admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

README: the database password comes back with the data (R-1106); restic 0.19.1
gates / gates (push) Successful in 49s
Details

Browse Source
This commit is contained in:
authentik Default Admin
2026-10-16 23:49:58 +02:00
parent f75b3aa778
commit b69585789a
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/README.md
+8 -1
View File
@@ -1538,6 +1538,13 @@ backups/primary/<app>/
⚠️ **R-127:** a regenerated **database** password is NOT harmless — `POSTGRES_PASSWORD` is ignored once ⚠️ **R-127:** a regenerated **database** password is NOT harmless — `POSTGRES_PASSWORD` is ignored once
PGDATA is non-empty, so the restored data dir keeps the old role hash and the app cannot authenticate PGDATA is non-empty, so the restored data dir keeps the old role hash and the app cannot authenticate
against its own rows, while the dump replay (local trust socket) still reports success. The WARN says so. against its own rows, while the dump replay (local trust socket) still reports success. The WARN says so.
- **The database password comes back with the data (v0.324.0, R-1106, operator decision 1A).** The app.yaml
variables that feed a database service's `*_PASSWORD` (`appbackup.DBCredentialVars`) are never generated (O4 skips
them): the unit's value wins; without one, the current install's value counts only when that install is OLDER than the
data; otherwise the restore is refused before any change (`err.backup.restore_no_db_password`). The off-site full
restore that keeps the app's definition (the reinstall case) writes the snapshot's password into the app's settings
(`stacks.SetStackSecretValues`, load-then-save) before the database starts — only when the snapshot replays the
database's data volume (`appbackup.DBDataVolumes`). Design: felhom.eu `07` §7.4. Catalog gate `db-credentials`.
- Helpers: `RecoveryUnitPath` / `RecoveryUnitComposePath` / `RecoveryUnitManifestPath` - Helpers: `RecoveryUnitPath` / `RecoveryUnitComposePath` / `RecoveryUnitManifestPath`
(`internal/appbackup/paths.go`). Capture: `Manager.CaptureRecoveryUnit` (`internal/backup/recovery_unit.go`), (`internal/appbackup/paths.go`). Capture: `Manager.CaptureRecoveryUnit` (`internal/backup/recovery_unit.go`),
run from the daily DB dump and the periodic `RefreshCache` (idempotent checksum-skip); the split itself run from the daily DB dump and the periodic `RefreshCache` (idempotent checksum-skip); the split itself
@@ -4649,7 +4656,7 @@ git -C ~/git/felhom-controller pull
Runtime `debian:13.x-slim`, pinned by version and digest; the Docker CLI's apt repo codename is read from the image's Runtime `debian:13.x-slim`, pinned by version and digest; the Docker CLI's apt repo codename is read from the image's
`/etc/os-release`. **restic is NOT an apt package:** the `restic` build stage downloads the official release binary of `/etc/os-release`. **restic is NOT an apt package:** the `restic` build stage downloads the official release binary of
the version in `ARG RESTIC_VERSION`, checks restic's signed `SHA256SUMS` with the vendored release key the version in `ARG RESTIC_VERSION` (0.19.1 since v0.324.0, R-1107), checks restic's signed `SHA256SUMS` with the vendored release key
(`third_party/restic/`), the published sum, and the per-architecture sum pinned in the Dockerfile — any mismatch fails (`third_party/restic/`), the published sum, and the per-architecture sum pinned in the Dockerfile — any mismatch fails
the build. Moving restic is a decision with a re-proof: `internal/backup/testdata/restic/<version>/` holds REAL outputs the build. Moving restic is a decision with a re-proof: `internal/backup/testdata/restic/<version>/` holds REAL outputs
of each version the off-site code was checked against, and `TestR1105_*` assert every parsed shape and failure class of each version the off-site code was checked against, and `TestR1105_*` assert every parsed shape and failure class