chore: re-home the control-plane dump to rig #8

Merged

dan-claude-bot merged 1 commit from chore/rehome-control-plane-dump into main

2026-07-12 19:19:30 +00:00

dan-claude-bot commented

2026-07-12 19:18:49 +00:00

(Migrated from github.com)

Follow-up to heavy-duty/rig#9 (merged), which
added rig coolify backup install. The script now exists in both repos; this removes cast's
copy.

Why it was never cast's

scripts/dump-coolify-db.sh opens with docker exec coolify-db pg_dump …. That only works
on the control-plane box, as root, under a scheduler. cast is the off-box tool — and
cast's own README already says so:

cast runs on your machine: it is an API client, and a server should never install it.

The script contradicted that invariant. It was also entirely unreferenced: nothing in
src/ ever called it, and install.sh only picks it up via a scripts/*.sh glob. It was
payload that survived the rig/cast/infra split without being re-homed.

What replaces it

rig coolify backup install — which does the things cast structurally could not do from off
the box: install age + awscli, drop the script, install a systemd service + timer, and
template an empty 0600 bindings file for the operator to fill.

Two defects were fixed in the move rather than carried across:

It would have uploaded empty artifacts. A failed pg_dump piped into age still
produces a valid, tiny, encrypted file — it uploads cleanly every night and looks exactly
like a working backup. The rig version refuses to upload an empty artifact.
aws-cli >= 2.23 breaks against S3-compatible backends (new default upload checksums
that Hetzner/MinIO/Ceph reject). Debian 13 ships 2.23.6, so this is the default install.
The rig unit defaults both checksum knobs to when_required.

What stays, and why

register-github-app.sh and restore-db.sh are genuinely cast's: both run from your
machine, driving the Coolify API or reaching a box over SSH. The README's Scripts section now
states that boundary explicitly, so the next on-box script doesn't land here by default.

Testing

npm run build ✓ · vitest 69 passed ✓ · biome check clean ✓ — unchanged, since
nothing referenced the removed file.

⚠️ Ordering: rig#9 is merged, but any box still running the old runbook step (copying the
script out of ~/.local/share/cast/scripts/) must move to rig coolify backup install — the
path disappears on the next cast upgrade.

🤖 Generated with Claude Code

Follow-up to [heavy-duty/rig#9](https://github.com/heavy-duty/rig/pull/9) (merged), which added `rig coolify backup install`. The script now exists in both repos; this removes cast's copy. ## Why it was never cast's `scripts/dump-coolify-db.sh` opens with `docker exec coolify-db pg_dump …`. That only works **on the control-plane box**, as root, under a scheduler. cast is the off-box tool — and cast's own README already says so: > cast runs on **your** machine: it is an API client, and a server should never install it. The script contradicted that invariant. It was also **entirely unreferenced**: nothing in `src/` ever called it, and `install.sh` only picks it up via a `scripts/*.sh` glob. It was payload that survived the rig/cast/infra split without being re-homed. ## What replaces it `rig coolify backup install` — which does the things cast structurally *could not* do from off the box: install `age` + `awscli`, drop the script, install a systemd service + timer, and template an empty `0600` bindings file for the operator to fill. Two defects were fixed in the move rather than carried across: - **It would have uploaded empty artifacts.** A failed `pg_dump` piped into `age` still produces a valid, tiny, encrypted file — it uploads cleanly every night and looks exactly like a working backup. The rig version refuses to upload an empty artifact. - **`aws-cli >= 2.23` breaks against S3-compatible backends** (new default upload checksums that Hetzner/MinIO/Ceph reject). Debian 13 ships 2.23.6, so this is the default install. The rig unit defaults both checksum knobs to `when_required`. ## What stays, and why `register-github-app.sh` and `restore-db.sh` are genuinely cast's: both run **from** your machine, driving the Coolify API or reaching a box over SSH. The README's Scripts section now states that boundary explicitly, so the next on-box script doesn't land here by default. ## Testing `npm run build` ✓ · `vitest` **69 passed** ✓ · `biome check` clean ✓ — unchanged, since nothing referenced the removed file. ⚠️ **Ordering:** rig#9 is merged, but any box still running the old runbook step (copying the script out of `~/.local/share/cast/scripts/`) must move to `rig coolify backup install` — the path disappears on the next `cast` upgrade. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/cast#8

No description provided.