edd8687ea6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 4541@bnt-lap001 Assistant-Session: 2099b3aa-d7d9-49a9-ab4e-fa8b7d0e39e8
36 lines
2.1 KiB
Bash
Executable file
36 lines
2.1 KiB
Bash
Executable file
#!/bin/sh
|
|
# Install the MAS evidence backup worker on railiance01 and run the first upload.
|
|
# Run as root from a directory holding exactly the files named in SHA256SUMS.
|
|
# Effects: /opt/railiance-platform/mas-backup/, four systemd units,
|
|
# /etc/mas-backup/age-recipient (public key). Timers are enabled only after
|
|
# the first backup and freshness check pass. Does not scale, roll or restart
|
|
# the MAS facility and never deletes retained objects.
|
|
set -eu
|
|
[ "$(id -u)" -eq 0 ] || { echo '{"status":"failed","code":"root_required"}'; exit 1; }
|
|
sha256sum -c --quiet SHA256SUMS
|
|
[ -f /etc/mas-backup/primary.env ] || { echo '{"status":"failed","code":"primary_env_missing"}'; exit 1; }
|
|
recipient=$(cat age-recipient)
|
|
case "$recipient" in age1*) ;; *) echo '{"status":"failed","code":"age_recipient_required"}'; exit 1;; esac
|
|
|
|
install -d -m 0755 -o root -g root /opt/railiance-platform/mas-backup
|
|
for f in mas_evidence_backup.py mas_evidence_capture.py mas_evidence_archive.py primary_application_archive.py mas_evidence_notify.py; do
|
|
install -m 0644 -o root -g root "$f" /opt/railiance-platform/mas-backup/"$f"
|
|
done
|
|
install -m 0644 -o root -g root age-recipient /etc/mas-backup/age-recipient
|
|
for u in mas-evidence-backup.service mas-evidence-backup.timer mas-evidence-freshness.service mas-evidence-freshness.timer mas-evidence-alert@.service; do
|
|
install -m 0644 -o root -g root "$u" /etc/systemd/system/"$u"
|
|
done
|
|
systemctl daemon-reload
|
|
|
|
systemctl start mas-evidence-backup.service
|
|
systemctl start mas-evidence-freshness.service
|
|
systemctl enable --now mas-evidence-backup.timer mas-evidence-freshness.timer >/dev/null 2>&1
|
|
|
|
python3 - <<'PY'
|
|
import json, pathlib
|
|
latest = json.loads(pathlib.Path("/var/lib/mas-evidence-backup/latest-offsite.json").read_text())
|
|
keep = ("status", "captured_at", "object_key", "version_id", "ciphertext_sha256", "ciphertext_bytes",
|
|
"remote_retrieval_verified", "immutable_create", "retained_objects_deleted", "run", "capture")
|
|
print(json.dumps({k: latest.get(k) for k in keep}, indent=2, sort_keys=True))
|
|
PY
|
|
systemctl list-timers --all --no-pager | grep mas-evidence
|