dev_agentandClaude Opus 5.5
765740b921
Address review of 9ac3342:
- The media backup now runs as the host user mealquest (10001) with no
capabilities. systemd bind-mounts the data volume read-only at
/run/mealquest-data and passes the NAS key as a credential; the script
changes into media, refuses it if the physical path differs (symlink)
and rsyncs "./", so the path cannot be swapped under it. ssh pins the
NAS host keys from /etc/mealquest/known_hosts (deploy/known_hosts).
- A missing media directory now fails the job. The deploy step creates it.
- deploy/RUNBOOK.md records the Traefik route (task 0c1dc172), backup
setup, the restore procedure (stop, move db/-wal/-shm aside, restore,
count check, start) and the 2026-10-05 drill with ltx -level all.
Task: d2f2e87e-5114-4ef1-93ab-360ffb5c009e
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
30 lines
1.1 KiB
Desktop File
30 lines
1.1 KiB
Desktop File
# Runs the nightly MealQuest media backup (/usr/local/sbin/mealquest-media-backup).
|
|
# Triggered by mealquest-media-backup.timer; run by hand with
|
|
# systemctl start mealquest-media-backup
|
|
# and read the result with
|
|
# journalctl -u mealquest-media-backup
|
|
#
|
|
# The script runs as the app's user (10001, host user "mealquest") with no
|
|
# capabilities. systemd, as root, only bind-mounts the data volume's root
|
|
# (a root-owned path the app cannot replace) read-only at
|
|
# /run/mealquest-data and copies the NAS key into the credentials directory.
|
|
[Unit]
|
|
Description=Back up MealQuest media to the Synology NAS
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/mealquest-media-backup
|
|
User=mealquest
|
|
Group=mealquest
|
|
LoadCredential=nas_key:/home/overseer/mealquest/deploy/secrets/litestream_key
|
|
BindReadOnlyPaths=/var/lib/docker/volumes/mealquest-data/_data:/run/mealquest-data
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
NoNewPrivileges=yes
|
|
CapabilityBoundingSet=
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|