vitya
8db4b0d71c
End-to-end pipeline отработан, run #1 verified 20 sec, 8.8 GB snolla + IIS configs + 14 certs + sshd state → /volume1/NetBackup/ruvds-iis/<date>/ на kreknin. Retention 7 daily, ntfy vds-backup topic. Scripts checked into scripts/ruvds-backup-daily-kreknin/: - setup.ps1 (one-time install: SSH key + rclone + configs + ScheduledTask) - run.ps1 (live backup logic; Invoke-Rclone wrapper для NOTICE-on-stderr) - README.md (decisions log, smoke instructions, atomic revert) Bugs found and fixed during smoke (см. README Decisions log): 1. Backup-WebConfiguration -Force параметра нет → check + Remove first 2. rclone --log-file lock с PS Start-Transcript → drop --log-file 3. rclone NOTICE на stderr + $ErrorActionPreference=Stop → Invoke-Rclone wrapper temporarily switches к Continue 4. ssh-keyscan known_hosts не parsится rclone go-sftp → drop pinning, rely on key-auth Закрывает "Backup strategy для RUVDS IIS" Open question в [iis-migration-to-ruvds]. Open follow-ups (не блокер): - PFX export pass plaintext в скрипте — TODO move to gpg/DPAPI - Retention prune (kept 1 today) — verify в day 8 - Phone-side ntfy push — user verifies Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
76 lines
4.3 KiB
Markdown
76 lines
4.3 KiB
Markdown
# ruvds-backup-daily-kreknin — scripts
|
||
|
||
Ежедневный backup RUVDS (`80.64.31.36` Win Server 2025 Core) → kreknin Synology (`195.19.90.188:/volume1/NetBackup/ruvds-iis/<date>/`) via rclone SFTP.
|
||
|
||
Live since **2026-05-24**. Schedule: daily **04:30 MSK**. Task name: `RUVDS-Backup-Daily`.
|
||
|
||
## Files
|
||
|
||
- `setup.ps1` — one-time install: SSH key, rclone, configs, ScheduledTask.
|
||
- `run.ps1` — backup logic (synced to `C:\ProgramData\backup\run.ps1` by setup.ps1).
|
||
|
||
## Initial install (rebuilding RUVDS from scratch)
|
||
|
||
```powershell
|
||
# На RUVDS, PowerShell as Administrator
|
||
mkdir C:\backup-scripts -Force
|
||
# Копируем оба файла из source repo:
|
||
Copy-Item \\tsclient\C\Users\vitya\projects\.admin\scripts\ruvds-backup-daily-kreknin\*.ps1 C:\backup-scripts\
|
||
C:\backup-scripts\setup.ps1
|
||
```
|
||
|
||
Setup паузится после генерации SSH key — нужно добавить `kreknin-key.pub` в `/volume1/homes/vitya/.ssh/authorized_keys` на kreknin (через SSH/DSM File Station), потом Enter.
|
||
|
||
## What's backed up (5 components)
|
||
|
||
| Component | Source | Remote path on kreknin |
|
||
|---|---|---|
|
||
| snolla site content | `C:\sites\snolla\` (~8.7 GB) | `NetBackup/ruvds-iis/<date>/sites/snolla/` |
|
||
| applicationHost.config | `C:\Windows\System32\inetsrv\config\applicationHost.config` | `NetBackup/ruvds-iis/<date>/iis-config/` |
|
||
| IIS native config backup | `Backup-WebConfiguration -Name daily-<date>` | `NetBackup/ruvds-iis/<date>/iis-backup-webconfiguration/` |
|
||
| LE certs (PFX export) | `Cert:\LocalMachine\My` private-key certs (14 PFX, pass `ruvds-backup-pfx`) | `NetBackup/ruvds-iis/<date>/certs/` |
|
||
| SSH state | `C:\ProgramData\ssh\` (sshd_config + administrators_authorized_keys) | `NetBackup/ruvds-iis/<date>/ssh-config/` |
|
||
|
||
Retention: **7 daily snapshots**. Older — pruned by `rclone purge` in step 4.
|
||
|
||
## Notifications
|
||
|
||
ntfy topic `vds-backup` (shared with VDS backup) — phone push:
|
||
- Success: title `RUVDS backup OK (<date>)`, tag `green_circle`, priority `default`
|
||
- Fail: title `RUVDS backup FAILED (<date>)`, tag `red_circle`, priority `high`
|
||
|
||
## Decisions log
|
||
|
||
- **rclone, not rsync** — Win Server Core нет cygwin/WSL, rsync.exe = пакет, security surface. rclone single .exe.
|
||
- **SFTP без host-key validation** — rclone go-sftp library не parsит SSH known_hosts с keyscan format корректно (key mismatch error даже на fresh keyscan). Path RUVDS↔kreknin через public internet, но key auth достаточно для нашего threat model. Если threat model меняется — populate known_hosts file from `ssh-keyscan` в правильном format.
|
||
- **`Invoke-Rclone` wrapper** — `$ErrorActionPreference = 'Stop'` + rclone NOTICE на stderr = native command terminating-error в PS. Wrapper temporarily switches к Continue для rclone calls, restores after. Без этого `2>$null` не помогает (PS видит non-empty stderr stream как error).
|
||
- **`Backup-WebConfiguration -Force`** — параметра нет в этой версии WebAdministration module. Используем `Get-WebConfigurationBackup + Remove-WebConfigurationBackup` если exist + plain `Backup-WebConfiguration`.
|
||
- **Cert PFX export pass = `ruvds-backup-pfx`** — temporary. TODO: pass-equivalent на Windows (gpg4win + pass-bash) или derived от machine-creds.
|
||
- **SYSTEM principal, не user account** — Task Scheduler SYSTEM имеет full access к C:\sites\, Cert:\LocalMachine\My, %SystemRoot%\System32\inetsrv\, не требует stored-password. Pattern matches VDS root-cron decision.
|
||
|
||
## Smoke run (manual)
|
||
|
||
```powershell
|
||
Start-ScheduledTask -TaskName 'RUVDS-Backup-Daily'
|
||
# Watch:
|
||
Get-Content C:\ProgramData\backup\logs\(Get-Date -Format yyyy-MM-dd).log -Wait
|
||
```
|
||
|
||
Verify on kreknin:
|
||
```powershell
|
||
ssh vitya@195.19.90.188 'du -sh /volume1/NetBackup/ruvds-iis/*/sites/snolla/'
|
||
```
|
||
|
||
## Atomic revert (uninstall)
|
||
|
||
```powershell
|
||
# On RUVDS:
|
||
Unregister-ScheduledTask -TaskName 'RUVDS-Backup-Daily' -Confirm:$false
|
||
Remove-Item C:\ProgramData\backup -Recurse -Force
|
||
# Optionally: Remove-Item 'C:\Program Files\rclone' -Recurse -Force
|
||
|
||
# On kreknin (via SSH):
|
||
ssh vitya@195.19.90.188 'rm -rf /volume1/NetBackup/ruvds-iis'
|
||
# Remove the RUVDS pubkey line from authorized_keys (one line with 'ruvds-backup' comment).
|
||
```
|