diff options
| -rw-r--r-- | prompts/skills/f3s-storage/SKILL.md | 2 | ||||
| -rw-r--r-- | prompts/skills/f3s-storage/references/backups.md | 35 | ||||
| -rw-r--r-- | prompts/skills/f3s-storage/references/usb-keys.md | 7 |
3 files changed, 43 insertions, 1 deletions
diff --git a/prompts/skills/f3s-storage/SKILL.md b/prompts/skills/f3s-storage/SKILL.md index 865c2e3..9c49968 100644 --- a/prompts/skills/f3s-storage/SKILL.md +++ b/prompts/skills/f3s-storage/SKILL.md @@ -26,7 +26,7 @@ Note: original plan was HAST, replaced by **zrepl** (ZFS send/receive) — more - [NFS over stunnel](references/nfs.md) — NFS server, mutual-TLS stunnel, Rocky client config, `/etc/fstab` - [nfs-mount-monitor](references/nfs-mount-monitor.md) — systemd watchdog on r-nodes (mount/stat/write probes, fail counter, cordon-and-reboot escalation) - [Troubleshooting](references/troubleshooting.md) — NFS issues, ZFS pool SUSPENDED recovery, **thermal** troubleshooting (Beelink S12 Pro) -- [Backups & Local-Path](references/backups.md) — S3 Glacier Deep Archive, when to use `local-path` instead of NFS +- [Backups & Local-Path](references/backups.md) — S3 Glacier Deep Archive, AWS CLI setup on a FreeBSD host (pkg + `/root/.aws` symlink to `/opt/snonux/secrets/aws.credentials`), when to use `local-path` instead of NFS ## Storage Summary diff --git a/prompts/skills/f3s-storage/references/backups.md b/prompts/skills/f3s-storage/references/backups.md index 99fd425..2181ebc 100644 --- a/prompts/skills/f3s-storage/references/backups.md +++ b/prompts/skills/f3s-storage/references/backups.md @@ -4,6 +4,41 @@ Encrypted incremental ZFS snapshots from `zdata` pool backed up daily to **AWS S3 Glacier Deep Archive** via cron. Scripts adapted from FreeBSD Home NAS setup. Also performs periodic zpool scrubbing. +The **`zusb` quarterly backup** (`/opt/snonux/bin/backup/backup`, which travels on the `zusb` pool — see [USB Key Mounting](usb-keys.md) → "Removable backup pool (`zusb`)") also uploads to the same S3 Glacier Deep Archive bucket (`s3://org-buetow-backup/<host>/`). Both workflows need the AWS CLI on the host that runs them. + +### AWS CLI setup on a FreeBSD host + +Install the `awscli` package. The Python flavor depends on the FreeBSD version: + +```sh +# FreeBSD 14.x (e.g. t450) +# py39-awscli-1.29.81 +# FreeBSD 15.x (e.g. f1, f-hosts) +# py312-awscli-1.42.44 +sudo pkg install -y py312-awscli # adjust py3XX to what pkg search -q awscli shows +``` + +Wire `/root/.aws` (the backup script runs `aws` as root). The **credentials ride on the `zusb` pool** at `/opt/snonux/secrets/aws.credentials` (INI: `[default]` + `aws_access_key_id` + `aws_secret_access_key`), so on any host that has `zusb` imported (i.e. `/opt` mounted) you only need the config file and a symlink — the secret is not duplicated on host disks and is not in git: + +```sh +sudo mkdir -p /root/.aws && sudo chmod 700 /root/.aws +printf '[default]\nregion = eu-central-1\n' | sudo tee /root/.aws/config >/dev/null +sudo chmod 600 /root/.aws/config +sudo ln -sf /opt/snonux/secrets/aws.credentials /root/.aws/credentials +``` + +Because the credentials are a symlink into `/opt` (`zusb/data/opt`), `aws` only resolves them while `zusb` is imported on that host. That is fine for the quarterly backup workflow (load `zusb` → run backup → export `zusb`); it is **not** suitable for the `zdata` daily-cron S3 backup on an f-host that does not normally have `zusb` imported — that host would need its own credentials copy (out of scope here). + +Verify (read-only): + +```sh +aws --version +aws sts get-caller-identity # expect Arn arn:aws:iam::634617747016:user/org-buetow-backup-user +aws s3 ls s3://org-buetow-backup/ # expect the per-host prefixes (e.g. t450/) +``` + +Installed 2026-07-20 on f1 (`py312-awscli-1.42.44`), matching the t450 setup (`py39-awscli-1.29.81`, same `/root/.aws/config` region and the same credentials symlink). + ## Local-Path Storage for SQLite Workloads Some k3s workloads use `local-path` (k3s default storageClass) instead of NFS for diff --git a/prompts/skills/f3s-storage/references/usb-keys.md b/prompts/skills/f3s-storage/references/usb-keys.md index 07b7414..9c40333 100644 --- a/prompts/skills/f3s-storage/references/usb-keys.md +++ b/prompts/skills/f3s-storage/references/usb-keys.md @@ -141,3 +141,10 @@ that old passphrase key is now obsolete for `zusb`. Scripts and deployment docs live in the conf repo at `f3s/freebsd-hosts/zusb/` (`zusb-load`, `zusb-unload`, `README.md`). The raw key itself is **not** in git — it is copied stick-to-stick like the other keys. + +The backup workflow itself is driven by `/opt/snonux/bin/backup/backup` (which +travels on the pool under `zusb/data/opt`); its S3 sync leg needs the AWS CLI +installed on the hosting f-host — see [Backups & Local-Path](backups.md) → +"AWS CLI setup on a FreeBSD host". The S3 credentials also ride on the pool at +`/opt/snonux/secrets/aws.credentials` and are wired in via a +`/root/.aws/credentials` symlink, so no secret material lives on host disks. |