vitya
22786e1865
- entities/ruvds-iis-host (NEW) — 80.64.31.36, Win Server 2025 Core, 25 SNI HTTPS bindings, 2/24 hostnames DNS-flipped - sources/iis-migration-to-ruvds-2026-05-23 (NEW) — chronology, SSH/scp pivot после home-ISP outbound 445 block - sources/ruvds-backup-daily-kreknin-2026-05-24 (NEW) — rclone+SFTP SYSTEM task daily 04:30, ntfy общий канал - concepts/traefik-acme-json-to-iis-cert-import (NEW) — PFX + SNI recipe - concepts/windows-server-2025-core-bootstrap — SMB deprecate, HTTP middlebox warning, HTTP/2 note; backup/cert open-Qs закрыты - entities/windows-recovery-host — partial-cutover state, imgproxy SPOF carve-out, tandemmebel indefinitely здесь - overview / index / log — catalog refresh Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
82 lines
5.9 KiB
Markdown
82 lines
5.9 KiB
Markdown
---
|
||
title: RUVDS daily backup → kreknin — pipeline standup 2026-05-24
|
||
type: source
|
||
tags: [backup, ruvds, kreknin, rclone, sftp, ntfy, schedtask]
|
||
ingested: 2026-05-24
|
||
raw_path: ../../.tasks/ruvds-backup-daily-kreknin.md
|
||
updated: 2026-05-24
|
||
---
|
||
|
||
# RUVDS daily backup → kreknin
|
||
|
||
Поднят ежедневный backup pipeline с [[../entities/ruvds-iis-host]] (`80.64.31.36`, Win Server 2025 Core) → [[../entities/kreknin-synology]] (`195.19.90.188 / kreknin.site`) в **04:30 MSK** (за 30 мин до VDS backup'а в 05:00, чтобы не пересекать uplink). После каждого прохода — ntfy push на общий topic `vds-backup` (одно phone-channel для всех backup events). Параллель [[vds-kzntsv-bootstrap-2026-05-20]] §backup, но source = Windows Core → cron нет (Task Scheduler), rsync нет (rclone), root-cron нет (SYSTEM scheduled task).
|
||
|
||
Источник истины — `.tasks/ruvds-backup-daily-kreknin.md`.
|
||
|
||
## Scope
|
||
|
||
| Path on RUVDS | Reason | Size |
|
||
|---|---|---|
|
||
| `C:\sites\snolla\` | CMS site content + Web.config + media | 8.66 GB |
|
||
| `C:\Windows\System32\inetsrv\config\applicationHost.config` | IIS site/binding/apppool config | <1 MB |
|
||
| `Backup-WebConfiguration` snapshot → `%SystemRoot%\System32\inetsrv\backup\` | IIS native config snapshot | <5 MB |
|
||
| `C:\ProgramData\ssh\` | sshd_config + authorized_keys | <50 KB |
|
||
| Exported PFX из `Cert:\LocalMachine\My` | LE certs для restore без re-extract из traefik | <1 MB |
|
||
|
||
Не бэкапятся: `C:\Windows\`, `C:\Program Files\`, IIS logs.
|
||
|
||
## Decisions log
|
||
|
||
- **Tool = rclone (SFTP)**. Не robocopy-over-SMB (SMB через home-ISP блокируется, см. [[iis-migration-to-ruvds-2026-05-23]] Phase 2), не rsync (нет cygwin/WSL на Core, лишний security surface), не restic (encrypted dedupe overkill пока link trusted; defer like VDS).
|
||
- **Run as SYSTEM**, не user account — full доступ к `C:\sites\` + `inetsrv\` + cert store, не требует stored-password в Task Scheduler. Pattern matches VDS root-cron decision.
|
||
- **PFX export pass = `pfximport` plaintext в run.ps1** — temporary, migrate to pass-equivalent на Windows (DPAPI или gpg4win+bash-pass) когда migration cutover'нется полностью.
|
||
- **Retention 7 daily snapshots, без hardlink dedup** — 8.66 GB × 7 = ~60 GB на kreknin (5.7T free). Per-day dirs `/volume1/NetBackup/ruvds-iis/YYYY-MM-DD/`.
|
||
- **ntfy topic `vds-backup`** — reuse общего канала, Title включает source-host чтобы phone-side отличать VDS-backup от RUVDS-backup.
