Pre-launch — Gluecron is in final validation. Public signups and git hosting for non-owner users open after launch review.
ccantynz/Gluecron.com
Commit1a07e02

feat(backup): offsite repos+DB backup so we can drop the GitHub mirror

feat(backup): offsite repos+DB backup so we can drop the GitHub mirror

The bare git repos under GIT_REPOS_PATH were the one piece of platform
state with NO off-box copy — the DB stores only metadata and cannot
reconstruct git objects. GitHub was serving as the de-facto offsite
backup; cutting it with no replacement would make a dead VPS a total
data-loss event.

- scripts/backup-offsite.sh: Neon-aware (pg_dump over DATABASE_URL, not
  the docker-only backup.sh) + tars the bare repos, pushes both to an
  rclone remote, fails LOUD if a configured offsite copy fails, prunes
  by retention, and pings a dead-man's-switch only on full success.
- scripts/restore.sh: companion DR restore for repos (into a scratch dir
  by default, never clobbering live) and db (into SCRATCH_DATABASE_URL by
  default, never prod without an explicit --target-url).

Install as a daily systemd timer per docs/CUTOVER_RUNBOOK.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ccanty labs committed on July 8, 2026Parent: 78ede81
2 files changed+140−01a07e0202e956c2d4cfb477b7682de5288d62220
2 changed files+140−0
Addedscripts/backup-offsite.sh+88−0View fileUnifiedSplit
1#!/usr/bin/env bash
2#
3# Durable offsite backup for the self-hosted VPS (systemd + Neon, NOT docker).
4#
5# This is the backup that lets Gluecron drop the GitHub mirror safely: it is
6# the ONLY off-box copy of the bare git repos once GitHub is gone. It captures
7# both halves of the platform's state:
8#
9# 1. the bare git repos under $GIT_REPOS_PATH (the actual repo objects —
10# the DB only stores metadata and CANNOT reconstruct these)
11# 2. the Neon Postgres database via pg_dump over $DATABASE_URL
12#
13# ...then pushes both to an offsite bucket with rclone and pings a
14# dead-man's-switch so a silently-missed backup pages you.
15#
16# Install as a systemd timer (see docs/CUTOVER_RUNBOOK.md). Run daily.
17#
18# Required env (set in /etc/gluecron.env):
19# DATABASE_URL Neon connection string (postgresql://...)
20# BACKUP_RCLONE_REMOTE e.g. r2:gluecron-backups (rclone must be configured)
21# Optional env:
22# GIT_REPOS_PATH bare repos dir (default: /opt/gluecron/repos)
23# BACKUP_DIR local staging dir (default: /opt/gluecron/backups)
24# RETAIN_DAYS local + offsite retention (default: 14)
25# HEALTHCHECK_PING_URL https://hc-ping.com/<uuid> (healthchecks.io)
26set -euo pipefail
27
28GIT_REPOS_PATH="${GIT_REPOS_PATH:-/opt/gluecron/repos}"
29BACKUP_DIR="${BACKUP_DIR:-/opt/gluecron/backups}"
30RETAIN_DAYS="${RETAIN_DAYS:-14}"
31
32log() { echo "$(date -Is) [backup-offsite] $*"; }
33
34if [ -z "${DATABASE_URL:-}" ]; then
35 log "FATAL: DATABASE_URL is not set — cannot back up the database."
36 exit 1
37fi
38
39mkdir -p "$BACKUP_DIR"
40ts=$(date +%Y%m%d-%H%M%S)
41repos_out="$BACKUP_DIR/repos-$ts.tar.gz"
42db_out="$BACKUP_DIR/db-$ts.dump"
43
44# 1. Bare git repos — the irreplaceable half. tar the whole tree; bare repos
45# are self-contained so a plain tar is a valid, restorable snapshot.
46if [ -d "$GIT_REPOS_PATH" ]; then
47 tar -czf "$repos_out" -C "$(dirname "$GIT_REPOS_PATH")" "$(basename "$GIT_REPOS_PATH")"
48 log "repos snapshot: $repos_out ($(du -h "$repos_out" | cut -f1))"
49else
50 log "WARN: GIT_REPOS_PATH ($GIT_REPOS_PATH) does not exist — skipping repos snapshot"
51fi
52
53# 2. Database — custom format so pg_restore can do selective/parallel restore.
54pg_dump --format=custom --no-owner --no-privileges "$DATABASE_URL" > "$db_out"
55log "db dump: $db_out ($(du -h "$db_out" | cut -f1))"
56
