fkrebs
3fa4608266
CT 103/109/113-conf were deployed earlier today, table updated. Add obsidian-vault (CT 103, daily 04:00, rolling 2-commit window) and obsidian-config (manual zip-drop workflow, see README in repo).
85 lines
5.3 KiB
Markdown
85 lines
5.3 KiB
Markdown
# Config-to-git fleet
|
|
|
|
Each host snapshots its critical config to a private Gitea repo on `git.nuclide.systems` daily. Force-push (mirror only — history isn't sacred). Token: long-lived `fkrebs` PAT embedded in remote URLs (mode 0600 on script/config).
|
|
|
|
## Repos
|
|
|
|
| Host | CT/VM | Repo | Schedule | Script | Source |
|
|
|---|---|---|---|---|---|
|
|
| PVE (`nuc`) | host | [fkrebs/pve-conf](https://git.nuclide.systems/fkrebs/pve-conf) | daily 03:00 | `/usr/local/sbin/pve-conf-backup.sh` (cron `/etc/cron.d/pve-conf-backup`) | `/etc/pve/` (excludes `priv/`, `*.key`, `authkey.pub*`) |
|
|
| Zoraxy | CT 108 | [fkrebs/zoraxy-conf](https://git.nuclide.systems/fkrebs/zoraxy-conf) | daily 03:00 | `/usr/local/sbin/zoraxy-conf-backup.sh` (cron `/etc/cron.d/zoraxy-conf-backup`) | Zoraxy config dir |
|
|
| AdGuard | CT 102 | [fkrebs/adguard-conf](https://git.nuclide.systems/fkrebs/adguard-conf) | daily 03:00 | `/usr/local/sbin/adguard-conf-backup.sh` (cron `/etc/cron.d/adguard-conf-backup`) | AdGuard config dir |
|
|
| Home Assistant | VM 100 | [fkrebs/home-assistant-config](https://git.nuclide.systems/fkrebs/home-assistant-config) | manual cron via addon `init_commands` (see below) | `/config/scripts/git-push.sh` | `/config/` (sees `.gitignore` allowlist) |
|
|
| Backrest | CT 103 | [fkrebs/ct103-conf](https://git.nuclide.systems/fkrebs/ct103-conf) | daily 03:00 | `/usr/local/sbin/ct103-conf-backup.sh` | `/opt/backrest/config/`, `/etc/cron.d/`, `/usr/local/bin/` |
|
|
| Ops stack | CT 109 | [fkrebs/ct109-conf](https://git.nuclide.systems/fkrebs/ct109-conf) | daily 03:00 | `/usr/local/sbin/ct109-conf-backup.sh` | `/opt/stacks/` (excludes `*/data/`, `*.db*`), `/etc/cron.d/` |
|
|
| Postgres / WAL-G | CT 113 | [fkrebs/ct113-conf](https://git.nuclide.systems/fkrebs/ct113-conf) | daily 03:00 | `/usr/local/sbin/ct113-conf-backup.sh` | `/opt/stacks/` (excludes `*/data/`), `/etc/postgresql/`, `/etc/cron.d/`, `/usr/local/bin/` |
|
|
| Obsidian vault | UNAS via CT 103 | [fkrebs/obsidian-vault](https://git.nuclide.systems/fkrebs/obsidian-vault) | daily 04:00 | `/usr/local/sbin/obsidian-vault-backup.sh` | `Notizen/` (excludes sync indices, `.obsidian/`, `.trash`). Rolling 2-commit history. |
|
|
| Obsidian config | manual zip drop | [fkrebs/obsidian-config](https://git.nuclide.systems/fkrebs/obsidian-config) | manual (or via Obsidian Git plugin) | `/tmp/obsidian-config-init.sh` (one-shot) | `.obsidian/` minus `workspace*.json`, `cache/`, `*.bak*` |
|
|
|
|
`fkrebs/ha-config` was created in error 2026-05-24 — deleted.
