backup(books-vds): daily 06:00 MSK pipeline to kreknin live 🟢
- scripts/books-vds-backup-daily-kreknin/ — run.sh + .env.example + README - ES path.repo bootstrap (one-time stack edit, snapshot repo 'kreknin' registered) - curl smtps://yandex:465 email (CRLF + Date headers, no msmtp dep on CentOS 7) - StrictHostKeyChecking=yes + pre-populated known_hosts (CentOS 7 no accept-new) - cron /etc/cron.d/books-vds-backup live, initial sync 4.87 GB in 13m28s, ntfy push sent - wiki: entities/books-vds.md + sources/books-vds-backup-daily-kreknin-2026-05-25.md created - wiki: concepts/books-ssh-access → vds-kzntsv-ssh-access (was lying about books on vds-kzntsv) - .tasks/books-vds-backup-daily-kreknin.md closed 🟢 pending phone-side verify Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -1,15 +1,17 @@
|
||||
---
|
||||
title: books shared VDS — SSH access audit + retained keys
|
||||
title: vds-kzntsv — SSH access audit + retained keys
|
||||
status: live
|
||||
tags: [vds, ssh, audit, books, tenant-split, ops]
|
||||
related: [[vds-kzntsv]], [[../sources/vds-kzntsv-bootstrap-2026-05-20]]
|
||||
tags: [vds, ssh, audit, infra, ops]
|
||||
related: [[../entities/vds-kzntsv]], [[../sources/vds-kzntsv-bootstrap-2026-05-20]]
|
||||
---
|
||||
|
||||
# books shared VDS — SSH access (post-audit 2026-05-24)
|
||||
# vds-kzntsv — SSH access (post-audit 2026-05-24)
|
||||
|
||||
Snapshot SSH-доступа к `vds-kzntsv` (89.253.255.94 / vds.kzntsv.site), на котором сейчас живёт shared `books`-инсталляция (Slovo + Bookva в одном compose-стеке, до physical split Фазы 4 в [`tenant-split`](https://git.kzntsv.site/victor/books/src/branch/master/.wiki/concepts/tenant-split.md)).
|
||||
Snapshot SSH-доступа к [[../entities/vds-kzntsv]] (`89.253.255.94 / vds.kzntsv.site`) — наш infra-VDS (gitea, registry, ntfy, mssql, minio, owncloud, board-viewer).
|
||||
|
||||
Создан 2026-05-24 в результате таски `[books-ssh-audit-shared-vds]` 🟢 (см. spec в Фазе 3 §SSH-аудит).
|
||||
**Корректировка 2026-05-25:** до этой даты документ ошибочно утверждал что на vds-kzntsv живёт shared books-инсталляция. **Это неверно** — books-стек на отдельном клиентском VDS `89.253.255.133` (см. [[../entities/books-vds]]). vds-kzntsv хостит только нашу infra. Аудит ниже относится к vds-kzntsv SSH (наш infra-host), не к books VDS.
|
||||
|
||||
Создан 2026-05-24 в результате таски `[books-ssh-audit-shared-vds]` 🟢 — задача была названа в предположении что books на vds-kzntsv; reality по сути проверила infra SSH (что и должно было быть).
|
||||
|
||||
## Retained keys
|
||||
|
||||
@@ -52,16 +54,15 @@ Brute-force protection adequate; нет required action.
|
||||
|
||||
`sudo journalctl -u ssh -u sshd --since="7 days ago" | grep Accepted` показал **только** `vitya from 94.19.247.14` (мой home public IP). Никаких других source-IP — clean.
|
||||
|
||||
## Tenant-split implications (Phase 3 acceptance)
|
||||
## Books tenant-split — implications (исправлено 2026-05-25)
|
||||
|
||||
Spec `tenant-split.md` §«Двухуровневая изоляция пользователей → Infra-level»:
|
||||
> на промежуточной стадии не давать аналитикам Bookva SSH к VDS, только app-level. SSH-аудит до cutover'а.
|
||||
Spec `tenant-split.md` §«Двухуровневая изоляция пользователей → Infra-level» и аудит «не давать аналитикам Bookva SSH к VDS» — **должны были применяться к books VDS, не к vds-kzntsv**. Реальный books VDS = `89.253.255.133` ([[../entities/books-vds]]) — отдельный клиентский сервер. SSH-аудит на books VDS — отдельная follow-up задача.
