spencerm/PacketStation
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 9: Admin completion, reconcile, notifications, integrity, backups
ci / frontend (pull_request) Successful in 1m11s
Details
ci / server (pull_request) Successful in 12m2s
Details
ci / image (pull_request) Skipped
Details
ci / e2e (pull_request) Successful in 6m1s
Details

Browse Source 
Admin: Departments (name and stations; add shows the three groups IT must
create), Profiles (welder stamp, station limits, active) with a CSV import
that previews and applies only when clean, Checklists (weld and plain),
Security (session, lockout and rate-limit settings with bounds, alerts for
the last 24 hours, the integrity result), Access log with filters and a
guarded CSV, Who is in, Stamp check, Notifications, and the employeeID
flags. Every Admin change is audited.

Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh
(15 minutes), integrity (seals, asset hashes, missing and orphan files, the
audit chain), backup-check, notify-send and notify-digest. Notifications
route per event type to AD groups, users, mailboxes or the department
Supervisor group, immediately or in a daily digest, over STARTTLS verified
against the PESCO CA, with dry run on the test stack.

Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer
at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21.
CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19.

Migration 0010. Closes the app part of I6, M3, O1, O2 and S3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
spencerm
2026-10-21 18:27:09 -06:00
co-authored by Claude Opus 5.5
parent ce28d2f3c6
commit a82e056b6a
116 changed files with 15125 additions and 297 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/backup/packetstation-backup.service
+25
View File
@@ -0,0 +1,25 @@
# Packet Station nightly database backup (scripts/backup/ps-backup.sh).
# Installed by root on docker-1: see scripts/backup/README.md. Started by packetstation-backup.timer.
# Runs as root because it talks to the Docker daemon and writes /var/backups/packetstation.
[Unit]
Description=Packet Station database backup (pg_dump of each stack)
Documentation=file:///home/spencerm/packetstation/repo/scripts/backup/README.md
Wants=docker.service
After=docker.service
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/ps-backup.sh --config /etc/packetstation/backup.conf
Environment=KEEP=7
# Gentle on the host: the dump runs while the shop is closed, but the stacks stay up.
Nice=10
IOSchedulingClass=idle
TimeoutStartSec=1h
# Hardening. /usr, /boot and /etc are read-only to the script; it writes only the backup folders.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=full
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes