admin/Linux_post_install
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: pos system backup -- optional --no-encrypt (BACKUP_ENCRYPT=0)

Browse Source
This commit is contained in:
he
2026-08-14 17:19:17 -04:00
parent 44c08ef4a4
commit 03dd92370c
7 changed files with 64 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DOC/howto/system.md
+10 -2
View File
@@ -78,14 +78,22 @@ sudo rm -f /etc/systemd/system/pos-health.{service,timer} && sudo systemctl daem
## `pos system backup` — encrypted folder snapshots
```bash
pos system backup <folder-path> # encrypt to ./<name>_<date>.tar.gz.gpg
pos system backup --service # pick a folder from /srv + ~/srv
pos system backup <folder-path> # encrypt to ./<name>_<date>.tar.gz.gpg
pos system backup <folder-path> --no-encrypt # plain ./<name>_<date>.tar.gz, no password
pos system backup --service # pick a folder from /srv + ~/srv
```
Uses `sudo tar` + gpg AES-256. The password is prompted **twice and never
stored**; the artifact is `chmod 600`. On success (and on failure, via ERR
trap) a `notify_send` alert is sent.
**Skip encryption** with `--no-encrypt` (or `BACKUP_ENCRYPT=0` in
`system.env`): the archive stays a plain `.tar.gz`, no password is prompted,
and the file is still `chmod 600` + USB-copy verified. This is the
**headless/cron-safe** mode — the encrypted path prompts for a password, so
under cron it needs `--no-encrypt` with a fixed folder
(`pos system backup ~/Documents --no-encrypt`).
`--service` lists folders under the roots in `BACKUP_SERVICE_ROOTS`
(default `/srv $HOME/srv`; override via `system.env` or env) and lets you pick.