cesnimda
49 lines
2.2 KiB
Markdown
49 lines
2.2 KiB
Markdown
# Encrypted Google Drive backups
|
|
|
|
Yes—JobTracker recovery sets can be copied to Google Drive. Use an `rclone crypt` remote so database,
|
|
CV, attachment and key archives are encrypted before they leave the production host.
|
|
|
|
## One-time production setup
|
|
|
|
1. Install `rclone` from the operating system's trusted package source.
|
|
2. Run `rclone config` as the same operating-system user used by deployment.
|
|
3. Create a Google Drive remote, for example `gdrive`.
|
|
4. Complete Google OAuth in your browser. Do not paste its refresh token into Git, chat or CI.
|
|
5. Create a second remote of type `crypt`, for example `gdrive-crypt`, targeting a dedicated folder
|
|
such as `gdrive:JobTrackerBackups`.
|
|
6. Enable filename and directory-name encryption. Store the crypt password and salt in the protected
|
|
production credential store/rclone configuration, not in the repository.
|
|
7. Verify the encrypted remote without uploading private application data:
|
|
|
|
```bash
|
|
printf 'backup connectivity test\n' >/tmp/jobtracker-backup-test.txt
|
|
rclone copy /tmp/jobtracker-backup-test.txt gdrive-crypt:jobtracker-test
|
|
rclone ls gdrive-crypt:jobtracker-test
|
|
rm -f /tmp/jobtracker-backup-test.txt
|
|
rclone purge gdrive-crypt:jobtracker-test
|
|
```
|
|
|
|
8. Add this to `/opt/job-tracker/shared/.env`:
|
|
|
|
```text
|
|
BACKUP_RCLONE_REMOTE=gdrive-crypt:jobtracker
|
|
```
|
|
|
|
9. Run the **Production backup** workflow manually. It must create the local verified recovery set
|
|
first, copy that set to Drive, and fail visibly if the off-host copy fails.
|
|
|
|
## Schedule and retention
|
|
|
|
- Scheduled workflow: 00:00 and 01:00 UTC triggers with a Europe/Oslo guard; one backup runs at local
|
|
02:00 even when daylight-saving time changes.
|
|
- Recovery-point objective: 24 hours.
|
|
- Local retention: 30 days plus 12 monthly recovery sets.
|
|
- Google Drive retention: the upload is immutable. Apply a matching Drive/rclone lifecycle only after
|
|
a scratch restore has proven the off-host copy.
|
|
|
|
## Recovery rule
|
|
|
|
Download into a scratch directory and restore into a separate MariaDB/database-volume environment.
|
|
Never rehearse by restoring over live production. Preserve the newest deletion-tombstone ledger when
|
|
restoring older application data.
|