How to Set Up Zero-Trust Encrypted Backups Using Restic on Ubuntu 24.04

·1 views

Restic, an open-source backup tool written in Go, offers client-side AES-256-CTR encryption and content-defined block-level deduplication, addressing key weaknesses in traditional backup approaches. Unlike legacy sync tools, Restic natively supports cloud storage such as S3 without requiring third-party proxies or mounts. A critical security consideration involves IAM policy configuration: broadly denying S3 delete permissions breaks Restic's lock-file cleanup mechanism, so delete access must be selectively allowed for the locks/ directory only. Storing unrestricted cloud credentials on the host machine poses a serious ransomware risk, as compromised root access can enable permanent deletion of off-site backups. Additionally, automating Restic installation by querying the GitHub API at scale can trigger rate limits, causing failed deployments across large server fleets.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Agents in CI/CD Pipelines Cut PR Review Bottlenecks Without Replacing Engineers

Engineering teams often struggle with pull request backlogs as developers submit PRs faster than reviewers can process them. By embedding AI agents directly into CI/CD pipelines, routine triage tasks such as categorizing PRs, flagging lint violations, summarizing test failures, and assigning labels can be automated before a human reviewer ever opens the request. The AI agent analyzes each pull request immediately after CI starts, producing structured summaries and suggested fixes instead of raw build logs, reducing context-switching for reviewers. A key guardrail in this approach is that the AI never merges code autonomously — it assists reviews rather than approving production changes. Platforms including GitHub, GitLab, Harness, and AI-native tools are increasingly moving toward this model of friction-reducing automation across the software delivery lifecycle.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Fix GitLab CI Docker Socket Connection Error in CI Jobs

GitLab CI jobs fail with a 'Cannot connect to the Docker daemon at unix:///var/run/docker.sock' error when the DOCKER_HOST environment variable is not set, causing the Docker client to look for a local socket that does not exist inside the job container. The Docker daemon runs in a separate docker:dind service container, so the job container finds nothing listening on the local socket. The fix requires setting DOCKER_HOST to tcp://docker:2376 and keeping TLS-related variables consistent, using port 2376 when TLS certificates are configured and port 2375 only when TLS is explicitly disabled. A misconfigured or missing dind service — often due to the runner lacking privileged mode in its config — can also trigger the same error even when DOCKER_HOST is correctly set. This error is distinct from the tcp://docker:2375 variant, which points to a reachability or TLS mismatch issue rather than a missing DOCKER_HOST setting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Typed Seam, Not a Rule Engine, Fixes Hardcoded Business Logic

Software teams often frame externalizing business rules as a tooling choice — picking an npm package in Node.js or adopting Drools in Java — but the real architectural move is defining a clean, typed boundary between the service and the rule layer. The core pattern replaces inline conditional logic with a typed input, a typed output, and a rule set evaluated externally, so the calling code never needs to know the rule engine's internals. Both compile-time types and runtime schema validation are essential: the compiler catches mismatches in your own code, while runtime checks catch silent shape changes when a rule layer is updated underneath you. Skipping the runtime boundary means a rule change that renames a field can fail silently in production rather than loudly in a test. Once this seam is correctly established, the choice of engine, language, or hosting becomes an implementation detail rather than the central decision.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Unhandled Promise Rejections Silently Crash Node.js Background Workers

Unhandled promise rejections are a leading cause of silent failures in long-running Node.js services such as background workers, queue consumers, and batch jobs. A promise rejection is considered unhandled when no .catch() handler, .then() error argument, or try/catch around an await exists anywhere in its chain. Unlike HTTP request handlers where failure is scoped to a single request, a crashing background worker can drop dozens of in-flight jobs with no immediate alert. Modern versions of Node.js have shifted from merely printing warnings to terminating the process outright when such rejections occur. Developers are advised to adopt concrete error-handling patterns to prevent these failures from going undetected in production environments.

0 comments Read more at DEV Community