419ab475b1
Two additions: 1. secrets-issuance backup: daily timer snapshots /var/lib/secrets-issuance to /mnt/library/.secrets-issuance-backup/ as a date-stamped tar.gz, keeping the last 14 days. Closes the catastrophic-fail-mode where an LXC 105 loss wipes every client's age key with no recovery path. Caveat: privileged LXCs that mount /mnt/library can read the backup (root-uid maps to host root); encrypted-tarball variant is a future refinement. 2. homelab doctor: 10 invariant checks for an enrolled client — clone present, sync timer/launchd job active, age key perms, CLI symlinked, AGENTS.md linked, inventory entry exists, MCP reachable, secrets /health responds, sops canary decrypts, git creds present. Returns nonzero on any 'fail'. Useful after enrollment or whenever something smells off. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
10 lines
206 B
Desktop File
10 lines
206 B
Desktop File
[Unit]
|
|
Description=Snapshot secrets-issuance state to /mnt/library
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/opt/secrets-issuance/secrets-issuance/backup.sh
|
|
Nice=10
|
|
TimeoutStartSec=300
|