Harden backup integrity, implement verified restore and safe upgrades

etc/app-backup/app-backup.conf

@@ -1,122 +1,97 @@
-# app-backup.conf
-# -----------------------------------------------------------------------------
-# Konfiguration für app-backup.sh und app-restore.sh
-# Pfade/Accounts bitte an eure Umgebung anpassen.
-# -----------------------------------------------------------------------------
-
-# === Core paths ===
+# app-backup v2. Trusted Bash configuration, root:root, mode 600.
+# Existing installations retain their file; merge new options from .conf.dist.
 WORKDIR="/var/backups/app-backup"
-STAGING_ROOT="${WORKDIR}/staging"
-ARCHIVE_DIR="${WORKDIR}/archives"
+STAGING_ROOT="$WORKDIR/staging"
+ARCHIVE_DIR="$WORKDIR/archives"
+RESTORE_ROOT="$WORKDIR/restore"
+LOG_DIR="/var/log/app-backup"
+LOCKFILE="/run/app-backup.lock"
+ARCHIVE_PREFIX="appbackup"
 
-# === Retention ===
-LOCAL_RETENTION_DAYS=7
-
-# === Compression ===
-# zstd (schnell + gut) oder gzip (kompatibel)
+# Local staging and archives contain plaintext: use an encrypted server volume.
+MIN_FREE_GB=10
 COMPRESSOR="zstd"
+ZSTD_LEVEL=6
+ZSTD_THREADS=2
+LOG_RETENTION_DAYS=30
+LOCAL_RETENTION_DAYS=7
+REMOTE_RETENTION_DAYS=30
+RETENTION_KEEP_LAST=3
+# Enable deliberately after a successful restore rehearsal. v1 runs are retained.
+ENABLE_REMOTE_RETENTION="false"
 
-# === Remote (rclone) ===
+ENABLE_UPLOAD="true"
 RCLONE_BIN="rclone"
+RCLONE_CONFIG="/root/.config/rclone/rclone.conf"
 RCLONE_REMOTE_BASE="OneDriveCrypt:gemini"
 RCLONE_RETRIES=6
 RCLONE_LOW_LEVEL_RETRIES=20
 RCLONE_RETRIES_SLEEP="30s"
-RCLONE_STATS="1m"
-RCLONE_BWLIMIT="0"                 # "0" = unbegrenzt
-ENABLE_REMOTE_RETENTION="true"
-REMOTE_RETENTION_DAYS=30
-
-# === Safety ===
-MIN_FREE_GB=10
-NICE_LEVEL=10
-IONICE_CLASS=2
-IONICE_LEVEL=6
-
-# === Mail report (lokaler postfix/sendmail) ===
+RCLONE_TIMEOUT="1h"
+RCLONE_CONTIMEOUT="30s"
+RCLONE_TRANSFERS=2
+RCLONE_CHECKERS=4
+# OneDrive chunks must be multiples of 320 KiB; 80 MiB satisfies this.
+RCLONE_ONEDRIVE_CHUNK_SIZE="80Mi"
+RCLONE_BWLIMIT="0"
 ENABLE_MAIL_REPORT="true"
 MAIL_TO="johannes"
-MAIL_FROM="app-backup@$(hostname -f 2>/dev/null || hostname)"
-MAIL_SUBJECT_PREFIX="[app-backup]"
-MAIL_INCLUDE_LOG_TAIL_LINES=200
 
-# -----------------------------------------------------------------------------
-# Was soll gesichert werden?
-# -----------------------------------------------------------------------------
 ENABLE_WORDPRESS="true"
+WP_DIR="/var/www/html"
+# Nextcloud paths below WP_DIR are automatically excluded (including on restore).
+WP_EXCLUDES=()
+
 ENABLE_NEXTCLOUD="true"
 ENABLE_NEXTCLOUD_DATA="true"
 ENABLE_NEXTCLOUD_MAINTENANCE="true"
-ENABLE_DB_DUMPS="true"
-ENABLE_MAIL="true"  # optional
-
-# -----------------------------------------------------------------------------
-# WordPress / Webroot
-# -----------------------------------------------------------------------------
-# In eurem Setup liegt WordPress direkt in /var/www/html
-WP_DIR="/var/www/html"
-
-# Wenn Nextcloud unterhalb von WP_DIR liegt, wird es sonst doppelt gesichert.
-# Modus:
-#  - auto   => exclude "nextcloud/" automatisch, wenn NC_DIR == WP_DIR/nextcloud
-#  - manual => nutzt WP_EXCLUDES Array
-WP_EXCLUDES_MODE="auto"
-#WP_EXCLUDES_MODE="manual"
-#WP_EXCLUDES=("nextcloud/")
-
-# -----------------------------------------------------------------------------
-# Nextcloud
-# -----------------------------------------------------------------------------
 NC_DIR="/var/www/html/nextcloud"
-
-# User für occ-Kommandos (Rocky/Apache meist: apache)
+NC_DATA_DIR="$NC_DIR/data"
 NC_OCC_USER="apache"
 
