Back up and restore the whole instance, or just your own data #8

Merged

brian merged 1 commit from backup-and-restore into master

2026-08-26 16:31:42 +00:00

brian commented

2026-08-26 16:31:28 +00:00

Owner

The app has been carrying real medication history for a while with no way to
get it out, so this adds backups at the two levels that matter.

Admins get a full system archive: a consistent database snapshot plus every
pill photo, downloadable or pushed to a configurable Nextcloud over WebDAV,
optionally on a nightly schedule with retention. The snapshot goes through
SQLite's online-backup API rather than a file copy — the app runs in WAL mode
while serving requests, so a copied .db alone can be stale or torn. Restoring
swaps the database in with an atomic rename, holds the reminder job off for the
duration, and leaves the replaced database behind as .pre-restore- so a
mistaken restore is still recoverable from the filesystem.

Each user gets the same thing narrowed to their own account: every medication
with its ingredients and pill photo, their groups, and the complete record of
what they took and when — as a restorable .zip or .json, or a .csv of the dose
history for a spreadsheet. Restore offers replace or merge; merge matches
medications by name and doses by medication plus timestamp, so re-merging the
same bundle is a no-op.

A user bundle deliberately carries no credentials and restores into the
calling account rather than as one, so it can't be used to take over a login,
and each user's Nextcloud destination lives on their own row — a personal backup
never reaches the instance-wide credentials. Nextcloud errors report status
codes without echoing response bodies, so a user-supplied URL can't be turned
into a reader of whatever the backend can reach.

Destination and schedule are admin-editable settings in the database, matching
how ntfy and Twilio are already configured; the NEXTCLOUD_* env vars only seed
initial values.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

The app has been carrying real medication history for a while with no way to get it out, so this adds backups at the two levels that matter. Admins get a full system archive: a consistent database snapshot plus every pill photo, downloadable or pushed to a configurable Nextcloud over WebDAV, optionally on a nightly schedule with retention. The snapshot goes through SQLite's online-backup API rather than a file copy — the app runs in WAL mode while serving requests, so a copied .db alone can be stale or torn. Restoring swaps the database in with an atomic rename, holds the reminder job off for the duration, and leaves the replaced database behind as .pre-restore-<stamp> so a mistaken restore is still recoverable from the filesystem. Each user gets the same thing narrowed to their own account: every medication with its ingredients and pill photo, their groups, and the complete record of what they took and when — as a restorable .zip or .json, or a .csv of the dose history for a spreadsheet. Restore offers replace or merge; merge matches medications by name and doses by medication plus timestamp, so re-merging the same bundle is a no-op. A user bundle deliberately carries no credentials and restores *into* the calling account rather than *as* one, so it can't be used to take over a login, and each user's Nextcloud destination lives on their own row — a personal backup never reaches the instance-wide credentials. Nextcloud errors report status codes without echoing response bodies, so a user-supplied URL can't be turned into a reader of whatever the backend can reach. Destination and schedule are admin-editable settings in the database, matching how ntfy and Twilio are already configured; the NEXTCLOUD_* env vars only seed initial values. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

brian added 1 commit

2026-08-26 16:31:29 +00:00

Back up and restore the whole instance, or just your own data 707a913bc0

The app has been carrying real medication history for a while with no way to
get it out, so this adds backups at the two levels that matter.

Admins get a full system archive: a consistent database snapshot plus every
pill photo, downloadable or pushed to a configurable Nextcloud over WebDAV,
optionally on a nightly schedule with retention. The snapshot goes through
SQLite's online-backup API rather than a file copy — the app runs in WAL mode
while serving requests, so a copied .db alone can be stale or torn. Restoring
swaps the database in with an atomic rename, holds the reminder job off for the
duration, and leaves the replaced database behind as .pre-restore-<stamp> so a
mistaken restore is still recoverable from the filesystem.

Each user gets the same thing narrowed to their own account: every medication
with its ingredients and pill photo, their groups, and the complete record of
what they took and when — as a restorable .zip or .json, or a .csv of the dose
history for a spreadsheet. Restore offers replace or merge; merge matches
medications by name and doses by medication plus timestamp, so re-merging the
same bundle is a no-op.

A user bundle deliberately carries no credentials and restores *into* the
calling account rather than *as* one, so it can't be used to take over a login,
and each user's Nextcloud destination lives on their own row — a personal backup
never reaches the instance-wide credentials. Nextcloud errors report status
codes without echoing response bodies, so a user-supplied URL can't be turned
into a reader of whatever the backend can reach.

Destination and schedule are admin-editable settings in the database, matching
how ntfy and Twilio are already configured; the NEXTCLOUD_* env vars only seed
initial values.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

brian merged commit 1e3b086895 into master

2026-08-26 16:31:42 +00:00

brian deleted branch backup-and-restore

2026-08-26 16:31:42 +00:00

brian referenced this pull request from a commit

2026-08-26 16:31:42 +00:00

Merge pull request 'Back up and restore the whole instance, or just your own data' (#8) from backup-and-restore into master