mirror of
https://github.com/myronblair/jarvis
synced 2026-07-28 08:43:00 -05:00
Claude
80588efa7a
Removed live secret literals from git-tracked code (all were on GitHub): - deploy/reactor.py: Claude/Groq API keys, DB pass, Gmail/iCloud app passwords now from os.environ (loaded via systemd EnvironmentFile=/etc/jarvis-arc/reactor.env, root:www-data 0640) - public_html/login.php: used a private hardcoded PDO connection; now uses config.php DB_* constants - deploy/jarvis-backup.sh (runs via cron), jarvis-deploy.sh, jarvis-watchdog.sh: DB pass now sourced from /etc/jarvis/db.env (root:root 0600) - removed dead agent/jarvis-arc-reactor.py (unreferenced old duplicate leaking an old Groq key + stale Ollama IP) - added deploy/reactor.env.example and deploy/db.env.example templates Verified live: reactor restarted with all 21 handlers + DB poller (job round-trip OK), login works, mysqldump auth via env OK. NOTE: these keys remain in GitHub history and should be rotated (Claude/Groq/Gmail/iCloud/DB). Separate decision needed on INFRASTRUCTURE-REFERENCE.md (full cred doc still tracked) + history purge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
43 lines
1.9 KiB
Bash
Executable File
43 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
[ -r /etc/jarvis/db.env ] && . /etc/jarvis/db.env
|
|
# JARVIS backup — DB dump + all files needed to actually restore JARVIS, as tar.gz
|
|
# Fixed 2026-07-07: this only ever backed up the MySQL database. If this VM were
|
|
# lost, the DB alone is useless without the application code, the reactor daemon,
|
|
# its systemd unit, and the nginx site config — none of which were captured. Also
|
|
# fixed a typo ($SIYE -> $SIZE) that silently broke the size line in the log.
|
|
BACKUP_DIR="/var/backups/jarvis"
|
|
LOG="$BACKUP_DIR/backup.log"
|
|
LOCK="$BACKUP_DIR/backup.lock"
|
|
DB_NAME="jarvis_db"
|
|
DB_USER="jarvis_user"
|
|
DB_PASS="${JARVIS_DB_PASS:?DB pass unset - see /etc/jarvis/db.env}"
|
|
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
|
|
OUTFILE="$BACKUP_DIR/jarvis_backup_${TIMESTAMP}.tar.gz"
|
|
TMPDIR=$(mktemp -d)
|
|
|
|
mkdir -p "$BACKUP_DIR"
|
|
touch "$LOCK"
|
|
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Starting backup..." >> "$LOG"
|
|
|
|
cleanup() { rm -rf "$TMPDIR"; rm -f "$LOCK"; }
|
|
trap cleanup EXIT
|
|
|
|
if mysqldump -u"$DB_USER" -p"$DB_PASS" "$DB_NAME" > "$TMPDIR/jarvis_db.sql" 2>>"$LOG"; then
|
|
mkdir -p "$TMPDIR/files/etc"
|
|
cp -a /var/www/jarvis "$TMPDIR/files/var-www-jarvis"
|
|
cp -a /opt/jarvis-arc "$TMPDIR/files/opt-jarvis-arc"
|
|
cp -a /etc/nginx/sites-enabled/jarvis "$TMPDIR/files/etc/nginx-site-jarvis" 2>>"$LOG"
|
|
cp -a /etc/systemd/system/jarvis-arc.service "$TMPDIR/files/etc/jarvis-arc.service" 2>>"$LOG"
|
|
crontab -l > "$TMPDIR/files/etc/root-crontab.txt" 2>>"$LOG"
|
|
|
|
tar -czf "$OUTFILE" -C "$TMPDIR" jarvis_db.sql files
|
|
SIZE=$(du -sh "$OUTFILE" | cut -f1)
|
|
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Backup OK: $(basename "$OUTFILE") ($SIZE)" >> "$LOG"
|
|
else
|
|
echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: mysqldump failed" >> "$LOG"
|
|
exit 1
|
|
fi
|
|
|
|
find "$BACKUP_DIR" -name "jarvis_backup_*.tar.gz" -mtime +7 -delete
|
|
COUNT=$(ls "$BACKUP_DIR"/jarvis_backup_*.tar.gz 2>/dev/null | wc -l)
|
|
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Done. Files retained: $COUNT" >> "$LOG" |