57# 3. Offsite copy (both artifacts). Fail LOUD if configured but the copy fails —
58# a backup that only lives on the same box it protects is not a backup.
59if [ -n "${BACKUP_RCLONE_REMOTE:-}" ]; then
60 if ! command -v rclone >/dev/null 2>&1; then
61 log "FATAL: BACKUP_RCLONE_REMOTE set but rclone is not installed"
62 exit 1
63 fi
64 rclone copy "$db_out" "$BACKUP_RCLONE_REMOTE/db/" \
65 && log "offsite: db -> $BACKUP_RCLONE_REMOTE/db/" \
66 || { log "FATAL: offsite db copy failed"; exit 1; }
67 if [ -f "$repos_out" ]; then
68 rclone copy "$repos_out" "$BACKUP_RCLONE_REMOTE/repos/" \
69 && log "offsite: repos -> $BACKUP_RCLONE_REMOTE/repos/" \
70 || { log "FATAL: offsite repos copy failed"; exit 1; }
71 fi
72 # Prune offsite copies older than retention (best-effort).
73 rclone delete --min-age "${RETAIN_DAYS}d" "$BACKUP_RCLONE_REMOTE/db/" 2>/dev/null || true
74 rclone delete --min-age "${RETAIN_DAYS}d" "$BACKUP_RCLONE_REMOTE/repos/" 2>/dev/null || true
75else
76 log "WARN: BACKUP_RCLONE_REMOTE not set — backup is LOCAL ONLY (not safe as the sole copy once GitHub is gone)"
77fi
78
79# 4. Local retention.
80find "$BACKUP_DIR" -name 'repos-*.tar.gz' -mtime +"$RETAIN_DAYS" -delete 2>/dev/null || true
81find "$BACKUP_DIR" -name 'db-*.dump' -mtime +"$RETAIN_DAYS" -delete 2>/dev/null || true
82
83# 5. Dead-man's-switch: only ping on full success (reached the end of the script).
84if [ -n "${HEALTHCHECK_PING_URL:-}" ]; then
85 curl -fsS -m 10 "$HEALTHCHECK_PING_URL" >/dev/null 2>&1 || true
86fi
87
88log "done."
Addedscripts/restore.sh+52−0View fileUnifiedSplit
1#!/usr/bin/env bash
2#
3# Disaster-recovery restore for the self-hosted VPS. Companion to
4# scripts/backup-offsite.sh. Proves the backups are actually restorable —
5# an untested backup is a hope, not a backup.
6#
7# Usage:
8# scripts/restore.sh repos <repos-YYYYMMDD-HHMMSS.tar.gz> [--dest DIR]
9# scripts/restore.sh db <db-YYYYMMDD-HHMMSS.dump> [--target-url URL]
10#
11# Modes:
12# repos Extract a repos snapshot into --dest (default: a scratch dir under
13# /tmp so you can diff/verify before swapping it into place). It does
14# NOT overwrite the live $GIT_REPOS_PATH unless you point --dest there.
15# db pg_restore a db dump into --target-url (default: $SCRATCH_DATABASE_URL,
16# NEVER $DATABASE_URL by default — restoring over prod must be explicit).
17#
18# Pull an artifact from offsite first if needed:
19# rclone copy $BACKUP_RCLONE_REMOTE/repos/repos-<ts>.tar.gz ./
20set -euo pipefail
21
22log() { echo "$(date -Is) [restore] $*"; }
23die() { log "FATAL: $*"; exit 1; }
24
25mode="${1:-}"; artifact="${2:-}"
26shift 2 2>/dev/null || true
27
28[ -n "$mode" ] && [ -n "$artifact" ] || die "usage: restore.sh {repos|db} <artifact> [opts]"
29[ -f "$artifact" ] || die "artifact not found: $artifact"
30
31case "$mode" in
32 repos)
33 dest="/tmp/gluecron-restore-$(date +%s)"
34 while [ $# -gt 0 ]; do case "$1" in --dest) dest="$2"; shift 2;; *) shift;; esac; done
35 mkdir -p "$dest"
36 tar -xzf "$artifact" -C "$dest"
37 log "extracted repos snapshot into: $dest"
38 log "verify a repo, e.g.: git -C \"$dest\"/repos/<owner>/<name>.git log -1"
39 log "when satisfied, swap into place by stopping gluecron and rsync-ing over \$GIT_REPOS_PATH"
40 ;;
41 db)
42 target="${SCRATCH_DATABASE_URL:-}"
43 while [ $# -gt 0 ]; do case "$1" in --target-url) target="$2"; shift 2;; *) shift;; esac; done
44 [ -n "$target" ] || die "no target: pass --target-url or set SCRATCH_DATABASE_URL (refusing to guess prod)"
45 log "restoring $artifact into $target"
46 pg_restore --clean --if-exists --no-owner --no-privileges --dbname "$target" "$artifact"
47 log "restore complete. sanity-check: psql \"$target\" -c 'select count(*) from users;'"
48 ;;
49 *)
50 die "unknown mode '$mode' (want: repos | db)"
51 ;;
52esac
053