forked from heavy-duty/rig
claude-hdb
c3f812ddaf
Both found by the first run on a real control-plane box — neither was reachable by the argument-parsing tests. $EDITOR is unset on a freshly-bootstrapped server, which is precisely rig's target environment. The printed next-step `$EDITOR /etc/coolify-dump.env` expanded to nothing, so bash tried to EXECUTE the 0600 bindings file and said "Permission denied" — an error that reads like a filesystem problem and is not one. Print `nano`. A bare bucket name in S3_BUCKET reads to `aws` as a LOCAL path, so the upload died with "Invalid argument type" and a usage dump — after pg_dump had run and age had encrypted 14MB, with nothing in the error pointing at the actual mistake. The script now validates the bindings up front: S3_BUCKET must be an s3:// URI, S3_ENDPOINT must carry a scheme. Both fail with the value quoted and the reason stated, before a database is read. Note what still cannot be validated, and now says so in the script: age's X25519 header does not reveal its recipient, so a valid-but-WRONG key (staging's instead of prod's) yields a flawless backup nobody can open. Only decrypting an artifact proves the recipient. The printed next-steps now walk through that read-back explicitly, from a machine holding the private key — never the box. The dump script ships as an embedded heredoc, so a typo in it would first surface at 04:00 on a live control plane. test/cli.sh now extracts it and asserts it is valid bash and that both new guards fire. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| bootstrap.sh | ||
| coolify-backup-install.sh | ||
| coolify-install.sh | ||
| runner-install.sh | ||