|
||||
|
||||
**Verified clean** as of 2026-05-24 — никаких аналитических SSH-ключей не было выдано. Single-developer setup; analyst access всегда был app-level only. Pre-cutover sigh of relief.
|
||||
vds-kzntsv (этот документ) — infra-VDS, не имеет отношения к books tenants. После Phase 4 books tenant-split:
|
||||
- books VDS (`89.253.255.133`) — текущий shared books → может остаться за Slovo (или Bookva, как пользователь решит).
|
||||
- vds-bookva-new — отдельный VDS у учредителя Bookva. См. `.tasks/books-vds-bookva-bootstrap.md` + `books-dns-cutover-bookva.md`.
|
||||
|
||||
После Phase 4 (physical split на 2 VDS):
|
||||
- vds-kzntsv (Slovo) — продолжит хостить остальную нашу инфру (gitea, registry, ntfy, mssql, minio, owncloud, board-viewer) + books-slovo стек. SSH = vitya only.
|
||||
- vds-bookva-new (Bookva) — отдельная box, отдельный SSH. Заводить core-dev key (vitya) + опционально formally-named Bookva admin.
|
||||
vds-kzntsv остаётся infra-host независимо от tenant-split исхода.
|
||||
|
||||
## How to add a new key (process)
|
||||
|
||||
109
.wiki/entities/books-vds.md
Normal file
109
.wiki/entities/books-vds.md
Normal file
@@ -0,0 +1,109 @@
|
||||
---
|
||||
title: Books VDS (client server — 89.253.255.133)
|
||||
type: entity
|
||||
tags: [hardware, vds, books, host4g, backup, portainer]
|
||||
related: [[kreknin-synology]], [[vds-kzntsv]]
|
||||
updated: 2026-05-25
|
||||
---
|
||||
|
||||
# Books VDS
|
||||
|
||||
Клиентский VDS (отдельный от инфра-VDS [[vds-kzntsv]]). Хостит production books app stack (api/web/scheduler/task-runner) + shared infra (mongo, minio, elasticsearch, traefik, portainer).
|
||||
|
||||
**Это НЕ vds-kzntsv.** Books-стек живёт здесь, не на vds.kzntsv.site. Domain `books.kzntsv.site` (и `bookva.kzntsv.site`) разрешаются в этот IP.
|
||||
|
||||
## Доступ
|
||||
|
||||
- **Public IP:** 89.253.255.133
|
||||
- **Provider:** host4g.ru (DNS вендорский `vps-21075162-277731.host4g.ru`)
|
||||
- **OS:** CentOS 7, kernel 3.10.0-1160.36.2.el7.x86_64 (древний, EOL)
|
||||
- **SSH:** `root@89.253.255.133:22` — only via ed25519 key (`~/.ssh/id_ed25519_books_ops` на workstation)
|
||||
- **Sudo:** root, passwordless (мы под root напрямую)
|
||||
- **Portainer:** `https://portainer.kzntsv.site` (отдельный Portainer, не путать с `portainer.vds.kzntsv.site` для [[vds-kzntsv]])
|
||||
|
||||
Все creds — в `pass show books-vds/full-env`.
|
||||
|
||||
## Disk
|
||||
|
||||
```
|
||||
/dev/vda1 122G 59G used (49%) 63G free
|
||||
```
|
||||
|
||||
Single root partition, нет отдельной `/data`. Docker hub data под `/var/lib/docker/`.
