3 Commits

Author	SHA1	Message	Date
admin	5e0625410a	security(offbox): validate host/user/repo before the ssh exec (option-injection guard) ... Background commit review flagged command/option injection: operator-provided host/user/ repo_path flow into restic's ssh -s sftp command. Reject leading '-' (ssh option injection, e.g. -oProxyCommand) + metacharacters/traversal; OffboxConfigured fails closed on an invalid target. Companion test covers the injection cases. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs	2026-06-30 15:39:22 +02:00
admin	02820d6550	fix(offbox): use restic -o sftp.command (0.14 has no sftp.args) ... Live validation surfaced 'option sftp.args is not known' on restic 0.14.0; switch to the portable sftp.command SSH invocation (ConnectTimeout/StrictHostKeyChecking preserved). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs	2026-06-30 15:32:43 +02:00
admin	2a7deadc93	controller v0.93.0: NAS Part B off-box backup target (restic-over-SFTP) ... Encrypted restic repo over SFTP for the app-data tier (the off-site 3-2-1 leg). A dead NAS fails fast via -oConnectTimeout (spike Q8), never hangs the runner; secrets are 0600 files (ride DR via PBS whole-CT); init-if-absent, retention forget --prune, restore, single-flight, per-app toggle + UI. restic re-added to the image. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs	2026-06-30 15:26:38 +02:00