[CryptoJones]

Closes #110
Part of #105

What

• roundtable db backup [--dir DIR] [--keep N] uses SQLite's online backup API, so the copy is consistent while a run holds the store open. It writes backups/roundtable-<host>-<stamp>.db beside the store, 0600 in a 0700 dir, as one rollback-journal file. It runs integrity_check on the copy, deletes a failed copy, and prunes to the newest N (default 14).
• roundtable db restore FILE [--force] refuses a corrupt file (never overridable), a file that is not a store, and a newer schema unless --force. The store it replaces is checkpointed and kept as roundtable.db.pre-restore-<stamp>.
• scripts/backup-telesto.sh is a one-shot job. It runs db backup, then restic to sftp:telesto:/NAS/backups/flatline-roundtable/<host>, with the password in pass flatline-roundtable/restic-telesto. It ships the backups and the gpg-encrypted DB key entry, because a store without its key cannot decrypt its secrets. It keeps 14 daily, 8 weekly and 6 monthly snapshots, and runs restic check on Sundays or with CHECK=1. rsync is documented as the fallback.
• examples/net.thenetwerk.roundtable-backup.plist runs it daily at 03:45. It is a timer starting a one-shot, so no process stays resident.
• .gitignore already excludes *.db, *.db-wal, *.db-shm and backups/ (added in Runs read the store; YAML retired (#109) #124).

Verified

6 new tests in TestBackup: a 0600 integrity-checked copy taken while a WAL reader is open, 15 backups with --keep 14 leaving the newest 14, corrupt and newer-schema refusals, and the replaced store kept aside. 239 tests pass.

First backup and the restore drill on makemake (scratch path, live store untouched):

$ CHECK=1 scripts/backup-telesto.sh
backup .../backups/roundtable-makemake-20261006T095420Z.db (integrity ok, kept 1)
created restic repository 6aef3569aa at sftp:telesto:/NAS/backups/flatline-roundtable/makemake
restic check: no errors were found
$ restic restore latest --target <drill>          # Restored 11 files/dirs (136.434 KiB)
$ roundtable db restore <drill>/.../roundtable-makemake-20261006T095420Z.db --config <drill>/roundtable.db
restored ... (schema 2, key id 5252579b70f9ae54)
$ roundtable db doctor --config <drill>/roundtable.db
mode 0600 | schema 2 | integrity ok | key id 5252579b70f9ae54 — unlocks this store | secrets 9 | lanes 18 live, 11 active
$ roundtable secrets check --config <drill>/roundtable.db      # 9/9 present
$ roundtable --config <drill>/roundtable.db --list             # 11 active lane(s). No calls made.
$ diff <(roundtable db export --config <drill>/roundtable.db) <(roundtable db export)   # identical

The plist is installed and loaded on makemake (launchctl print shows it scheduled for 03:45).

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/

🤖 Generated with Claude Code

https://claude.ai/code/session_01UFaYYNp3Pb6CnndLuW1sj1

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 2da09462-4819-4b4f-9463-36e086a26f98

📥 Commits

Reviewing files that changed from the base of the PR and between 9870994 and 1ea5200.

📒 Files selected for processing (6)

• BACKLOG.md
• README.md
• examples/net.thenetwerk.roundtable-backup.plist
• roundtable
• scripts/backup-telesto.sh
• tests/test_roundtable.py

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}