prosolis
42d857a878
The canonical instance -- the one with her actual writing -- turned out to be the least protected thing in the estate: - No scheduled backup at all; the newest snapshot was a month old. Now petal-backup.timer: VACUUM INTO, gzip, age-encrypt with the parodia public recipient, push to the VPS over headscale with a size check, prune both ends. Persistent=true because the box is not on 24/7. Neither machine can decrypt what it holds; the identity is offline. - Petal ran as a bare ./petal with PPID 1, so a crash or reboot left it down until somebody noticed. Now petal.service, verified by kill -9. - The Piper units retried forever without ever failing: RestartSec=3 against systemd's default 10s window means the burst limit is never reached, which is how a dead service logged 26,800+ restarts over a day while read-aloud silently fell back to browser speech. StartLimitIntervalSec=300 makes a broken Piper show up in --failed. backup-petal.sh now handles both deployment shapes (compose exec on the VPS, local binary on millenia) and encrypts before anything leaves the host. The VPS no longer uses it -- Petal rides parodia-backup there.
24 lines
917 B
Desktop File
24 lines
917 B
Desktop File
[Unit]
|
|
Description=Nightly backup of Petal's database (millenia)
|
|
Documentation=file:///home/reala/petal/deploy/README.md
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=reala
|
|
WorkingDirectory=/home/reala/petal
|
|
# Encrypted with the parodia age recipient before it leaves the box, then
|
|
# pushed to the VPS over headscale. The recipient is a public key and the
|
|
# private identity is offline, so neither millenia nor the VPS can decrypt what
|
|
# they are holding. Replaces nothing -- before this there was no scheduled
|
|
# backup of her writing at all; the newest snapshot on 2026-07-27 was a month
|
|
# old.
|
|
Environment=AGE_RECIPIENT=age19n4k55m9d50xew5vj2ehmcsf3wuj7fhgmfpckadpvcya4032q9dqrt4yjw
|
|
Environment=REMOTE_USER=reala
|
|
Environment=REMOTE_HOST=100.64.0.1
|
|
Environment=REMOTE_DIR=petal-backups-millenia
|
|
ExecStart=/home/reala/petal/deploy/backup-petal.sh
|
|
Nice=10
|
|
IOSchedulingClass=idle
|