kevinveenbirkenbachandClaude Fable 5 598b7c3a9a feat(svc-bkp-secrets-2-local): host secret material backup role ...

New svc-bkp-secrets-2-local role: a differential rsync --link-dest snapshot
of the host-generated secret material that lives in no docker volume, NFS
export or operator inventory - infinito secrets + tokens, the self-signed
CA, the Let's Encrypt account/certs, the ACME DNS credentials - plus the
node identity (ssh host keys + machine-id). files/recover.py restores each
present subtree to its fixed system path and gates the node-identity
restore behind --restore-node-identity. Wires the systemd unit + nightly
schedule (06_daemons, 07_schedule). Unit tests cover the domain/target map
and the main() subtree-selection + node-identity gating.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-12 03:15:52 +02:00

..

main.yml

feat(svc-bkp-secrets-2-local): host secret material backup role

2026-07-12 03:15:52 +02:00