railiance-platform/deploy/mas-backup/install.sh

#!/bin/sh
# Install the MAS evidence backup worker on railiance01 and run the first upload.
# Run as root from a directory holding exactly the files named in SHA256SUMS.
# Effects: /opt/railiance-platform/mas-backup/, four systemd units,
# /etc/mas-backup/age-recipient (public key). Timers are enabled only after
# the first backup and freshness check pass. Does not scale, roll or restart
# the MAS facility and never deletes retained objects.
set -eu
[ "$(id -u)" -eq 0 ] || { echo '{"status":"failed","code":"root_required"}'; exit 1; }
sha256sum -c --quiet SHA256SUMS
[ -f /etc/mas-backup/primary.env ] || { echo '{"status":"failed","code":"primary_env_missing"}'; exit 1; }
recipient=$(cat age-recipient)
case "$recipient" in age1*) ;; *) echo '{"status":"failed","code":"age_recipient_required"}'; exit 1;; esac

install -d -m 0755 -o root -g root /opt/railiance-platform/mas-backup
for f in mas_evidence_backup.py mas_evidence_capture.py mas_evidence_archive.py primary_application_archive.py mas_evidence_notify.py; do
  install -m 0644 -o root -g root "$f" /opt/railiance-platform/mas-backup/"$f"
done
install -m 0644 -o root -g root age-recipient /etc/mas-backup/age-recipient
for u in mas-evidence-backup.service mas-evidence-backup.timer mas-evidence-freshness.service mas-evidence-freshness.timer mas-evidence-alert@.service; do
  install -m 0644 -o root -g root "$u" /etc/systemd/system/"$u"
done
systemctl daemon-reload

systemctl start mas-evidence-backup.service
systemctl start mas-evidence-freshness.service
systemctl enable --now mas-evidence-backup.timer mas-evidence-freshness.timer >/dev/null 2>&1

python3 - <<'PY'
import json, pathlib
latest = json.loads(pathlib.Path("/var/lib/mas-evidence-backup/latest-offsite.json").read_text())
keep = ("status", "captured_at", "object_key", "version_id", "ciphertext_sha256", "ciphertext_bytes",
        "remote_retrieval_verified", "immutable_create", "retained_objects_deleted", "run", "capture")
print(json.dumps({k: latest.get(k) for k in keep}, indent=2, sort_keys=True))
PY
systemctl list-timers --all --no-pager | grep mas-evidence