Files

T

Micha bc9ace315a Backup-Audit-Hardening: Dump-Frische-Monitoring und Scope-Konsistenz

Findings aus dem Backup-/Restore-Audit 2026-06-18 umgesetzt:

- Dump-Frische als Prometheus-Metrik (homelab_borg_dump_present /
  homelab_borg_dump_age_seconds) im Host-Exporter; schliesst den
  Blindfleck, dass Borg weiterlaeuft und stale Dumps archiviert, ohne
  Job-Fehler.
- Neue Alerts HomelabBorgDumpMissing / HomelabBorgDumpStale (critical)
  plus ALERT_RULES.md.
- Freshness-Gate (.sh + .ps1) und H:-Nearline-Pull um n8n.sqlite.dump
  und postgresql17-globals.sql ergaenzt.
- Critical-Container-Watch um mail-archiver, n8n, homeassistant,
  smarthome-mosquitto erweitert.
- BACKUP_SCOPE: /mnt/user/projekte und sonstige User-Shares ausserhalb
  App-Scope als bewusste offene Operator-Entscheidung dokumentiert;
  Hermes-data-Pfad als geparkt klargestellt.
- MASTER_TODO: Nearline-Pull-Ueberwachung, Host-Pull-Nachzug und
  projekte-Scope-Entscheidung aufgenommen.

Enthaelt ausserdem die zuvor vorbereiteten Scope-Erweiterungen
(nextcloud html+data, n8n, filebrowser, influxdb3) und Scope-Drift-/
Retention-/Compact-/Check-Alerts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-18 20:25:54 +02:00

gitea-bundle-mirror.sh

Write Prometheus textfile and Gitea bundles world-readable

2026-05-27 20:41:07 +02:00

pre-backup-dumps.sh

Backup-Audit-Hardening: Dump-Frische-Monitoring und Scope-Konsistenz

2026-06-18 20:25:54 +02:00

pre-borg.sh

Fix Borg preflight freshness dump path

2026-05-25 19:44:22 +02:00

README.md

Fix Gitea bundle mirror host run

2026-05-26 20:16:19 +02:00

USER_SCRIPTS_SETUP.md

Add Unraid flash config to Borg preflight

2026-05-25 19:36:16 +02:00

README.md

Borg dump scripts

These scripts are intended to run on the Unraid host before a Borg backup starts.

Current script

pre-backup-dumps.sh
gitea-bundle-mirror.sh

Output

Fresh dump artifacts are written to:

/mnt/user/backups/borg/dumps/latest

Fresh Gitea repository bundles are written to:

/mnt/user/backups/git-bundles/gitea

Borg UI should include /local/borg-dumps as a backup source. The Gitea bundle target should also be part of the Borg scope, either through the backups share or an explicit Borg source.

The dump set also includes unraid-flash-config.tar.gz, a host-generated archive of /boot/config plus checksum and manifest. Treat this archive as secret backup material.

Notes

The script is written for host execution where docker is available.
gitea-bundle-mirror.sh additionally expects host access to the Gitea bare repositories under /mnt/user/services/gitea/data/git/repositories.
It does not assume Backrest.
It keeps only the latest dump set because Borg itself provides history.

Recommended automation path

The recommended automation path is:

Unraid User Scripts on the host
host-side schedule / cron
Borg UI backup job afterwards

This is preferred over a Borg UI inline hook because the dump script expects:

host access to docker exec
host paths like /mnt/user/...
direct write access to the dump target directory

Do not treat pre-backup-dumps.sh as a Borg UI inline script unless the architecture is deliberately changed later.

See USER_SCRIPTS_SETUP.md for the intended host-side rollout.