mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 21:26:44 +00:00
kevinveenbirkenbachandClaude Opus 5.5
fdf1a33c5f
baudolo stops every container on a volume before the authoritative copy
unless its image is listed via --images-no-stop-required. Leaving the
marker out silently picked "stop": the Stalwart webmail start that the
backup cycle triggered got SIGKILLed mid `composer update` (CI run
40625679270), and 71 services that mount a named volume had never
decided either way.
- The marker is now `backup.stop_required` (true = stop first, false =
copy live), replacing the double-negated `no_stop_required`; the 50
existing declarations are inverted unchanged. backup_image takes the
marker and the wanted value explicitly:
lookup('backup_image', 'stop_required', false) still feeds
--images-no-stop-required, lookup('backup_image', 'disabled', true)
the skip list.
- The 71 undecided services carry researched values (repo files plus
upstream backup guidance: GitLab, Jenkins, Elastic, RabbitMQ, Typesense,
Qdrant, OpenLDAP, Prometheus, Moodle, ClamAV, Alertmanager, ...): engine
files, git repositories, SQLite, mnesia and multi-file state stop; image
code, write-once blob stores with metadata in the database and
atomically rewritten files copy live. Stalwart's main service stays
stopped until /var/lib/stalwart is verified to hold only logs.
- Re-obtainable data is no longer backed up at all (`backup: false` on
the volume): model weights, ClamAV signatures, SearXNG config/cache,
transient RabbitMQ queues, Funkwhale's Typesense index, the meta clone,
the agent-broker socket dir, coturn's unused data dir, and volumes no
image reads (Decidim's /app paths outside /code, BookWyrm's /app/data
which v0.9.3 never reads, FusionDirectory's measured-empty dir).
- The backup lookup only matches what actually runs once the role
declares it: Bluesky's broker (`custom: bluesky_broker`) and Decidim
(`custom: true`) declare their custom build, BookWyrm's worker/migrate,
EspoCRM's daemon/websocket, Moodle's cron and OpenProject's proxy use
their owner's image, and the templates drop their render-time
overrides. Decidim deploys decidim_custom:0.31.6 and BookWyrm
bookwyrm_custom:3.11-slim from now on; a BookWyrm ref bump still
rebuilds through the build-args digest.
- test_backup_stop_decision_declared requires the boolean on every
service with its own image that mounts a backed-up named volume;
test_stop_required replaces the old integrity test.
Measured against HEAD: 43 -> 78 services copied live, none moved the
other way; 14 -> 30 volumes skipped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Requirements 📋
This directory contains project requirements documents. Its scope is user stories and acceptance criteria that define what the project must do and that guide agent-assisted implementation.
Archive
- 001 - Nextcloud Talk TURN relay
- 001 - Service Registry Refactoring
- 003 - Reduce
applicationsandusersto lookup-only access - 004 - Generic RBAC role auto-provisioning via OpenLDAP
- 005 - WordPress Multisite support for OIDC-driven RBAC
- 006 - Service-gated Playwright tests
- 007 - WordPress to Discourse post round-trip
- 015 - KIX Service Management integration
- 016 - web-app-hugo (Static Site Generator)
- 012 - Package Cache (Nexus 3 OSS)
- 013 - Sub-Beta-to-Beta Lifecycle Promotion for
web-*Roles - 015: Self-built Moodle image (replaces
bitnamilegacy/moodle) - 015 - OpenCloud and OpenTalk IAM integration
- 021 - SSO Flavor Migration (oauth2 + oidc → unified
ssoservice) - 008 - Role Meta Layout Refactoring
- 009 - Per-Role Networks and Ports Migration
- 010 - Role Meta
run_after/lifecycleMigration - 011 - Role
meta/info.ymlMigration - 016 - Fediwall multi-wall via OIDC-protected runtime upload
- 019 - Playwright meta/services.yml parity coverage
- 020 - CI Run 25705903504 Deploy-Failure Remediation Loop
- 022 - Zammad Helpdesk Role with OIDC SSO
- 023 - Setup Penpot
- 025 - Matrix Role Ansible Flavor (matrix-docker-ansible-deploy)
- 028 - atmo.rsvp (AT Protocol Events) Role + Mobilizon/ActivityPub Bridge
- 031 - svc-net-tor: Tor Onion-Service Provider (injected alongside the clearnet domain)
- 037 - svc-net-wireguard: WireGuard Transport for Swarm Deployments
- 038 - svc-net-wireguard: Full-Mesh WireGuard for Compose Deployments
- 038 - web-svc-api