|
||||
|
||||
## Стек (2026-05-25 inventory)
|
||||
|
||||
### Portainer-managed stacks (endpoint 1)
|
||||
|
||||
| Stack | Container(s) | Purpose |
|
||||
|---|---|---|
|
||||
| `books-api` | books-api | books API server (Nitro, port 3021) |
|
||||
| `books-web` | books-web | books-Nuxt front-end |
|
||||
| `books-job-scheduler` | books-job-scheduler + books-job-scheduler-mongo | agenda jobs (cron + on-demand) |
|
||||
| `books-ntfy` | books-ntfy | local ntfy (separate from shared `ntfy.vds.kzntsv.site`) |
|
||||
| `books-ops-mcp` | books-ops-mcp + books-ops-mcp-bootstrap-1 + books-docker-proxy + books-docker-proxy-ro | books ops-mcp endpoint |
|
||||
| `chrome` | chrome | Puppeteer browser for PDFs / scraping |
|
||||
|
||||
### SSH-managed (legacy compose at `/usr/docker/<svc>/`)
|
||||
|
||||
| Compose dir | Containers | Bind data path |
|
||||
|---|---|---|
|
||||
| `/usr/docker/books-db/` | books-db | `./data` → `/var/lib/mysql` (MariaDB 10.6.4) |
|
||||
| `/usr/docker/mongo/` | mongo | `./data/{db,configdb}` |
|
||||
| `/usr/docker/minio/` | minio | `./data` (S3 blobs) |
|
||||
| `/usr/docker/elasticsearch/` | elasticsearch | `./data` + `./snapshots` (added 2026-05-25) |
|
||||
| `/usr/docker/traefik/` | traefik | `./letsencrypt` (acme.json) + `./data/traefik.yml` |
|
||||
| `/usr/docker/portainer/` | portainer | named volume `portainer_data` |
|
||||
| `/usr/docker/proxy-chain/` | proxy-chain | upstream HTTP-proxy chain |
|
||||
|
||||
**TODO**: мигрировать максимум SSH-managed контейнеров под Portainer (отдельная таска после backup-pipeline live). Cause: разделённое управление обламывает CI (Portainer-only deploy.yml) и debugging.
|
||||
|
||||
### Build helpers (transient)
|
||||
|
||||
- `buildx_buildkit_builder-*` × 7 — buildkit builders, oneshot за `docker buildx`. Не data.
|
||||
|
||||
## App-config paths
|
||||
|
||||
```
|
||||
/opt/books/api/{config,data,upload}
|
||||
/opt/books/job-scheduler/{config,mongo/{db,configdb}}
|
||||
/opt/books/task-runner/
|
||||
/opt/books/ntfy/ # local ntfy data
|
||||
/opt/books/books-ops-mcp/
|
||||
```
|
||||
|
||||
`config/default.json` overrides image-baked config (MySQL/ES/S3 endpoints).
|
||||
|
||||
## Backup
|
||||
|
||||
Daily 06:00 MSK → kreknin. См. [[../sources/books-vds-backup-daily-kreknin-2026-05-25]]. Pipeline:
|
||||
- DB dumps: books-db (mariadb), mongo (shared), books-job-scheduler-mongo
|
||||
- ES snapshot via REST API (file repo `kreknin`)
|
||||
- rsync bind paths + dumps + `/opt/books/` + `/etc/{ssh,hosts,cron.d}` + `/root/.ssh` → `vitya@kreknin:/volume1/NetBackup/books-vds/<date>/`
|
||||
- ntfy `BOOKS-VDS backup OK <date>` + email
|
||||
- Retention 7 daily snapshots
|
||||
|
||||
Live since 2026-05-25.
|
||||
|
||||
## DNS
|
||||
|
||||
- `books.kzntsv.site` → 89.253.255.133 (`books-api` host route via local traefik)
|
||||
- `bookva.kzntsv.site` → 89.253.255.133 (`books-web` host route)
|
||||
- `elasticsearch.kzntsv.site` → 89.253.255.133 (ES via traefik basicAuth)
|
||||
- `portainer.kzntsv.site` → 89.253.255.133 (Portainer UI)
|
||||
- `edge.kzntsv.site` → 89.253.255.133 (Portainer edge agent)
|
||||
|
||||
Auth-зоны DNS — в reg.ru под `kzntsv.site`.
|
||||
|
||||
## Cross-refs
|
||||
|
||||
- [[kreknin-synology]] — backup target.
|
||||
- [[vds-kzntsv]] — наш инфра-VDS (отдельный, gitea/registry/etc.) — НЕ хост books'а.
|
||||
- [[../concepts/vds-kzntsv-ssh-access]] — SSH-аудит инфра-VDS (был misnamed как `books-ssh-access` до 2026-05-25; ошибочно claimed vds-kzntsv hosts books).
|
||||
- [[../sources/books-vds-backup-daily-kreknin-2026-05-25]] — backup standup chronology.
|
||||
|
||||
## Каking-of-history notes
|
||||
|
||||
- Discovered 2026-05-25 во время backup-таски. Wiki [[../concepts/books-ssh-access]] до этого ошибочно говорила что books на vds-kzntsv (89.253.255.94). User: «books VDS - это совсем другой сервер, клиентский». Inventory + IP probe confirmed.
