clconsole has no backup of any kind #35

New issue

Closed

opened 2026-09-21 16:35:45 +01:00 by cruelacid · 1 comment

cruelacid commented

2026-09-21 16:35:45 +01:00

Owner

Two copies were taken before that day's Forgejo upgrade, but they are pre-upgrade artefacts rather than a schedule:

/home/cruelacid/forgejo/data.pre-upgrade-20260921T142931Z — raw, 9.4 G, on the same disk
forgejo-dump-20260921.tar.zst — 95 MB, copied to the operator's Mac

Sizes make the shape clear: packages 9.3 G (registry, CI can republish), gitea.db 104 M (not rebuildable — issues, PRs, CI history, secrets), git repositories 50 M for all three.

deploy/restic/ already does exactly this for the fleet against S3-compatible storage and is the obvious thing to point at this box. Note the two gotchas found on 21 Sep: a raw cp -a fails on root-owned data/ssh and must run as root inside a container (no passwordless sudo on clconsole), and forgejo dump refuses to run as root and must run as uid 1000.

The dump contains secrets — RENOVATE_TOKEN, the registry credentials and the runner registration token all live in gitea.db. The copy on the Mac should not outlive its usefulness.

Checked on 21 Sep 2026: no dumps, no restic (not installed), no backup timers. The git repositories, every issue and pull request, the CI history, the Actions secrets and the 9.3 GB container registry the fleet pulls from exist in exactly one place. Two copies were taken before that day's Forgejo upgrade, but they are pre-upgrade artefacts rather than a schedule: - `/home/cruelacid/forgejo/data.pre-upgrade-20260921T142931Z` — raw, 9.4 G, on the same disk - `forgejo-dump-20260921.tar.zst` — 95 MB, copied to the operator's Mac Sizes make the shape clear: `packages` 9.3 G (registry, CI can republish), `gitea.db` 104 M (**not** rebuildable — issues, PRs, CI history, secrets), git repositories 50 M for all three. `deploy/restic/` already does exactly this for the fleet against S3-compatible storage and is the obvious thing to point at this box. Note the two gotchas found on 21 Sep: a raw `cp -a` fails on root-owned `data/ssh` and must run as root inside a container (no passwordless sudo on clconsole), and `forgejo dump` refuses to run as root and must run as uid 1000. **The dump contains secrets** — `RENOVATE_TOKEN`, the registry credentials and the runner registration token all live in `gitea.db`. The copy on the Mac should not outlive its usefulness.

cruelacid referenced this issue

2026-09-21 18:06:06 +01:00

Notifications and mentions #66

cruelacid commented

2026-09-23 18:55:49 +01:00

Author

Owner

Moved to the Vikunja board as NEC-12: https://projectron.nerchure.com/tasks/12

Moved to the Vikunja board as **NEC-12**: https://projectron.nerchure.com/tasks/12

cruelacid closed this issue

2026-09-23 18:55:49 +01:00