40 lines
1.4 KiB
Bash
Executable File
40 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# Copyright 2026 Umbra Tools (umbratools.com)
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Delete vaultwarden backups older than the retention window.
|
|
#
|
|
# Run as root via a NOPASSWD sudoers rule, because the share is mounted as root.
|
|
# Install to /usr/local/sbin/vw-cleanup-old owned by root, mode 755.
|
|
#
|
|
# The retention window is fixed here rather than taken as an argument, so this
|
|
# grant cannot be used to delete anything outside the named pattern.
|
|
|
|
set -euo pipefail
|
|
|
|
MNT="/mnt/netbackup"
|
|
KEEP_DAYS=60
|
|
|
|
# Refuse to delete anything if the share is not mounted. Without this check the
|
|
# path is a plain empty directory, find matches nothing, and the script exits 0
|
|
# reporting "deleted 0" - which is indistinguishable from a healthy run. That
|
|
# is how the retention policy could fail silently.
|
|
if ! mountpoint -q "$MNT"; then
|
|
echo "vw-cleanup-old: ${MNT} is not mounted, refusing to run" >&2
|
|
exit 1
|
|
fi
|
|
|
|
DIR="${MNT}/Vault"
|
|
|
|
if [ ! -d "$DIR" ]; then
|
|
echo "vw-cleanup-old: ${DIR} does not exist on the share" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# -delete implies -depth, so directory contents are handled before the
|
|
# directory itself. The pattern is pinned to this share and this filename
|
|
# shape; nothing else on the share can match.
|
|
find "$DIR" -maxdepth 1 -type f -name 'vaultwarden-*.db' -mtime "+${KEEP_DAYS}" -print -delete
|
|
|
|
echo "vw-cleanup-old: retention ${KEEP_DAYS} days enforced"
|