Skip to content

Fix/infisical to keep #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
boidushya merged 3 commits into from
May 4, 2026
Merged

Fix/infisical to keep #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dd675bc
infra: swap infisical for self-hosted keep
boidushya May 4, 2026
dfc986d
infra: backup keep.db nightly to B2
boidushya May 4, 2026
ae3efd4
Merge branch 'master' into fix/infisical-to-keep
boidushya May 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions infra/files/backups/backup-keep.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
#!/bin/bash
# Online backup of keep.db: SQLite .backup as the keep user (the only one with read on /var/lib/keep/keep.db),
# then rclone push as the deploy user (the only one with the B2 credentials).
# The DB is age-encrypted at rest, so mode 644 on the backup file is fine.

set -euo pipefail

DEST=/var/backups/keep
install -d -o keep -g keep -m 0755 "$DEST"

TS=$(date -u +%Y-%m-%d_%H-%M-%S)
FILE="$DEST/keep_backup_$TS.db"

runuser -u keep -- sqlite3 /var/lib/keep/keep.db ".backup '$FILE'"
chmod 644 "$FILE"

runuser -u deploy -- /usr/bin/rclone copy "$FILE" b2:lyrics-api-backups/keep/daily/ --transfers 4
if [ "$(date -u +%u)" = "7" ]; then
runuser -u deploy -- /usr/bin/rclone copy "$FILE" b2:lyrics-api-backups/keep/weekly/ --transfers 4
fi

# Local retention: 7 days
find "$DEST" -name 'keep_backup_*.db' -mtime +7 -delete
5 changes: 5 additions & 0 deletions infra/files/backups/keep-backup.cron
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# /etc/cron.d/keep-backup
# Daily keep.db backup at 03:45 UTC (after cache.db backup window). Runs as root because the script
# needs to switch to keep (read DB) and deploy (push to B2) without password prompts.
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
45 3 * * * root /usr/local/bin/backup-keep.sh
2 changes: 1 addition & 1 deletion infra/phases/01-packages.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ DEBIAN_FRONTEND=noninteractive apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install -y \
curl wget ca-certificates gnupg lsb-release \
ufw fail2ban \
rclone jq git \
rclone jq git sqlite3 \
apt-transport-https debian-archive-keyring

echo "OK: base packages installed"
8 changes: 8 additions & 0 deletions infra/phases/08-backups.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,14 @@ install -m 755 -o root -g root \
install -m 755 -o root -g root \
"$INFRA_DIR/files/backups/upload-backup.sh" \
/usr/local/bin/upload-backup.sh
install -m 755 -o root -g root \
"$INFRA_DIR/files/backups/backup-keep.sh" \
/usr/local/bin/backup-keep.sh

# System cron for keep.db backup (runs as root, drops to keep + deploy via runuser)
install -m 644 -o root -g root \
"$INFRA_DIR/files/backups/keep-backup.cron" \
/etc/cron.d/keep-backup

# rclone config for deploy user (mode 600)
install -d -o deploy -g deploy -m 700 /home/deploy/.config
Expand Down
Loading