90 lines
4.4 KiB
Text
90 lines
4.4 KiB
Text
# ─────────────────────────────────────────────────────────────────────
|
|
# Morphit indexer — backup configuration.
|
|
#
|
|
# The `morphit-ops init` wizard writes this to /etc/morphit/backup.env
|
|
# at the values the operator picked during setup. Manual edit is
|
|
# fine; the script reads it as a shell snippet on every run.
|
|
#
|
|
# After editing, no restart needed — the systemd timer reads this
|
|
# file at the start of each backup run.
|
|
# ─────────────────────────────────────────────────────────────────────
|
|
|
|
# ─── REQUIRED ────────────────────────────────────────────────────────
|
|
|
|
# Where to write the backup files. Must be writable by whichever
|
|
# user runs the script (the systemd unit defaults to the morphit
|
|
# system user).
|
|
BACKUP_DIR=/home/morphit/backups
|
|
|
|
# How many days of backups to keep. Older files are deleted
|
|
# during each run. Applies to both local files AND remote
|
|
# (rsync's --delete is NOT used — remote retention is the
|
|
# operator's responsibility, see REMOTE_DESTINATION).
|
|
RETAIN_DAYS=30
|
|
|
|
# Postgres database name and authenticating user. `morphit-ops init`
|
|
# (and `morphit-ops harden`) DERIVE these from your
|
|
# MORPHIT_INDEXER_DATABASE_URL, so a non-standard DB (e.g. a BunkerWeb
|
|
# box on morphit_user/morphit_db) is filled in correctly. The values
|
|
# below are the init.sql defaults — the fallback if the URL can't be
|
|
# parsed. Change if your postgres setup differs.
|
|
DB_NAME=morphit_indexer
|
|
DB_USER=morphit_indexer
|
|
|
|
# ─── OPTIONAL ────────────────────────────────────────────────────────
|
|
# Each of these is unused when unset or when its value looks like
|
|
# a placeholder (contains REPLACE/XXXXX/example.com/CHANGE_ME).
|
|
# Filling one in turns on the corresponding feature.
|
|
|
|
# Postgres host + port. Empty (default) uses local Unix-socket
|
|
# peer auth; set when Postgres runs on a different host or port.
|
|
DB_HOST=
|
|
DB_PORT=
|
|
|
|
# Docker-aware backup: name of the container running Postgres. When
|
|
# set, the dump runs THROUGH `docker exec <container> pg_dump …`
|
|
# (for a BunkerWeb / docker-compose Postgres — no host pg_dump).
|
|
# Empty (default) = host Postgres. `morphit-ops init` and every
|
|
# `morphit-ops upgrade` auto-detect + fill this; you rarely set it by
|
|
# hand. On this path pg_dump runs inside the container against its
|
|
# own local socket, so DB_HOST/DB_PORT are ignored and no password is
|
|
# needed (container-local trust/peer auth); the backup user must be
|
|
# able to run `docker`.
|
|
DB_CONTAINER=
|
|
|
|
# age public key (https://age-encryption.org) — when set, every
|
|
# backup is encrypted with `age -r "$AGE_RECIPIENT"` before being
|
|
# written to disk. The matching PRIVATE key MUST live off this
|
|
# host (operator's laptop, a separate vault host, or a hardware
|
|
# token), or the encryption defends against nothing — an
|
|
# attacker who roots this box gets the private key too and
|
|
# decrypts at will. See `docs/OPERATIONS.md` §37.12.
|
|
#
|
|
# Generate a fresh keypair with:
|
|
# age-keygen -o /path/to/safe/storage/morphit-backup.key
|
|
# The first line of the file is the public key, prefixed `age1`;
|
|
# copy that here.
|
|
#
|
|
# If left unset (or if the value contains a placeholder marker),
|
|
# the script writes plaintext .sql.gz files. Audit-log the
|
|
# decision; never silently leak by default.
|
|
AGE_RECIPIENT=
|
|
|
|
# rsync-compatible off-host destination (e.g.
|
|
# `backups@backup.example.com:/morphit/`). When set, every
|
|
# completed backup is pushed off this host immediately after the
|
|
# local write. Rsync errors are warned but do not fail the run —
|
|
# the local copy is the authoritative source-of-truth.
|
|
#
|
|
# Use age encryption ABOVE if your remote isn't trusted.
|
|
REMOTE_DESTINATION=
|
|
|
|
# SSH private key for rsync auth, used only when
|
|
# REMOTE_DESTINATION is set. Generate with:
|
|
# ssh-keygen -t ed25519 -f /etc/morphit/backup-ssh-key -N ""
|
|
# and add the matching public key to the remote host's
|
|
# ~/.ssh/authorized_keys for the receiving user. The key must
|
|
# be readable only by whichever user runs the backup script
|
|
# (chmod 600). Leave empty to let SSH use its default
|
|
# (~/.ssh/id_*).
|
|
SSH_KEY=
|