dtoro/oikos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

secrets-issuance backup + homelab doctor smoke-test

Browse Source 
Two additions:

1. secrets-issuance backup: daily timer snapshots /var/lib/secrets-issuance
   to /mnt/library/.secrets-issuance-backup/ as a date-stamped tar.gz,
   keeping the last 14 days. Closes the catastrophic-fail-mode where an
   LXC 105 loss wipes every client's age key with no recovery path.
   Caveat: privileged LXCs that mount /mnt/library can read the backup
   (root-uid maps to host root); encrypted-tarball variant is a future
   refinement.

2. homelab doctor: 10 invariant checks for an enrolled client — clone
   present, sync timer/launchd job active, age key perms, CLI symlinked,
   AGENTS.md linked, inventory entry exists, MCP reachable, secrets
   /health responds, sops canary decrypts, git creds present. Returns
   nonzero on any 'fail'. Useful after enrollment or whenever something
   smells off.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
root
2026-05-20 21:37:42 +02:00
parent b4ca21b2b3
commit 419ab475b1
5 changed files with 251 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
secrets-issuance/backup.service Normal file
View File

@@ -0,0 +1,9 @@
[Unit]
Description=Snapshot secrets-issuance state to /mnt/library
After=network-online.target
[Service]
Type=oneshot
ExecStart=/opt/secrets-issuance/secrets-issuance/backup.sh
Nice=10
TimeoutStartSec=300