|
||||
- Workstation SSH key `id_ed25519_books_ops` уже был задеплоен под root до этой сессии (видимо, прошлый bootstrap забыт-без-документации).
|
||||
- Hybrid stack-management (Portainer + SSH-compose) — pre-existing, не наш design. Migrate to Portainer-only — follow-up.
|
||||
@@ -8,6 +8,7 @@ Catalog of all wiki pages. One line per page, organized by type. Updated on ever
|
||||
|
||||
## Entities
|
||||
|
||||
- [books-vds](entities/books-vds.md) — Books VDS (89.253.255.133 — host4g.ru, client server hosting books app + shared mongo/minio/elasticsearch)
|
||||
- [dead-synology-diskstation](entities/dead-synology-diskstation.md) — мёртвая Synology DiskStation (source NAS)
|
||||
- [kreknin-synology](entities/kreknin-synology.md) — Kreknin Synology (backup target + DDNS)
|
||||
- [openwrt-router](entities/openwrt-router.md) — OpenWRT Router (192.168.1.1)
|
||||
@@ -19,7 +20,7 @@ Catalog of all wiki pages. One line per page, organized by type. Updated on ever
|
||||
## Concepts
|
||||
|
||||
- [admin-infra-project](concepts/admin-infra-project.md) — design + migration plan для OpeItcLoc03/admin (canonical)
|
||||
- [books-ssh-access](concepts/books-ssh-access.md) — SSH access audit на shared VDS (books Slovo+Bookva), retained keys + add/revoke processes
|
||||
- [vds-kzntsv-ssh-access](concepts/vds-kzntsv-ssh-access.md) — SSH access audit на vds-kzntsv (infra VDS), retained keys + add/revoke processes (was misnamed `books-ssh-access` до 2026-05-25 — content всегда был про vds-kzntsv)
|
||||
- [compose-bcrypt-escape-trap](concepts/compose-bcrypt-escape-trap.md) — Docker Compose ест `$` в bcrypt hashes
|
||||
- [db-tls-self-signed-via-traefik-raw-tcp](concepts/db-tls-self-signed-via-traefik-raw-tcp.md) — DB TLS через traefik raw TCP с self-signed certs
|
||||
- [docker-host-loopback-detect](concepts/docker-host-loopback-detect.md) — Docker host-loopback detection — как доказать что host.docker.internal не петля
|
||||
@@ -53,5 +54,6 @@ Catalog of all wiki pages. One line per page, organized by type. Updated on ever
|
||||
- [iis-host-migration-2026-05-19](sources/iis-host-migration-2026-05-19.md) — IIS Host Migration Session 2026-05-19 chronology
|
||||
- [iis-migration-to-ruvds-2026-05-23](sources/iis-migration-to-ruvds-2026-05-23.md) — IIS migration to RUVDS — session 2026-05-23/24 (SSH/scp pivot, 25 SNI bindings, partial DNS cutover)
|
||||
- [nas-recovery-session-2026-05-18](sources/nas-recovery-session-2026-05-18.md) — NAS Recovery Session 2026-05-18/19 chronology
|
||||
- [books-vds-backup-daily-kreknin-2026-05-25](sources/books-vds-backup-daily-kreknin-2026-05-25.md) — books VDS daily backup → kreknin pipeline standup 2026-05-25 (ES file-snapshot repo + DB dumps + curl SMTP)
|
||||
- [ruvds-backup-daily-kreknin-2026-05-24](sources/ruvds-backup-daily-kreknin-2026-05-24.md) — RUVDS daily backup → kreknin pipeline standup 2026-05-24 (rclone+SFTP, SYSTEM task)
|
||||
- [vds-kzntsv-bootstrap-2026-05-20](sources/vds-kzntsv-bootstrap-2026-05-20.md) — VDS bootstrap session 2026-05-20 chronology
|
||||
|
||||
111
.wiki/sources/books-vds-backup-daily-kreknin-2026-05-25.md
Normal file
111
.wiki/sources/books-vds-backup-daily-kreknin-2026-05-25.md
Normal file
@@ -0,0 +1,111 @@
|
||||
---
|
||||
title: books VDS daily backup → kreknin — pipeline standup 2026-05-25
|
||||
type: source
|
||||
tags: [backup, books-vds, kreknin, rsync, elasticsearch-snapshot, curl-smtp, cron, ntfy]
|
||||
ingested: 2026-05-25
|
||||
raw_path: ../../.tasks/books-vds-backup-daily-kreknin.md
|
||||
updated: 2026-05-25
|
||||
---
|
||||
|
||||
# books VDS daily backup → kreknin
|
||||
|
||||
Поднят ежедневный backup pipeline с [[../entities/books-vds]] (`89.253.255.133` / host4g.ru / CentOS 7) → [[../entities/kreknin-synology]] (`195.19.90.188`) в **06:00 MSK**. Параллель к [[vds-kzntsv-bootstrap-2026-05-20]] §backup и [[ruvds-backup-daily-kreknin-2026-05-24]] (pattern mirror), но source = CentOS 7 с hybrid SSH-compose + Portainer стек.
