3 Commits

Include renames

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	765740b921	Run the media backup as uid 10001 and add the deploy runbook ... Address review of 9ac3342: - The media backup now runs as the host user mealquest (10001) with no capabilities. systemd bind-mounts the data volume read-only at /run/mealquest-data and passes the NAS key as a credential; the script changes into media, refuses it if the physical path differs (symlink) and rsyncs "./", so the path cannot be swapped under it. ssh pins the NAS host keys from /etc/mealquest/known_hosts (deploy/known_hosts). - A missing media directory now fails the job. The deploy step creates it. - deploy/RUNBOOK.md records the Traefik route (task 0c1dc172), backup setup, the restore procedure (stop, move db/-wal/-shm aside, restore, count check, start) and the 2026-10-05 drill with ltx -level all. Task: d2f2e87e-5114-4ef1-93ab-360ffb5c009e Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 19:28:36 -04:00
dev_agentandClaude Opus 5.5	9ac3342664	Litestream replication to the NAS and nightly media backup ... Add a litestream service (0.5.17) to the compose stack that streams /data/mealquest.db over SFTP to the Synology NAS with a dedicated key, daily snapshots kept for a week. Add a systemd timer that rsyncs the media directory to the NAS nightly at 03:30. Task: d2f2e87e-5114-4ef1-93ab-360ffb5c009e Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 19:15:16 -04:00
dev_agent	9d0e943fc3	Host firewall allowlist unit (DOCKER-USER, port 8090) (#72) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-05 17:56:12 -04:00