419ab475b1
Two additions: 1. secrets-issuance backup: daily timer snapshots /var/lib/secrets-issuance to /mnt/library/.secrets-issuance-backup/ as a date-stamped tar.gz, keeping the last 14 days. Closes the catastrophic-fail-mode where an LXC 105 loss wipes every client's age key with no recovery path. Caveat: privileged LXCs that mount /mnt/library can read the backup (root-uid maps to host root); encrypted-tarball variant is a future refinement. 2. homelab doctor: 10 invariant checks for an enrolled client — clone present, sync timer/launchd job active, age key perms, CLI symlinked, AGENTS.md linked, inventory entry exists, MCP reachable, secrets /health responds, sops canary decrypts, git creds present. Returns nonzero on any 'fail'. Useful after enrollment or whenever something smells off. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
12 lines
196 B
SYSTEMD
12 lines
196 B
SYSTEMD
[Unit]
|
|
Description=Daily secrets-issuance backup
|
|
|
|
[Timer]
|
|
OnCalendar=*-*-* 03:30:00
|
|
RandomizedDelaySec=10min
|
|
Persistent=true
|
|
Unit=secrets-issuance-backup.service
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|