|
||||
|
||||
Источник истины — `.tasks/books-vds-backup-daily-kreknin.md` и `scripts/books-vds-backup-daily-kreknin/`.
|
||||
|
||||
## Background — почему отдельно
|
||||
|
||||
Прошлые сессии (и `[[../concepts/vds-kzntsv-ssh-access]]` до 2026-05-25) ошибочно утверждали что books-стек живёт на [[../entities/vds-kzntsv]]. **Это не так:** books на отдельном клиентском VDS `89.253.255.133`. User указал на ошибку явно: «books VDS - это совсем другой сервер, клиентский». См. [[../entities/books-vds]] для актуального factsheet.
|
||||
|
||||
## Scope
|
||||
|
||||
| Path on books VDS | Reason | Approx size |
|
||||
|---|---|---|
|
||||
| `/opt/books/{api,job-scheduler,task-runner,ntfy,books-ops-mcp}` | App configs (`config/default.json` overrides) | < 100 MB |
|
||||
| `/usr/docker/minio/data` | MinIO blobs (S3) — основная масса | ~4.5 GB |
|
||||
| `/usr/docker/elasticsearch/snapshots` | ES snapshot files (repo `kreknin`) | < 1 MB (read_me index only) |
|
||||
| `/usr/docker/traefik/{letsencrypt,data}` | acme.json + traefik.yml | < 5 MB |
|
||||
| `/etc/{ssh,hosts,cron.d}` | system config | < 50 KB |
|
||||
| `/root/.ssh` | root SSH state | < 5 KB |
|
||||
| `mariadb.sql.gz` (live dump) | books-db full dump | ~270 MB |
|
||||
| `mongo.archive.gz` (live dump) | shared mongo (root auth) | ~170 KB |
|
||||
| `job-scheduler-mongo.archive.gz` (live dump) | scheduler agenda (no auth) | ~3 MB |
|
||||
|
||||
Total после initial sync: **4.87 GB** (`du -sh` reported 4.8 GB после rsync).
|
||||
|
||||
Не бэкапятся: `/var/lib/docker/`, `/var/log/`, transient buildx volumes.
|
||||
|
||||
## Decisions log
|
||||
|
||||
- **Tool = bash + rsync + curl** (no rclone, no msmtp). Linux native, no extra installs. Pattern mirror VDS-infra `run.sh`.
|
||||
- **ES snapshot via REST API** (filesystem repo `kreknin`), не data-dir rsync. Required one-time stack edit `/usr/docker/elasticsearch/docker-compose.yml`: добавлены env `path.repo=/snapshots` + bind `./snapshots:/snapshots`, ES recreated. Снимки атомарны и Lucene-consistent.
|
||||
- **Email via `curl --ssl-reqd --url smtps://...:465`** (implicit TLS), не msmtp. CentOS 7 + EOL repos = msmtp install painful; curl native + Yandex SMTP works. Initial attempt с `smtp://...:465` + `--ssl-reqd` дала 30-sec timeout (curl попытался STARTTLS на TLS-only-from-start порту) — исправлено переходом на `smtps://`.
|
||||
- **RFC 5322 CRLF headers + Date + MIME-Version + Content-Type** в email-body. Yandex отвергает без Date. Initial body без них принимался при STARTTLS теста, но for production safety — full headers.
