Files
felhom.eu/documentation/audits/offsite-lock-build-2026-10-03/partA/A2-rclone-on-sftp-repo.txt
T
admin f417cdede1
gates / gates (push) Successful in 29s
hub v0.127.0: off-site key registrar (box never gets the storage password), password sealed at rest, daily key check, clean-up window (shipped off) — decisions 68-69, R-820/R-821/R-822
Part A evidence (migration spike, sftp-written repo through the pinned rclone key) and the hub
red-proofs under documentation/audits/offsite-lock-build-2026-10-03/. Manifest bump follows after
the image is built and Secret/offsite-secret-key exists.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-03 16:57:04 +02:00

75 lines
2.3 KiB
Plaintext

## 2. key line now PINNED (same key). 3. rclone: through it
control: today's sftp: transport through the pinned key:
$ sftp.sh snapshots
Fatal: unable to open repository at sftp:u629488-sub4@u629488-sub4.your-storagebox.de:spike-migrate: unable to start the sftp session, error: unexpected EOF
[rc=1]
$ rc.sh snapshots
ID Time Host Tags Paths
--------------------------------------------------------------
9c767903 2026-10-03 14:04:12 migbox app1 /d/tree
761dc658 2026-10-03 14:04:18 migbox app1 /d/tree
--------------------------------------------------------------
2 snapshots
[rc=0]
$ rc.sh backup /d/tree --host migbox --tag app1
using parent snapshot 761dc658
Files: 0 new, 0 changed, 3 unmodified
Dirs: 0 new, 0 changed, 3 unmodified
Added to the repository: 0 B (0 B stored)
processed 3 files, 390.641 KiB in 0:00
snapshot 56667008 saved
[rc=0]
$ rc.sh restore 9c767903 --target /d/restored --include /d/tree/sub/note.txt
restoring <Snapshot 9c767903 of [/d/tree] at 2026-10-03 14:04:12.212018962 +0000 UTC by root@migbox> to /d/restored
[rc=0]
restored sftp-era file == its content at that snapshot: IDENTICAL
$ rc.sh check
using temporary cache in /tmp/restic-check-cache-456083153
create exclusive lock for repository
load indexes
check all packs
check snapshots, trees and blobs
[0:00] 100.00% 3 / 3 snapshots
no errors were found
[rc=0]
$ rc.sh check --read-data
using temporary cache in /tmp/restic-check-cache-2313441632
create exclusive lock for repository
load indexes
check all packs
check snapshots, trees and blobs
[0:00] 100.00% 3 / 3 snapshots
read all data
[0:00] 100.00% 4 / 4 packs
no errors were found
[rc=0]
## 4.
$ rc.sh forget 9c767903
unable to remove <snapshot/9c767903c1> from the repository
[0:48] 0.00% 0 / 1 files deleted
blob not removed, server response: 403 Forbidden (403)
[rc=1]
$ rc.sh snapshots
ID Time Host Tags Paths
--------------------------------------------------------------
9c767903 2026-10-03 14:04:12 migbox app1 /d/tree
761dc658 2026-10-03 14:04:18 migbox app1 /d/tree
56667008 2026-10-03 14:04:51 migbox app1 /d/tree
--------------------------------------------------------------
3 snapshots
[rc=0]