|
||
|
||
## Хронология standup'а (2026-05-24)
|
||
|
||
- **~10:18:** rclone v1.74.2 installed на RUVDS (`C:\Program Files\rclone\rclone.exe`).
|
||
- **~10:18:** ed25519 SSH key `C:\ProgramData\backup\kreknin-key` сгенерирован, pubkey deployed в kreknin `/var/services/homes/vitya/.ssh/authorized_keys` **через VDS pivot** (source machine не имеет direct SSH к kreknin).
|
||
- **~10:19:** Deployed `rclone.conf` (SFTP remote `kreknin`, `disable_hashcheck=true`), `config.env` (ntfy creds), `run.ps1`. ACL = SYSTEM + Administrators.
|
||
- **10:19:47:** Зарегистрирован ScheduledTask `RUVDS-Backup-Daily` (daily 04:30 MSK, SYSTEM, 2h timeout).
|
||
- **10:21:13 — 11:42:57:** Initial full sync 8.66 GB snolla + 4 small components → kreknin. **~82 мин** из-за home-uplink throttling (production cron не affected — RUVDS uplink direct).
|
||
- **11:46:51:** Run #1 incremental smoke ✓ **20 sec** — все 5 components OK, retention prune OK (1 snapshot kept, ничего пока удалять), ntfy success sent.
|
||
- Scripts checked-in: `scripts/ruvds-backup-daily-kreknin/` (setup.ps1 + run.ps1 + README).
|
||
|
||
## Bugs fixed during smoke
|
||
|
||
- `Backup-WebConfiguration -Force` параметра нет на этом IIS — используем `Get-WebConfigurationBackup + Remove-WebConfigurationBackup` если exists + plain `Backup-WebConfiguration`.
|
||
- rclone `--log-file` указывал на тот же путь что и `Start-Transcript` → file lock. Убран `--log-file`, transcript captures всё.
|
||
- rclone NOTICE на stderr + `$ErrorActionPreference='Stop'` = PS terminating error даже c `2>$null`. Wrapper `Invoke-Rclone` temporarily switches к `ErrorActionPreference='Continue'`.
|
||
- ssh-keyscan'енный `known_hosts` не проходит rclone go-sftp library (key mismatch). Убран `known_hosts_file` из rclone.conf, key-auth достаточно.
|
||
|
||
## Pipeline state
|
||
|
||
- **Live**: ScheduledTask `RUVDS-Backup-Daily`, daily 04:30 MSK, SYSTEM.
|
||
- **Verified**: run #1 end-to-end (20 sec incremental, ntfy push received).
|
||
- **Retention day-8 verify**: pending — retention prune не triggered'илась (только 1 snapshot < 7).
|
||
- **Phone-side ntfy verify**: pending — user должен подтвердить что push с title `RUVDS backup OK` приходит на ntfy app (common channel с VDS backup).
|
||
|
||
## Open follow-ups (не блокер)
|
||
|
||
- PFX export passphrase в plaintext — migrate to DPAPI/pass-equivalent.
|
||
- Backup `C:\sites\snolla` size growth (CMS uploads через админку) — quarterly disk-usage check на kreknin.
|
||
|
||
## Атомарный revert
|
||
|
||
```powershell
|
||
# На RUVDS:
|
||
Unregister-ScheduledTask -TaskName 'RUVDS-Backup-Daily' -Confirm:$false
|
||
Remove-Item C:\ProgramData\backup -Recurse -Force
|
||
# На kreknin (через SSH):
|
||
ssh vitya@195.19.90.188 'rm -rf /volume1/NetBackup/ruvds-iis'
|
||
```
|
||
|
||
## Cross-refs
|
||
|
||
- Source host: [[../entities/ruvds-iis-host]]
|
||
- Backup target: [[../entities/kreknin-synology]]
|
||
- Driver: open question "Backup strategy для RUVDS" из [[iis-migration-to-ruvds-2026-05-23]] — closed by этой задачей.
|
||
- Parallel pipeline: VDS Ubuntu → kreknin rsync `--link-dest` (см. [[vds-kzntsv-bootstrap-2026-05-20]] §backup).
|
||
- Notification: общий ntfy topic `vds-backup` на `ntfy.vds.kzntsv.site` (см. [[../entities/vds-kzntsv]] §стек).
|