|
||||
- **`StrictHostKeyChecking=yes`** (НЕ `accept-new`) — CentOS 7 OpenSSH 7.4 не поддерживает `accept-new` (added in 7.6). kreknin host key pre-populated в `/root/.ssh/known_hosts` на bootstrap step.
|
||||
- **Retention 7 daily snapshots** (matches VDS + RUVDS pattern). ES snapshot pruning отдельно — via REST DELETE.
|
||||
- **`ntfy.vds.kzntsv.site/vds-backup` topic** (shared канал с VDS + RUVDS + windows-host). Title `BOOKS-VDS backup OK <date>` отличает от других хостов на phone-side.
|
||||
- **books-job-scheduler-mongo без auth** — `MONGO_INITDB_ROOT_*` env пустой, `mongodump --archive` без `--uri` достаточен. Shared `mongo` — root auth (urircreds).
|
||||
- **Cron 06:00 MSK** — после VDS-infra (05:00), RUVDS (04:30), windows-host (05:30). Break перед US-EU business start.
|
||||
- **`books-vds-portainer/full-env` consolidated** → `books-vds/full-env` (parity с `vds-kzntsv/full-env` one-file-per-host pattern).
|
||||
|
||||
## Хронология standup'а (2026-05-25)
|
||||
|
||||
- **08:30:** user-указание начать `stateful-split-volume-copy` под supervision. Probe `vds-ops` MCP показал что books-db нет на vds-kzntsv (только generic mariadb/mongo/minio). Wiki `[[../concepts/vds-kzntsv-ssh-access]]` (тогда `books-ssh-access.md`) врала что books живёт на vds-kzntsv.
|
||||
- **08:45:** user: «89.253.255.133 - books VDS, клиентский. Сделаем backup на kreknin». Pivot фокус.
|
||||
- **08:48:** SSH probe `id_ed25519_books_ops` → ready, root access OK. Inventory: hybrid Portainer + SSH-compose, hosting books-api/web/scheduler/task-runner/db + shared infra.
|
||||
- **08:55:** Portainer API token request — user создал `claude-code-automation` PAT в Portainer UI (`portainer.kzntsv.site`). Saved в pass `books-vds-portainer/full-env`. API tested OK. But `elasticsearch`/`mongo`/`minio`/`books-db`/`traefik` нет среди Portainer-managed stacks — they're SSH-compose. User: «после backup'а мигрируем максимум под Portainer».
|
||||
- **08:58:** ES probe — `path.repo` не настроен, snapshot API не работает без edit'а compose.
|
||||
- **09:00:** User approval на ES stack edit «сейчас, ES никто не использует». Sed edit `docker-compose.yml` + recreate. docker-compose 1.29 → docker 26 incompat (`KeyError: 'ContainerConfig'`) → manual `docker rm` renamed-stuck → `docker-compose up -d` clean → ES ready in 30s. Snapshot repo `kreknin` registered + test snap SUCCESS → deleted.
|
||||
- **09:14:** Wrote `scripts/books-vds-backup-daily-kreknin/{run.sh,.env.example,README.md}` локально. Built `.env` from pass entries (books-vds + vds-kzntsv NTFY + snolla-smtp SMTP). Deployed `/opt/stacks/backup/{run.sh,.env}` на VDS via scp. Generated `kreknin-key` ed25519 на VDS. Authorized pubkey on kreknin via workstation `id_ed25519_kreknin`. Pre-populated kreknin host key в `/root/.ssh/known_hosts` (CentOS 7 no accept-new).
|
||||
- **09:15:** Smoke run start. DB dumps OK (mariadb 270MB, mongo 170KB, scheduler-mongo 2.8MB). ES snapshot SUCCESS. rsync started.
|
||||
- **09:29:** rsync done, 4.87 GB in **13m28s** (7.6 MB/s). ntfy push отправлен. Email **timeout 30s** — bug в email_send.
|
||||
- **09:30:** Diagnose. SMTP_PORT=465 + `smtp://` + `--ssl-reqd` = curl попытался STARTTLS на implicit-TLS-only порту. Fix: `smtps://` schema. Plus CRLF headers + Date header. Re-tested: SMTP send OK.
|
||||
- **09:32:** Updated run.sh re-deployed. Cron installed `/etc/cron.d/books-vds-backup` (0 6 * * * root /opt/stacks/backup/run.sh). crond active.
