{range .Config.Env}}{{println .}}{{end}}' | Select-String '^MSSQL_SA_PASSWORD=' | %{ ($_ -split '=', 2)[1] }
|
||||
|
||||
.\setup.ps1 -SmtpPass $smtpPass -MssqlSaPass $saPass
|
||||
```
|
||||
|
||||
Между шагом 1 и 6 setup паузится — нужно добавить kreknin-key.pub в `/var/services/homes/vitya/.ssh/authorized_keys` на kreknin (через File Station UI, SSH, или **VDS pivot** if local SSH к kreknin не setup):
|
||||
|
||||
```bash
|
||||
# VDS pivot (если нет direct SSH с этой машины к kreknin):
|
||||
PUBKEY='<paste content of C:\ProgramData\backup\kreknin-key.pub>'
|
||||
ssh vitya@89.253.255.94 "ssh -i ~/.ssh/id_ed25519_kreknin vitya@195.19.90.188 'echo \"$PUBKEY\" >> ~/.ssh/authorized_keys'"
|
||||
```
|
||||
|
||||
После этого Enter в setup.ps1 → продолжается.
|
||||
|
||||
## Manual smoke run
|
||||
|
||||
```powershell
|
||||
Start-ScheduledTask -TaskName 'WindowsHost-Backup-Daily'
|
||||
Get-Content "C:\ProgramData\backup\logs\$(Get-Date -Format yyyy-MM-dd).log" -Wait
|
||||
```
|
||||
|
||||
Verify on kreknin (via VDS pivot):
|
||||
```bash
|
||||
ssh vitya@89.253.255.94 'ssh -i ~/.ssh/id_ed25519_kreknin vitya@195.19.90.188 "ls -la /volume1/NetBackup/windows-host/$(date +%Y-%m-%d)/; du -sh /volume1/NetBackup/windows-host/$(date +%Y-%m-%d)/*"'
|
||||
```
|
||||
|
||||
## Decisions log
|
||||
|
||||
- **rclone, not rsync** — нет cygwin/WSL зависимости, single .exe. Same pattern что VDS msmtp/rsync, RUVDS rclone — proven.
|
||||
- **Wake-To-Run** — `-WakeToRun` flag на ScheduledTask. windows-host может быть в sleep когда RUVDS уже принимает live traffic; backup всё равно поднимет машину в 03:00 MSK. Critical для warm-standby use-case.
|
||||
- **MSSQL backup via docker exec** — `sqlcmd -C` (trust cert; sqlcmd 18 enforces TLS даже на localhost) с `BACKUP DATABASE WITH COMPRESSION, INIT, FORMAT` для consistency. Backup .bak пишется в volume `mssql_mssql_data` (`/var/opt/mssql/backup/`), затем `docker cp` на host temp dir → rclone sync → cleanup container .bak.
|
||||
- **MinIO data bind-mount path** — `C:\Users\vitya\projects\docker\diskstation\minio\data` (verified via `docker inspect minio`). Backup читает напрямую с file system, без MinIO API calls — proven safe для standby (no live mutations).
|
||||
- **MSSQL_SA_PASS в config.env**, не в pass — windows-host не имеет pass-store setup. ACL config.env = SYSTEM + Administrators only. TODO: setup pass на windows-host для DPAPI-equivalent (long-term).
|
||||
- **Schedule 03:00 MSK** — sequential с RUVDS (04:30) + VDS (05:00). Все 3 backups на kreknin аккумулируются за одну ночь.
|
||||
|
||||
## Atomic revert (uninstall)
|
||||
|
||||
```powershell
|
||||
# На windows-host:
|
||||
Unregister-ScheduledTask -TaskName 'WindowsHost-Backup-Daily' -Confirm:$false
|
||||
Remove-Item C:\ProgramData\backup -Recurse -Force
|
||||
# Optionally: Remove-Item 'C:\Program Files\rclone' -Recurse -Force
|
||||
|
||||
# На kreknin (via VDS pivot):
|
||||
ssh vitya@89.253.255.94 'ssh -i ~/.ssh/id_ed25519_kreknin vitya@195.19.90.188 "rm -rf /volume1/NetBackup/windows-host"'
|
||||
# Удалить windows-host pubkey-line (с `windows-host-backup` comment) из ~/.ssh/authorized_keys на kreknin.
|
||||
```
|
||||
Reference in New Issue
Block a user