-# Achtung: Das Dataverzeichnis ist oft NICHT unter /var/www/html/nextcloud/data!
-# Ermitteln mit:
-#   sudo -u apache php /var/www/html/nextcloud/occ config:system:get datadirectory
-NC_DATA_DIR="/var/www/html/nextcloud/data"
+# Native MariaDB-backed Gitea. Enable only after checking app.ini paths.
+ENABLE_GITEA="false"
+ENABLE_GITEA_SERVICE_STOP="true"
+GITEA_SERVICE_NAME="gitea"
+GITEA_DATA_DIR="/var/lib/gitea/data"
+GITEA_ETC_DIR="/etc/gitea"
+# Repository ROOT and custom directory can be OUTSIDE APP_DATA_PATH.
+# GITEA_REPOS_DIR="/var/lib/gitea/repositories"
+# GITEA_CUSTOM_DIR="/var/lib/gitea/custom"
 
-# Optional: nach Restore files:scan ausführen (kann lange dauern)
-NC_FILES_SCAN_AFTER_RESTORE="false"
+# Stop all writers throughout dumps + staging; downtime depends on data size.
+ENABLE_HTTPD_STOP="true"
+HTTPD_SERVICE_NAME="httpd"
+ENABLE_PHPFPM_STOP="true"
+PHPFPM_SERVICE_NAME="php-fpm"
+# Add actual Nextcloud cron timers/services, queue workers, containers, etc.
+# A timer and its currently running service must BOTH be included, timer first.
+QUIESCE_SERVICES=()
 
-# -----------------------------------------------------------------------------
-# Datenbanken (MariaDB/MySQL)
-# -----------------------------------------------------------------------------
-# DB-Namen
+ENABLE_DB_DUMPS="true"
+# Auto-detect mariadb-dump/mariadb; fallback to mysqldump/mysql.
+# DB_DUMP_BIN="mariadb-dump"
+# DB_CLIENT_BIN="mariadb"
 WP_DB_NAME="wordpress"
 NC_DB_NAME="nextcloud"
-
-# Zugangsdaten über my.cnf Dateien (empfohlen, keine Passwörter im Script)
-# Beispiel-Inhalt:
-#   [client]
-#   user=backup
-#   password=SEHR_GEHEIM
-#   host=localhost
+GITEA_DB_NAME="gitea"
 WP_DB_CNF="/etc/app-backup/wp-db.cnf"
 NC_DB_CNF="/etc/app-backup/nc-db.cnf"
+GITEA_DB_CNF="/etc/app-backup/db-gitea.cnf"
+# Restore needs accounts with DDL/DML rights. Use a separate --config FILE for it.
 
-# -----------------------------------------------------------------------------
-# Mail (optional) - nur relevant wenn ENABLE_MAIL=true
-# -----------------------------------------------------------------------------
+ENABLE_MAIL="true"
+MAIL_BACKUP_MODE="stop"
 MAIL_DIR="/var/vmail"
 POSTFIX_DIR="/etc/postfix"
 DOVECOT_DIR="/etc/dovecot"
+ENABLE_MAIL_HOME_DIRS="true"
+MAIL_HOME_DIRS=("/home/johannes" "/home/luciana")
+# Home copies stay on one filesystem; excluded directories are not backed up.
+MAIL_HOME_EXCLUDES=("OneDrive/" ".cache/" ".ccache/" ".local/share/Trash/")
 
-# -----------------------------------------------------------------------------
-# Restore Verhalten
-# -----------------------------------------------------------------------------
-# Wenn true: rsync --delete beim Restore (macht Ziel 1:1 wie im Backup)
+# Additional directories; only files, no automatic DB/container snapshot semantics.
+# Keep ordering stable: entries become extra-0, extra-1, ...
+EXTRA_PATHS=()
+# Restore target directories must already exist. Deletion is off by default.
 RESTORE_STRICT_DELETE="false"
-
-# Restore Default-Schalter (können auch per env überschrieben werden)
-# DRY_RUN="true"
-# RESTORE_FILES="true"
-# RESTORE_DB="true"
-
-# --- Force crypt remote (no fallback) ---
-ENABLE_UPLOAD="true"
-RCLONE_REMOTE_BASE="OneDriveCrypt:gemini"
-
-# Optional: log level
-RCLONE_LOG_LEVEL="INFO"

etc/app-backup/db-gitea.cnf

@@ -1,5 +0,0 @@
-[client]
-user=gitea
-password='p64AH!uK9'
-host=127.0.0.1
-port=3306

etc/app-backup/db-gitea.cnf.example

@@ -0,0 +1,4 @@
+[client]
+user=backup
+password=CHANGE_ME
+host=localhost

etc/app-backup/db-nextcloud.cnf.example

@@ -1,4 +1,4 @@
 [client]
-user=nc_user
+user=backup
 password=CHANGE_ME
 host=localhost

etc/app-backup/db-restore.cnf.example

@@ -0,0 +1,4 @@
+[client]
+user=restore
+password=CHANGE_ME
+host=localhost

etc/app-backup/db-wordpress.cnf.example

@@ -1,4 +1,4 @@
 [client]
-user=wp_user
+user=backup
 password=CHANGE_ME
 host=localhost

etc/app-backup/nc-db.cnf

@@ -1,4 +0,0 @@
-[client]
-user=nc_user
-password='XFYuyM9Ryom2GVfSwu4o'
-host=localhost

etc/app-backup/wp-db.cnf

@@ -1,4 +0,0 @@
-[client]
-user=wordpressuser
-password='p64AH!uK9'
-host=localhost