fix(cutover): authenticate Redis BGSAVE backups #311

Merged

pdurlej merged 1 commit from codex/f3/redis-backup-auth into main

2026-05-17 02:14:10 +02:00

codex commented

2026-05-17 02:10:41 +02:00

Collaborator

Canary status: missing — Forgejo PR checks will run on open; operator merge after green/accepted evidence.

Canary Context Pack

Product story

Before the Honcho Redis/Postgres final-boss F3 smoke, backup-before-apply must actively prove Redis can checkpoint with auth instead of silently archiving whatever happens to be on disk.

What changed

Redis backup now runs redis-cli --no-auth-warning -a "$REDIS_PASSWORD" BGSAVE when REDIS_PASSWORD is available in the container.
The backup helper no longer swallows Redis BGSAVE errors except the safe background saving already in progress case.
Mount archiving still runs after the checkpoint request succeeds.

Why it changed

Honcho Redis requires authentication. The old helper ran unauthenticated redis-cli BGSAVE >/dev/null 2>&1 || true, which could hide NOAUTH and still proceed. That is too weak for F3 final-boss backups.

Files touched

scripts/cutover/backup-before-apply.sh

Runtime evidence

home-platform-honcho-redis-1 exposes a REDIS_PASSWORD env name and uses it in the container healthcheck.
home-platform-honcho-redis-1 is running/healthy.
home-platform-honcho-postgres-1 is running/healthy.
No unhealthy containers before this PR.

Known constraints

This does not parse Redis passwords from container command strings. If a Redis service lacks REDIS_PASSWORD env and requires auth, backup should fail closed instead of silently proceeding.
This PR does not run the F3 smoke; it prepares the backup helper for the next step.

Explicit out-of-scope

No compose changes.
No runtime mutation except later operator-run backup after merge.
No change to Postgres backup behavior.

Requested decision

Merge this before backing up honcho-redis.

Merge blockers

bash -n scripts/cutover/backup-before-apply.sh fails.
Redis backup command would leak secret values to logs.

Spec sources read

scripts/cutover/backup-before-apply.sh — backup helper being corrected
modules/honcho-redis/module.yaml — target final-boss module
modules/honcho-postgres/module.yaml — paired final-boss module
compose/apps/compose.yaml — Honcho Redis auth delivery pattern

Verification

bash -n scripts/cutover/backup-before-apply.sh -> OK
git diff --check -> OK

Closes: none

Canary status: missing — Forgejo PR checks will run on open; operator merge after green/accepted evidence. ## Canary Context Pack ### Product story Before the Honcho Redis/Postgres final-boss F3 smoke, `backup-before-apply` must actively prove Redis can checkpoint with auth instead of silently archiving whatever happens to be on disk. ### What changed - Redis backup now runs `redis-cli --no-auth-warning -a "$REDIS_PASSWORD" BGSAVE` when `REDIS_PASSWORD` is available in the container. - The backup helper no longer swallows Redis `BGSAVE` errors except the safe `background saving already in progress` case. - Mount archiving still runs after the checkpoint request succeeds. ### Why it changed Honcho Redis requires authentication. The old helper ran unauthenticated `redis-cli BGSAVE >/dev/null 2>&1 || true`, which could hide `NOAUTH` and still proceed. That is too weak for F3 final-boss backups. ### Files touched - `scripts/cutover/backup-before-apply.sh` ### Runtime evidence - `home-platform-honcho-redis-1` exposes a `REDIS_PASSWORD` env name and uses it in the container healthcheck. - `home-platform-honcho-redis-1` is `running/healthy`. - `home-platform-honcho-postgres-1` is `running/healthy`. - No unhealthy containers before this PR. ### Known constraints - This does not parse Redis passwords from container command strings. If a Redis service lacks `REDIS_PASSWORD` env and requires auth, backup should fail closed instead of silently proceeding. - This PR does not run the F3 smoke; it prepares the backup helper for the next step. ### Explicit out-of-scope - No compose changes. - No runtime mutation except later operator-run backup after merge. - No change to Postgres backup behavior. ### Requested decision Merge this before backing up `honcho-redis`. ### Merge blockers - `bash -n scripts/cutover/backup-before-apply.sh` fails. - Redis backup command would leak secret values to logs. ## Spec sources read - `scripts/cutover/backup-before-apply.sh` — backup helper being corrected - `modules/honcho-redis/module.yaml` — target final-boss module - `modules/honcho-postgres/module.yaml` — paired final-boss module - `compose/apps/compose.yaml` — Honcho Redis auth delivery pattern ## Verification - `bash -n scripts/cutover/backup-before-apply.sh` -> OK - `git diff --check` -> OK Closes: none

codex added 1 commit

2026-05-17 02:10:41 +02:00

fix(cutover): authenticate Redis BGSAVE backups

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Failing after 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 20s