Claude
2b4f066234
fix: source .env at startup in backup.sh
...
Automatically loads HIY_BACKUP_DIR, HIY_BACKUP_REMOTE, HIY_BACKUP_RETAIN_DAYS
and other vars from .env so the cron job works without extra shell setup.
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
2026-03-27 17:52:29 +00:00
Claude
b7430cbb65
fix: add --transfers 1 --retries 5 to rclone — workaround for Proton Drive parallel upload bug
...
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
2026-03-26 15:44:46 +00:00
Claude
84ac8f3b9f
fix: copy hiy.db out of container before dumping — server image has no sqlite3
...
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
2026-03-26 15:32:26 +00:00
Claude
e8d303f184
feat: extend backup script and add restore script
...
backup.sh now covers all data:
- SQLite via podman exec into server container (fallback to host path)
- Postgres via pg_dumpall inside postgres container
- Forgejo data volume via podman volume export
- Caddy TLS certificates via podman volume export
- .env file (plaintext secrets — store archive securely)
restore.sh reverses each step: imports volumes, restores Postgres,
restores SQLite, optionally restores .env (--force to overwrite).
Both scripts find containers dynamically via compose service labels
so they work regardless of the container name podman-compose assigns.
.env.example documents HIY_BACKUP_DIR, HIY_BACKUP_REMOTE,
HIY_BACKUP_RETAIN_DAYS.
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
2026-03-26 15:06:16 +00:00
Claude
48b9ccf152
feat: M4 Hardening — encryption, resource limits, monitoring, backups
...
## Env var encryption at rest (AES-256-GCM)
- server/src/crypto.rs: new module — encrypt/decrypt with AES-256-GCM
Key = SHA-256(HIY_SECRET_KEY); non-prefixed values pass through
transparently for zero-downtime migration
- Cargo.toml: aes-gcm = "0.10"
- routes/envvars.rs: encrypt on SET; list returns masked values (••••)
- routes/databases.rs: pg_password and DATABASE_URL stored encrypted
- routes/ui.rs: decrypt pg_password when rendering DB card
- builder.rs: decrypt env vars when writing the .env file for containers
- .env.example: add HIY_SECRET_KEY entry
## Per-app resource limits
- apps table: memory_limit (default 512m) + cpu_limit (default 0.5)
added via idempotent ALTER TABLE in db.rs migration
- models.rs: App, CreateApp, UpdateApp gain memory_limit + cpu_limit
- routes/apps.rs: persist limits on create, update via PUT
- builder.rs: pass MEMORY_LIMIT + CPU_LIMIT to build script
- builder/build.sh: use $MEMORY_LIMIT / $CPU_LIMIT in podman run
(replaces hardcoded --cpus="0.5"; --memory now also set)
## Monitoring (opt-in compose profile)
- infra/docker-compose.yml: gatus + netdata under `monitoring` profile
Enable: podman compose --profile monitoring up -d
Gatus on :8080, Netdata on :19999
- infra/gatus.yml: Gatus config checking HIY /api/status every minute
## Backup cron job
- infra/backup.sh: dumps SQLite, copies env files + git repos into a
dated .tar.gz; optional rclone upload; 30-day local retention
Suggested cron: 0 3 * * * /path/to/infra/backup.sh
https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH
2026-03-24 15:06:42 +00:00
