Files

T

Micha ad9bb40b95 Harden posture/borg audit scripts (robustness + coverage)

Working-tree improvements to the audit scripts (authored locally, not by me;
reviewed for correctness + bash -n clean before commit):

- compose-runtime-drift: prefer `docker compose config` for the expected image
  with a raw-parse fallback; raw parser now resolves YAML anchors (*alias) so
  anchor-based composes (e.g. dawarich) no longer mis-report drift.
- komodo-stack-hygiene: treat an unreachable Komodo API as critical and exit 3
  so the Healthchecks EXIT trap sends /fail (the monitor itself is down, not
  "all green"); git fetch before hash-drift compare; clearer "cannot compare"
  message; pin in-container km host to localhost:9120.
- cert-token-check: expand monitored cert domains to the full set incl.
  hc.kaleschke.info.
- gitea-bundle-mirror: skip empty repos without refs instead of failing.
- unraid-user-scripts.md: document SEND_NTFY/NTFY_TOPIC for the daily report.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-24 11:35:55 +02:00

gitea-bundle-mirror.sh

Harden posture/borg audit scripts (robustness + coverage)

2026-06-24 11:35:55 +02:00

pre-backup-dumps.sh

Backup-Audit-Hardening: Dump-Frische-Monitoring und Scope-Konsistenz

2026-06-18 20:25:54 +02:00

pre-borg.sh

monitoring + backup: Stale-Handle-Hardening und Dead-Man's-Switch

2026-06-21 17:54:53 +02:00

README.md

Fix Gitea bundle mirror host run

2026-05-26 20:16:19 +02:00

USER_SCRIPTS_SETUP.md

Add Unraid flash config to Borg preflight

2026-05-25 19:36:16 +02:00

README.md

Borg dump scripts

These scripts are intended to run on the Unraid host before a Borg backup starts.

Current script

pre-backup-dumps.sh
gitea-bundle-mirror.sh

Output

Fresh dump artifacts are written to:

/mnt/user/backups/borg/dumps/latest

Fresh Gitea repository bundles are written to:

/mnt/user/backups/git-bundles/gitea

Borg UI should include /local/borg-dumps as a backup source. The Gitea bundle target should also be part of the Borg scope, either through the backups share or an explicit Borg source.

The dump set also includes unraid-flash-config.tar.gz, a host-generated archive of /boot/config plus checksum and manifest. Treat this archive as secret backup material.

Notes

The script is written for host execution where docker is available.
gitea-bundle-mirror.sh additionally expects host access to the Gitea bare repositories under /mnt/user/services/gitea/data/git/repositories.
It does not assume Backrest.
It keeps only the latest dump set because Borg itself provides history.

Recommended automation path

The recommended automation path is:

Unraid User Scripts on the host
host-side schedule / cron
Borg UI backup job afterwards

This is preferred over a Borg UI inline hook because the dump script expects:

host access to docker exec
host paths like /mnt/user/...
direct write access to the dump target directory

Do not treat pre-backup-dumps.sh as a Borg UI inline script unless the architecture is deliberately changed later.

See USER_SCRIPTS_SETUP.md for the intended host-side rollout.