morphit/ops/backup/backup.env.example

90 lines
4.4 KiB
Text

# ─────────────────────────────────────────────────────────────────────
# Morphit indexer — backup configuration.
#
# The `morphit-ops init` wizard writes this to /etc/morphit/backup.env
# at the values the operator picked during setup. Manual edit is
# fine; the script reads it as a shell snippet on every run.
#
# After editing, no restart needed — the systemd timer reads this
# file at the start of each backup run.
# ─────────────────────────────────────────────────────────────────────
# ─── REQUIRED ────────────────────────────────────────────────────────
# Where to write the backup files. Must be writable by whichever
# user runs the script (the systemd unit defaults to the morphit
# system user).
BACKUP_DIR=/home/morphit/backups
# How many days of backups to keep. Older files are deleted
# during each run. Applies to both local files AND remote
# (rsync's --delete is NOT used — remote retention is the
# operator's responsibility, see REMOTE_DESTINATION).
RETAIN_DAYS=30
# Postgres database name and authenticating user. `morphit-ops init`
# (and `morphit-ops harden`) DERIVE these from your
# MORPHIT_INDEXER_DATABASE_URL, so a non-standard DB (e.g. a BunkerWeb
# box on morphit_user/morphit_db) is filled in correctly. The values
# below are the init.sql defaults — the fallback if the URL can't be
# parsed. Change if your postgres setup differs.
DB_NAME=morphit_indexer
DB_USER=morphit_indexer
# ─── OPTIONAL ────────────────────────────────────────────────────────
# Each of these is unused when unset or when its value looks like
# a placeholder (contains REPLACE/XXXXX/example.com/CHANGE_ME).
# Filling one in turns on the corresponding feature.
# Postgres host + port. Empty (default) uses local Unix-socket
# peer auth; set when Postgres runs on a different host or port.
DB_HOST=
DB_PORT=
# Docker-aware backup: name of the container running Postgres. When
# set, the dump runs THROUGH `docker exec <container> pg_dump …`
# (for a BunkerWeb / docker-compose Postgres — no host pg_dump).
# Empty (default) = host Postgres. `morphit-ops init` and every
# `morphit-ops upgrade` auto-detect + fill this; you rarely set it by
# hand. On this path pg_dump runs inside the container against its
# own local socket, so DB_HOST/DB_PORT are ignored and no password is
# needed (container-local trust/peer auth); the backup user must be
# able to run `docker`.
DB_CONTAINER=
# age public key (https://age-encryption.org) — when set, every
# backup is encrypted with `age -r "$AGE_RECIPIENT"` before being
# written to disk. The matching PRIVATE key MUST live off this
# host (operator's laptop, a separate vault host, or a hardware
# token), or the encryption defends against nothing — an
# attacker who roots this box gets the private key too and
# decrypts at will. See `docs/OPERATIONS.md` §37.12.
#
# Generate a fresh keypair with:
# age-keygen -o /path/to/safe/storage/morphit-backup.key
# The first line of the file is the public key, prefixed `age1`;
# copy that here.
#
# If left unset (or if the value contains a placeholder marker),
# the script writes plaintext .sql.gz files. Audit-log the
# decision; never silently leak by default.
AGE_RECIPIENT=
# rsync-compatible off-host destination (e.g.
# `backups@backup.example.com:/morphit/`). When set, every
# completed backup is pushed off this host immediately after the
# local write. Rsync errors are warned but do not fail the run —
# the local copy is the authoritative source-of-truth.
#
# Use age encryption ABOVE if your remote isn't trusted.
REMOTE_DESTINATION=
# SSH private key for rsync auth, used only when
# REMOTE_DESTINATION is set. Generate with:
# ssh-keygen -t ed25519 -f /etc/morphit/backup-ssh-key -N ""
# and add the matching public key to the remote host's
# ~/.ssh/authorized_keys for the receiving user. The key must
# be readable only by whichever user runs the backup script
# (chmod 600). Leave empty to let SSH use its default
# (~/.ssh/id_*).
SSH_KEY=