dev_agentandClaude Opus 5.5 765740b921 Run the media backup as uid 10001 and add the deploy runbook ...

Address review of 9ac3342:

- The media backup now runs as the host user mealquest (10001) with no
  capabilities. systemd bind-mounts the data volume read-only at
  /run/mealquest-data and passes the NAS key as a credential; the script
  changes into media, refuses it if the physical path differs (symlink)
  and rsyncs "./", so the path cannot be swapped under it. ssh pins the
  NAS host keys from /etc/mealquest/known_hosts (deploy/known_hosts).
- A missing media directory now fails the job. The deploy step creates it.
- deploy/RUNBOOK.md records the Traefik route (task 0c1dc172), backup
  setup, the restore procedure (stop, move db/-wal/-shm aside, restore,
  count check, start) and the 2026-10-05 drill with ltx -level all.

Task: d2f2e87e-5114-4ef1-93ab-360ffb5c009e

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-05 19:28:36 -04:00

..

mealquest-firewall.service

Host firewall allowlist unit (DOCKER-USER, port 8090) (#72)

2026-10-05 17:56:12 -04:00

mealquest-firewall.sh

Host firewall allowlist unit (DOCKER-USER, port 8090) (#72)

2026-10-05 17:56:12 -04:00

mealquest-media-backup.service

Run the media backup as uid 10001 and add the deploy runbook

2026-10-05 19:28:36 -04:00

mealquest-media-backup.sh

Run the media backup as uid 10001 and add the deploy runbook

2026-10-05 19:28:36 -04:00

mealquest-media-backup.timer

Litestream replication to the NAS and nightly media backup

2026-10-05 19:15:16 -04:00