blob: a076f8f5633d1f0de1d27e8eecb1331be45dec5a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
# sanctum / labunix rebuild toolkit
A modular, idempotent, Unix-style rebuild toolkit designed to reduce recovery time from weeks to hours.
## Design goals
- Separate **install**, **restore**, and **verify**.
- Keep base connectivity stable before touching overlay networking.
- Make secrets and identities opt-in.
- Never abort the whole run because one restore item failed.
- Back up before overwrite and write a machine-readable report.
- Work on both **VM** and **real hardware**.
## Files
- `lib/common.sh` — shared helpers
- `install-base.sh` — installs packages and base structure only
- `restore-configs.sh` — restores configs from `capture-full.sh` database
- `doctor.sh` — read-only health and readiness checks
## Defaults
- Safe by default
- No automatic identity transplant
- No blind `/etc/network` overwrite unless explicitly requested
- No immutable `/etc/resolv.conf`
- No automatic WireGuard activation unless explicitly requested
## Roles
- `lab` — VM / test clone, least invasive
- `hardware` — real machine, still conservative
- `replacement` — real disaster-recovery target, identities allowed when requested
## Recommended recovery order
### 1. Base install
```bash
sudo ./install-base.sh --role replacement --profile core --start-safe-services
```
### 2. Restore essentials first
```bash
sudo ./restore-configs.sh \
--role replacement \
--category system-basics \
--category users \
--category ssh \
--category apt-sources \
--start-services
```
### 3. Restore network/DNS/firewall carefully
```bash
sudo ./restore-configs.sh \
--role replacement \
--category network-base \
--category dns \
--category firewall \
--network-mode source \
--dns-mode chain \
--start-services
```
### 4. Restore services
```bash
sudo ./restore-configs.sh \
--role replacement \
--category nginx \
--category mariadb \
--category postfix \
--category prosody \
--category docker \
--restore-secrets \
--start-services
```
### 5. Restore identities last
```bash
sudo ./restore-configs.sh \
--role replacement \
--category privacy \
--category tls \
--category identities \
--restore-secrets \
--restore-identities \
--start-services
```
### 6. Verify
```bash
sudo ./doctor.sh --role replacement --strict
```
## Reports and state
Each run writes:
- `/var/log/labunix-rebuild/report-<RUN_ID>.tsv`
- `/var/log/labunix-rebuild/doctor-<RUN_ID>.txt`
- `/var/lib/labunix-rebuild/state-<RUN_ID>.env`
- `/var/lib/labunix-rebuild/backups/<RUN_ID>/...`
## Notes
- `install-base.sh` does **not** restore your server identity.
- `restore-configs.sh` is intentionally interactive unless `--yes` is used.
- `doctor.sh` is read-only.
- For network restore, use local console access when possible.
## Latest patch notes
- v0.1.1 fixes early exit in `load_optional_config()` under `set -e`
- `install-base.sh` now has a bootstrap DNS fallback for broken `systemd-resolved` stub setups
- initial `apt-get update` is now validated and fails loudly instead of being reported as success
- locale handling no longer requires locale tools before base packages install them
|