|
||||
|
||||
## Pipeline state
|
||||
|
||||
- **Live:** cron `books-vds-backup`, daily 06:00 MSK, root user.
|
||||
- **Verified:** initial sync 4.87 GB end-to-end + ntfy push отправлен.
|
||||
- **Phone-side ntfy verify:** **pending user confirmation** (был ли push `BOOKS-VDS backup OK 2026-05-25` на ntfy app в общем канале `vds-backup`).
|
||||
- **Email verify:** sent после fix (см. 09:32 fix). User должен подтвердить получение `[BOOKS-VDS] backup OK <date>` или standalone fix-test message в inbox.
|
||||
- **Day-2 verify:** automatic at 06:00 MSK 2026-05-26 — first cron-trigger.
|
||||
- **Retention prune verify:** automatic at day-8 (когда snapshot count > 7).
|
||||
|
||||
## Bugs fixed during smoke
|
||||
|
||||
- **SMTP timeout 30s** — `smtp://...:465` + `--ssl-reqd` = curl STARTTLS на implicit-TLS-only порту. Server ждёт TLS handshake, curl ждёт plain EHLO, deadlock. Fix: `smtps://` scheme.
|
||||
- **email RFC 5322** — initial body had no Date/MIME headers, only From/To/Subject. Yandex отвергает без Date. Fix: добавлены Date, MIME-Version, Content-Type CRLF headers.
|
||||
- **CentOS 7 OpenSSH 7.4 no accept-new** — `StrictHostKeyChecking=accept-new` parse-error. Fix: `StrictHostKeyChecking=yes` + pre-populated known_hosts.
|
||||
- **docker-compose 1.29 ↔ docker 26 KeyError ContainerConfig** — recreate failed mid-way, container renamed-stuck. Manual `docker rm -f` + clean `up -d` rescued.
|
||||
|
||||
## Open follow-ups (не блокер)
|
||||
|
||||
- **Migrate SSH-compose стеки под Portainer** (отдельная таска, user-requested после backup live). Targets: elasticsearch, mongo, minio, books-db, traefik, proxy-chain.
|
||||
- **SSH-аудит books VDS** — отдельный аудит по pattern [[vds-kzntsv-ssh-access]]. На сейчас знаем только root key `id_ed25519_books_ops` под root — других пользователей не enum'ил. Pre-existing keys unknown.
|
||||
- **kreknin space audit** — quarterly check `du -sh /volume1/NetBackup/*` чтобы не упереться в 5.7T limit.
|
||||
- **wd40 backup**: рассмотреть второй backup target (B2 / Glacier) для resilience — см. [[../concepts/future-resilient-architecture-goals]].
|
||||
|
||||
## Атомарный revert
|
||||
|
||||
```bash
|
||||
# На books VDS:
|
||||
ssh root@89.253.255.133 'rm /etc/cron.d/books-vds-backup; rm -rf /opt/stacks/backup /var/log/books-vds-backup'
|
||||
|
||||
# Revert ES path.repo edit:
|
||||
ssh root@89.253.255.133 'cd /usr/docker/elasticsearch && \
|
||||
cp docker-compose.yml.bak-pre-snapshots-2026-05-25 docker-compose.yml && \
|
||||
docker rm -f elasticsearch && docker-compose up -d'
|
||||
|
||||
# На kreknin (через SSH):
|
||||
ssh vitya@195.19.90.188 'rm -rf /volume1/NetBackup/books-vds'
|
||||
# Remove the books-vds-backup-20260525 pubkey line from authorized_keys.
|
||||
```
|
||||
|
||||
## Cross-refs
|
||||
|
||||
- Source host: [[../entities/books-vds]]
|
||||
- Backup target: [[../entities/kreknin-synology]]
|
||||
- Pattern parent: [[vds-kzntsv-bootstrap-2026-05-20]] §backup (msmtp + rsync --link-dest)
|
||||
- Sibling pipeline: [[ruvds-backup-daily-kreknin-2026-05-24]] (rclone+SFTP)
|
||||
- Notification: общий ntfy topic `vds-backup` на `ntfy.vds.kzntsv.site`.
|
||||
- Misnaming legacy: [[../concepts/vds-kzntsv-ssh-access]] (бывший `books-ssh-access` до 2026-05-25).
|
||||
Reference in New Issue
Block a user