Phase 0.5: Aegis appdata + /boot/config backup to luna-pbs #61

Merged

claude-bot merged 7 commits from worktree-phase-0.5-appdata-pbs-backup into main 2026-09-02 21:48:43 +00:00

Conversation 0 Commits 7 Files changed 11 +1170

claude-bot commented 2026-08-28 23:54:52 +00:00

Collaborator

Copy link

Adds ccnet-unraid-appdata-pbs-backup/ — a Docker-packaged proxmox-backup-client for Unraid Aegis, closing the appdata/boot-config backup gap left when ccnet-borg-backup was retired (2026-08-16). Prerequisite for the *arr media stack (issue #59).

What's here

• Dockerfile — debian:trixie-slim + Proxmox pbs-client apt repo (same keyring/suite as ccnet-pbs-backup-swarm-data/pbs-backup.yml), pinned proxmox-backup-client version, built on Aegis.
• backup.sh — one proxmox-backup-client backup per run:
  • primary → appdata.pxar + bootconfig.pxar, --backup-id aegis, --exclude /pbs-backup (keeps the reused PVE encryption key out of a snapshot it encrypts)
  • cold → appdata-cold.pxar, separate --backup-id aegis-appdata-cold so no backup group has a varying archive set
• pbs-browse.sh — read-only list/files/mount/restore helper (entrypoint override).
• user-scripts/ — two User Scripts cron payloads (daily 03:30 primary, Sunday 02:45 cold), notify-on-failure.
• keys/ — only .example templates tracked; real key + token-secret are hand-placed in /boot/config/pbs-backup/ on Aegis and gitignored.
• CLAUDE.md — new Map entry.

Reuses the existing PVE encryption key and inherits prune/GC/verify/offsite-sync from the copper parent namespace on luna-pbs — nothing new to create server-side beyond the namespace + token + ACL.

Not done in this PR (user-gated — credentials must not pass through an automated session)

• luna-pbs: create namespace copper/aegis-appdata, generate token coppercore@pbs!aegis-appdata-backup, grant both DatastoreBackup + DatastoreAudit
• Aegis: place encryption-key.json + token-secret, first docker build (pin the version), install the User Scripts, configure CA Appdata Backup
• Restore drill (README "Verification") must pass before Phase 1 deploys the *arr containers

🤖 Generated with Claude Code

Adds `ccnet-unraid-appdata-pbs-backup/` — a Docker-packaged `proxmox-backup-client` for Unraid `Aegis`, closing the appdata/boot-config backup gap left when `ccnet-borg-backup` was retired (2026-08-16). Prerequisite for the `*arr` media stack (issue #59). ## What's here - **`Dockerfile`** — `debian:trixie-slim` + Proxmox `pbs-client` apt repo (same keyring/suite as `ccnet-pbs-backup-swarm-data/pbs-backup.yml`), pinned `proxmox-backup-client` version, built on Aegis. - **`backup.sh`** — one `proxmox-backup-client backup` per run: - `primary` → `appdata.pxar` + `bootconfig.pxar`, `--backup-id aegis`, `--exclude /pbs-backup` (keeps the reused PVE encryption key out of a snapshot it encrypts) - `cold` → `appdata-cold.pxar`, separate `--backup-id aegis-appdata-cold` so no backup group has a varying archive set - **`pbs-browse.sh`** — read-only `list`/`files`/`mount`/`restore` helper (entrypoint override). - **`user-scripts/`** — two User Scripts cron payloads (daily 03:30 primary, Sunday 02:45 cold), notify-on-failure. - **`keys/`** — only `.example` templates tracked; real key + token-secret are hand-placed in `/boot/config/pbs-backup/` on Aegis and gitignored. - **`CLAUDE.md`** — new Map entry. Reuses the existing PVE encryption key and inherits prune/GC/verify/offsite-sync from the `copper` parent namespace on luna-pbs — nothing new to create server-side beyond the namespace + token + ACL. ## Not done in this PR (user-gated — credentials must not pass through an automated session) - luna-pbs: create namespace `copper/aegis-appdata`, generate token `coppercore@pbs!aegis-appdata-backup`, grant both `DatastoreBackup` + `DatastoreAudit` - Aegis: place `encryption-key.json` + `token-secret`, first `docker build` (pin the version), install the User Scripts, configure CA Appdata Backup - **Restore drill** (README "Verification") must pass before Phase 1 deploys the `*arr` containers 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-08-28 23:54:52 +00:00

Add ccnet-unraid-appdata-pbs-backup (Phase 0.5 of the arr-stack build) ... 4438a5ae66

Docker-packaged proxmox-backup-client for Unraid Aegis, mirroring the
ccnet-pbs-backup-swarm-data pattern (Unraid is Slackware — no apt, so the
systemd-unit playbook becomes an image + User Scripts cron).

