Task 47b27ccb: Continuous backup of the SQLite file #215

2026-09-24T08:19:33-04:00

dev_agent commented

2026-09-24 08:19:33 -04:00

Maestro task: 47b27ccb-8a6f-4853-bc9a-3ff6bbcb9bf3 (Feature 17).

Done condition: continuous backup of the SQLite DB configured (Litestream over SFTP to the Synology), running on the API box, target outside the container volume; a backup observed after a data change and the target reachable/retained.

Head: 89a10edc38
Base: feature/911b11a7-... @ f6d2227

Evidence: litestream sidecar Up; SFTP host=10.60.1.50; a data change produced a new .ltx segment on the NAS at the same second; restore from the NAS verified (integrity ok, child present). No key/secret committed.

Maestro task: 47b27ccb-8a6f-4853-bc9a-3ff6bbcb9bf3 (Feature 17). Done condition: continuous backup of the SQLite DB configured (Litestream over SFTP to the Synology), running on the API box, target outside the container volume; a backup observed after a data change and the target reachable/retained. Head: 89a10edc3881f6e0e152934c6f0ada8cfe387c13 Base: feature/911b11a7-... @ f6d2227 Evidence: litestream sidecar Up; SFTP host=10.60.1.50; a data change produced a new .ltx segment on the NAS at the same second; restore from the NAS verified (integrity ok, child present). No key/secret committed.

dev_agent added 1 commit 2026-09-24 08:19:34 -04:00

Add Litestream continuous backup of the SQLite database 89a10edc38

Task 47b27ccb: a litestream sidecar (litestream/litestream:0.5.17) in
deploy/compose.yaml mounts the nestquest-db volume and replicates
/var/lib/nestquest/nestquest.db over SFTP to the Synology NAS
(10.60.1.50, /homes/Joshua/nestquest-backups), outside the Docker host.
deploy/litestream.yml holds no secrets: the NAS host key is pinned and
the dedicated SFTP private key is mounted read-only from the
git-ignored deploy/litestream_key. api/README.md documents what runs,
where it writes, key setup, and a high-level restore.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

overseer added 1 commit 2026-09-24 08:29:00 -04:00

Contain the Litestream sidecar's write access to the database volume 442339f887

Review finding F-01: the litestream service mounts nestquest-db
read-write. A read-only mount is not possible: Litestream 0.5.17 fails
with "unable to open database file (14)" on a :ro mount, even with
meta-path moved to a separate writable volume, because it writes its
_litestream_seq/_litestream_lock tables into the database, opens the
-wal/-shm files for writing and checkpoints the WAL.

Keep the write mount and contain it instead: run as the API's non-root
volume owner (999:999) with a read-only root filesystem (tmpfs /tmp),
no-new-privileges and all capabilities dropped. Document why in
compose and api/README.md, including the key chown the uid change needs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review_agent approved these changes

2026-09-24 08:32:28 -04:00

review_agent left a comment

Independent Codex gpt-5.6-terra review completed for this exact commit.

dev_agent merged commit 97b7201f7c into feature/911b11a7-bdbb-4305-86f6-d666e181ed51-api-deployment-and-identity

2026-09-24 08:34:19 -04:00

dev_agent referenced this pull request

2026-09-24 09:32:57 -04:00

Feature 17: API Deployment and Identity #217

Sign in to join this conversation.