backup: keep deleted/overwritten versions instead of mirroring them away (#120)

The nightly job runs 'rclone sync', which permanently deletes or overwrites
objects at the B2 destination. That means an accidental deletion or a
ransomware encryption on /hdd propagates straight to the backup on the next
run, leaving no clean copy.

Add --backup-dir so every superseded version is moved into a dated folder
under _versions/ rather than thrown away, and prune that folder after 30
days so it doesn't grow unbounded.

.github/workflows/lint-ansible.yml

@@ -22,6 +22,6 @@ jobs:
 
       - name: Run ansible-lint
         if: steps.check.outputs.has_files == 'true'
-        uses: ansible/ansible-lint@v25
+        uses: ansible/ansible-lint@v26
         with:
           working_directory: ansible/

.github/workflows/validate-terraform.yml

@@ -89,7 +89,7 @@ jobs:
 
       - name: Post plan as PR comment
         if: github.actor != 'dependabot[bot]'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs');

ansible/scripts/hdd-backup.sh

@@ -7,6 +7,15 @@ DIRS=(archive backups stash syncthing ftp)
 EMAIL="pez@pez.sh"
 SUBJECT="HDD Backup Report - $(date '+%Y-%m-%d %H:%M')"
 
+# Versioning: a plain `rclone sync` permanently deletes/overwrites objects at
+# the destination, so a deletion or ransomware encryption on /hdd would
+# propagate to the backup on the next run. Instead, move every superseded
+# version into a dated folder under $VERSIONS so it can be recovered, then
+# prune anything older than $RETENTION_DAYS to cap storage.
+STAMP="$(date '+%Y-%m-%d_%H%M%S')"
+VERSIONS="$BUCKET/_versions"
+RETENTION_DAYS=30
+
 failures=()
 report=""
 size_error=""
@@ -16,7 +25,7 @@ for dir in "${DIRS[@]}"; do
     dst="$BUCKET/$dir"
     echo "Syncing $src -> $dst"
 
-    if output=$(rclone sync "$src" "$dst" -v 2>&1); then
+    if output=$(rclone sync "$src" "$dst" --backup-dir "$VERSIONS/$STAMP/$dir" -v 2>&1); then
         rc=0
     else
         rc=$?
@@ -28,6 +37,14 @@ for dir in "${DIRS[@]}"; do
     report+="=== $dir ===\n$output\n\n"
 done
 
+# Prune versioned copies older than the retention window.
+if prune_output=$(rclone delete "$VERSIONS" --min-age "${RETENTION_DAYS}d" -v 2>&1); then
+    :
+else
+    failures+=("version-prune")
+    report+="=== Version Prune Error ===\n$prune_output\n\n"
+fi
+
 # Get bucket storage usage
 if bucket_usage=$(rclone size "$BUCKET" 2>&1); then
     :

terraform/pagerduty/providers.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     pagerduty = {
       source  = "pagerduty/pagerduty"
-      version = "~> 2.2"
+      version = "~> 3.32"
     }
   }
 }

terraform/providers.tf

@@ -12,7 +12,7 @@ terraform {
     }
     pagerduty = {
       source  = "pagerduty/pagerduty"
-      version = "~> 2.2"
+      version = "~> 3.32"
     }
   }