Arlind
6f656b7121
Recon of the live box (Ubuntu 24.04 x86_64, nginx 1.24, certbot 2.9) showed established conventions from the existing fenja / bifrost-customer services. Match them so the portal looks like a first-class citizen: - service runs as the existing `fenja` user, journald logging + full hardening block (ProtectKernelModules, LockPersonality), ExecStart on /usr/bin/node (box upgraded globally to Node 22) - code in /opt/bifrost-portal, in-dir .env (EnvironmentFile), data under the shared /opt/fenja/data/bifrost-portal (ReadWritePaths) - nginx: 1.24 `listen ... ssl http2` syntax, certbot options-ssl-nginx + dhparam includes, server_tokens off, sites-available/bifrost-portal (no .conf) symlinked; 12m body size for photo uploads; port 4322 (free) - deploy.sh / backup.sh point at the new paths - DEPLOY.md rewritten as a server-specific runbook incl. the global Node 22 upgrade + retest of the existing apps, and pnpm via corepack Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
32 lines
1 KiB
Bash
Executable file
32 lines
1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
#
|
|
# Nightly SQLite backup for the Bifrost portal. Uses the online .backup API
|
|
# (safe while the app is running — consistent, no locking issues with WAL).
|
|
# Keeps 30 days of compressed snapshots.
|
|
#
|
|
# Install as a cron job (as the `fenja` user):
|
|
# crontab -e
|
|
# 15 3 * * * /opt/bifrost-portal/scripts/backup.sh >> /opt/fenja/data/bifrost-portal/backup.log 2>&1
|
|
#
|
|
# For offsite copies, sync BACKUP_DIR to remote storage separately
|
|
# (e.g. rclone/rsync in a second cron line).
|
|
|
|
set -euo pipefail
|
|
|
|
DB_PATH="${BIFROST_DB_PATH:-/opt/fenja/data/bifrost-portal/bifrost.db}"
|
|
BACKUP_DIR="${BACKUP_DIR:-/opt/fenja/data/bifrost-portal/backups}"
|
|
RETENTION_DAYS="${RETENTION_DAYS:-30}"
|
|
|
|
mkdir -p "$BACKUP_DIR"
|
|
|
|
stamp="$(date -u +%Y%m%d-%H%M%S)"
|
|
out="$BACKUP_DIR/bifrost-$stamp.db"
|
|
|
|
echo "==> Backing up $DB_PATH -> $out"
|
|
sqlite3 "$DB_PATH" ".backup '$out'"
|
|
gzip -f "$out"
|
|
|
|
echo "==> Pruning backups older than $RETENTION_DAYS days"
|
|
find "$BACKUP_DIR" -name 'bifrost-*.db.gz' -type f -mtime "+$RETENTION_DAYS" -delete
|
|
|
|
echo "==> Backup complete: ${out}.gz"
|