|
|
|
|
## Pattern
|
|
|
|
All scripts follow the same shape:
|
|
|
|
```bash
|
|
#!/bin/bash
|
|
set -e
|
|
REPO_URL="https://fkrebs:<TOKEN>@git.nuclide.systems/fkrebs/<repo>.git"
|
|
WORK="/tmp/<name>-work"
|
|
mkdir -p "$WORK"
|
|
git -C "$WORK" init -b main -q 2>/dev/null || true
|
|
git -C "$WORK" config user.email "noreply@nuclide.systems"
|
|
git -C "$WORK" config user.name "<name>-backup"
|
|
git -C "$WORK" remote set-url origin "$REPO_URL" 2>/dev/null \
|
|
|| git -C "$WORK" remote add origin "$REPO_URL"
|
|
rsync -a --delete --exclude='.git' [+ secret excludes] <source>/ "$WORK/"
|
|
git -C "$WORK" add -A
|
|
git -C "$WORK" commit -q -m "auto: $(date -u +%Y-%m-%dT%H:%M:%SZ)" 2>/dev/null || true
|
|
git -C "$WORK" push -q --force origin main
|
|
```
|
|
|
|
PVE/CT 108/CT 102 use a rsync-to-tmp-then-push pattern. HAOS uses an in-place `git add -A` on `/config` because the `.gitignore` there is hand-curated with an allowlist for `.storage/`.
|
|
|
|
## HAOS specifics
|
|
|
|
- **Path**: `/config/scripts/git-push.sh` (mode 0700, runs in the Terminal & SSH addon).
|
|
- **Remote**: `https://fkrebs:<TOKEN>@git.nuclide.systems/fkrebs/home-assistant-config.git`. Token lives in `/config/.git/config` (mode 0600).
|
|
- **`.gitignore`** uses a default-deny allowlist for `.storage/` — only safe registry/lovelace/helpers/energy files are tracked. Tokens (`core.config_entries`, `mobile_app`, `androidtv_adbkey*`, etc.) are explicitly excluded. See `/config/.gitignore` on HAOS for the full list.
|
|
- **Scheduling** — Terminal & SSH addon container is rebuilt on update, so its `crontabs/` are not persistent. Use the addon's `init_commands` (Configuration tab):
|
|
|
|
```yaml
|
|
init_commands:
|
|
- 'echo "0 3 * * * /config/scripts/git-push.sh >> /config/scripts/git-push.log 2>&1" > /etc/crontabs/root && crond -b'
|
|
```
|
|
|
|
Then **Restart** the addon. Alternative: HA automation calling `shell_command` is not viable — the `homeassistant` container doesn't have SSH to addon containers.
|
|
|
|
## Token rotation
|
|
|
|
All four repos use the same PAT (`fkrebs` user, full repo scope). Rotate by:
|
|
|
|
1. Generate new PAT in Gitea → user settings → applications.
|
|
2. `git remote set-url origin https://fkrebs:<NEW>@git.nuclide.systems/fkrebs/<repo>.git` on each host.
|
|
3. Manually run each script once to verify.
|
|
|
|
Token leak risk: tracked in [[gitea_open_issues]]; long-term move is to switch to per-host deploy keys.
|
|
|
|
## Verification
|
|
|
|
Last commit on each repo should be `auto: <today>T03:0X:XXZ`. Quick check:
|
|
|
|
```bash
|
|
for r in pve-conf zoraxy-conf adguard-conf home-assistant-config; do
|
|
echo -n "$r: "
|
|
curl -sk -H "Authorization: token <TOKEN>" \
|
|
"https://git.nuclide.systems/api/v1/repos/fkrebs/$r/commits?limit=1" \
|
|
| python3 -c 'import json,sys; c=json.load(sys.stdin)[0]; print(c["commit"]["author"]["date"], c["commit"]["message"][:60])'
|
|
done
|
|
```
|
|
|
|
## Related
|
|
|
|
- [[homelab-architecture]] — host topology
|
|
- [[backrest-ct103]] — separate, repo-style binary backup for data (not config)
|