feat: P0 backup system (WAL+snapshot+restore+verify), monitoring stack, admin health API

scripts/backup/offsite-sync.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+set -euo pipefail
+
+SNAPSHOT_DIR="/opt/memento/backups/snapshots"
+REMOTE_HOST="${BACKUP_REMOTE_HOST:-}"
+REMOTE_PATH="${BACKUP_REMOTE_PATH:-/opt/memento-offsite-backups}"
+LOG_FILE="/opt/memento/backups/backup.log"
+
+log() {
+  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
+}
+
+TELEGRAM_BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-}"
+TELEGRAM_CHAT_ID="${TELEGRAM_CHAT_ID:-}"
+
+send_alert() {
+  if [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
+    curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
+      -d chat_id="$TELEGRAM_CHAT_ID" -d text="$1" >/dev/null 2>&1 || true
+  fi
+}
+
+log "=== Offsite backup sync ==="
+
+if [ -z "$REMOTE_HOST" ]; then
+  log "WARNING: No BACKUP_REMOTE_HOST configured. Skipping offsite sync."
+  log "Set BACKUP_REMOTE_HOST=user@server in /opt/memento/.env.docker for offsite backups"
+  exit 0
+fi
+
+LATEST=$(ls -t "$SNAPSHOT_DIR"/*.sql.gz 2>/dev/null | head -1)
+if [ -z "$LATEST" ]; then
+  log "ERROR: No snapshots to sync"
+  send_alert "🚨 MEMENTO: Offsite backup failed - no snapshots found!"
+  exit 1
+fi
+
+log "Syncing $LATEST to $REMOTE_HOST:$REMOTE_PATH"
+rsync -az --chmod=F600 "$SNAPSHOT_DIR/" "${REMOTE_HOST}:${REMOTE_PATH}/" 2>&1 | tee -a "$LOG_FILE"
+
+if [ $? -eq 0 ]; then
+  log "Offsite sync complete"
+else
+  log "ERROR: Offsite sync failed!"
+  send_alert "🚨 MEMENTO: Offsite backup sync FAILED! Check rsync connectivity."
+  exit 1
+fi