- daily primary run: appdata.pxar + bootconfig.pxar, --backup-id aegis,
  crash-consistent, --exclude /pbs-backup so the reused PVE encryption key
  never lands inside a snapshot it encrypts
- weekly cold run: appdata-cold.pxar, separate --backup-id aegis-appdata-cold
  (stable per-group archive set), picks up the CA Appdata Backup archive
- pbs-browse.sh restore helper (entrypoint override)
- keys/ holds only .example templates; real key + token-secret placed by hand
  in /boot/config/pbs-backup/ on Aegis, gitignored
- inherits prune/GC/verify/offsite-sync from the copper parent namespace

luna-pbs token/ACL, key placement, first build, and the restore drill are
user-gated and must pass before Phase 1 deploys the arr containers. Issue #59.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011TWtb2UUxCSEPyB625f4xM

claude-bot added 1 commit 2026-08-29 15:02:12 +00:00

pbs-appdata-backup: record 4.2.5-1 pin + first-run/drill results ... c4c8ebc62f

- Current pin: proxmox-backup-client 4.2.5-1 (built on Aegis 2026-08-29,
  trixie candidate matched the PBS server exactly)
- First primary backup + full restore drill passed (appdata.pxar restore,
  lidarr.db integrity_check ok, network.cfg byte-identical, pbs-backup/ excluded)
- Clarify the keyfile MUST be named encryption-key.json, and token-secret is
  the bare value not the generate-token JSON blob (both were hit in practice)
- User Scripts folders + schedule.json custom entries pre-staged; documented
  the one required GUI "Apply" (Unraid regenerates cron, hand edits don't stick)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011TWtb2UUxCSEPyB625f4xM

claude-bot added 1 commit 2026-08-29 19:22:14 +00:00

pbs-appdata-backup: cold layer already scheduled; clarify it's the CA plugin ... 65609e863a

- User Scripts applied 2026-08-29, cron live
- CA Appdata Backup was already on 0 2 * * 0 (earlier "disabled" recon was stale)
- Only remaining change: flashBackup yes -> No
- par2cron .par2cron-ignore-all marker placed in the cold dir
- README: "cold layer" is not a setting, it IS the CA plugin

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011TWtb2UUxCSEPyB625f4xM

claude-bot added 1 commit 2026-08-29 19:23:55 +00:00

pbs-appdata-backup: flashBackup set to no — Phase 0.5 config complete ... 7887205adf

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011TWtb2UUxCSEPyB625f4xM

copper added 1 commit 2026-09-02 21:28:47 +00:00

Merge branch 'main' into worktree-phase-0.5-appdata-pbs-backup cd3e0da1f3

claude-bot added 2 commits 2026-09-02 21:48:24 +00:00

docs: add arr-media-stack.md — canonical build plan (Phase 0/0.5 done, 1–3 on hold) ... 58cf346d24

Ports the personal session plan into the repo as the source-of-truth build
plan for the *arr media automation stack on Unraid Aegis. Phase 0 (storage
prep) and Phase 0.5 (this dir's appdata->PBS backup) are done and verified;
Phase 1-3 are planned, parked as of 2026-09-02 with Phase 1 the resume point.

CLAUDE.md: new Docs entry + cross-ref from the map entry.
README: one-line pointer to the plan.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011TWtb2UUxCSEPyB625f4xM

Merge remote-tracking branch 'origin/worktree-phase-0.5-appdata-pbs-backup' into worktree-phase-0.5-appdata-pbs-backup 9ec11fbed5

claude-bot merged commit 9b19b11c20 into main 2026-09-02 21:48:43 +00:00

claude-bot referenced this pull request from a commit 2026-09-02 21:48:43 +00:00

Merge pull request 'Phase 0.5: Aegis appdata + /boot/config backup to luna-pbs' (#61) from worktree-phase-0.5-appdata-pbs-backup into main

claude-bot referenced this pull request 2026-09-02 21:48:56 +00:00

Stand up Unraid (Aegis) appdata backup coverage + evaluate moving PBS back onto Unraid as a container #59

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

blocked

Waiting on something external before it can proceed

  

borg-backup

ccnet-borg-backup

  

ceph

Ceph pool/CephFS/mon work not tied to one stack

  

forgejo

ccnet-forgejo-swarm

  

in-progress

Actively being worked on right now

  

infra

OPNsense, Caddy, DNS, and other cross-cutting infra

  

netdata

ccnet-netdata-monitoring

  

nextcloud

ccnet-nextcloud-swarm

  

p:high

Should be picked up soon

  

p:low

No urgency, quality-of-life or deferred

  

p:medium

Worth doing, no fixed timeline

  

searxng

ccnet-searxng-swarm

  

service-onboard

ccnet-service_onboard

  

swarm-nodes

ccnet-swarm-nodes-runbook

No labels

blocked

borg-backup

ceph

forgejo

in-progress

infra

netdata

nextcloud

p:high

p:low

p:medium

searxng

service-onboard

swarm-nodes

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

copper/ccnet-prod-devops!61

No description provided.