4 commits

Author	SHA1	Message	Date
Claude	b7430cbb65	fix: add --transfers 1 --retries 5 to rclone — workaround for Proton Drive parallel upload bug ... https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH	2026-03-26 15:44:46 +00:00
Claude	84ac8f3b9f	fix: copy hiy.db out of container before dumping — server image has no sqlite3 ... https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH	2026-03-26 15:32:26 +00:00
Claude	e8d303f184	feat: extend backup script and add restore script ... backup.sh now covers all data: - SQLite via podman exec into server container (fallback to host path) - Postgres via pg_dumpall inside postgres container - Forgejo data volume via podman volume export - Caddy TLS certificates via podman volume export - .env file (plaintext secrets — store archive securely) restore.sh reverses each step: imports volumes, restores Postgres, restores SQLite, optionally restores .env (--force to overwrite). Both scripts find containers dynamically via compose service labels so they work regardless of the container name podman-compose assigns. .env.example documents HIY_BACKUP_DIR, HIY_BACKUP_REMOTE, HIY_BACKUP_RETAIN_DAYS. https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH	2026-03-26 15:06:16 +00:00
Claude	48b9ccf152	feat: M4 Hardening — encryption, resource limits, monitoring, backups ... ## Env var encryption at rest (AES-256-GCM) - server/src/crypto.rs: new module — encrypt/decrypt with AES-256-GCM Key = SHA-256(HIY_SECRET_KEY); non-prefixed values pass through transparently for zero-downtime migration - Cargo.toml: aes-gcm = "0.10" - routes/envvars.rs: encrypt on SET; list returns masked values (••••) - routes/databases.rs: pg_password and DATABASE_URL stored encrypted - routes/ui.rs: decrypt pg_password when rendering DB card - builder.rs: decrypt env vars when writing the .env file for containers - .env.example: add HIY_SECRET_KEY entry ## Per-app resource limits - apps table: memory_limit (default 512m) + cpu_limit (default 0.5) added via idempotent ALTER TABLE in db.rs migration - models.rs: App, CreateApp, UpdateApp gain memory_limit + cpu_limit - routes/apps.rs: persist limits on create, update via PUT - builder.rs: pass MEMORY_LIMIT + CPU_LIMIT to build script - builder/build.sh: use $MEMORY_LIMIT / $CPU_LIMIT in podman run (replaces hardcoded --cpus="0.5"; --memory now also set) ## Monitoring (opt-in compose profile) - infra/docker-compose.yml: gatus + netdata under `monitoring` profile Enable: podman compose --profile monitoring up -d Gatus on :8080, Netdata on :19999 - infra/gatus.yml: Gatus config checking HIY /api/status every minute ## Backup cron job - infra/backup.sh: dumps SQLite, copies env files + git repos into a dated .tar.gz; optional rclone upload; 30-day local retention Suggested cron: 0 3 * * * /path/to/infra/backup.sh https://claude.ai/code/session_01FKCW3FDjNFj6jve4niMFXH	2026-03-24 15:06:42 +00:00