spencermandClaude Opus 5.5
a82e056b6a
Admin: Departments (name and stations; add shows the three groups IT must create), Profiles (welder stamp, station limits, active) with a CSV import that previews and applies only when clean, Checklists (weld and plain), Security (session, lockout and rate-limit settings with bounds, alerts for the last 24 hours, the integrity result), Access log with filters and a guarded CSV, Who is in, Stamp check, Notifications, and the employeeID flags. Every Admin change is audited. Worker: ad-reconcile (nightly and on "refresh from AD now"), session-refresh (15 minutes), integrity (seals, asset hashes, missing and orphan files, the audit chain), backup-check, notify-send and notify-digest. Notifications route per event type to AD groups, users, mailboxes or the department Supervisor group, immediately or in a daily digest, over STARTTLS verified against the PESCO CA, with dry run on the test stack. Backups: scripts/backup/ps-backup.sh and ps-restore.sh with a systemd timer at 02:00 America/Denver. Restore rehearsed on the test stack 2026-10-21. CI: pip-audit and npm audit. pypdf 6.21.1 and certifi 2026.10.19. Migration 0010. Closes the app part of I6, M3, O1, O2 and S3. Co-Authored-By: Claude Opus 5.5 <[email protected]>
26 lines
969 B
Desktop File
26 lines
969 B
Desktop File
# Packet Station nightly database backup (scripts/backup/ps-backup.sh).
|
|
# Installed by root on docker-1: see scripts/backup/README.md. Started by packetstation-backup.timer.
|
|
# Runs as root because it talks to the Docker daemon and writes /var/backups/packetstation.
|
|
[Unit]
|
|
Description=Packet Station database backup (pg_dump of each stack)
|
|
Documentation=file:///home/spencerm/packetstation/repo/scripts/backup/README.md
|
|
Wants=docker.service
|
|
After=docker.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/sbin/ps-backup.sh --config /etc/packetstation/backup.conf
|
|
Environment=KEEP=7
|
|
# Gentle on the host: the dump runs while the shop is closed, but the stacks stay up.
|
|
Nice=10
|
|
IOSchedulingClass=idle
|
|
TimeoutStartSec=1h
|
|
# Hardening. /usr, /boot and /etc are read-only to the script; it writes only the backup folders.
|
|
NoNewPrivileges=yes
|
|
PrivateTmp=yes
|
|
ProtectSystem=full
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictSUIDSGID=yes
|