Nikolay MiroshnichenkoandClaude Fable 5
1aea8a6d9b
Circuit 1: real git in /config (deploy key, pre-commit secret scanner, meaningful commits). Circuit 2: age-encrypted native HA backups in GitHub Releases with rotation and a mandatory monthly restore drill. Ships install/sync/scan/offsite/restore scripts, HA automations/snippets, setup + architecture + incident + runbook references, EN + RU skill docs. README/README.ru gain an ops-companion bullet in Scenario 3; CHANGELOG [Unreleased] Added entry (no version bump). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ha-git-backup — the ops companion skill
Our Scenario 3 ends with generate_ha_package handing you a Home Assistant KNX YAML. This
skill covers what happens after you deploy it: the life of your /config.
Two circuits, two different jobs:
- History — a real git repo inside
/config, pushed to a private GitHub repo over a deploy key (blast radius: one repo). Every change is a meaningful commit ([daily] 3 file(s) | HA 2026.7.1); a pre-commit secret scanner blocks any commit whose diff contains a token, password or private key. Answers "what broke my automation last night" in onegit diff. - Recovery — full native HA backups (including
.storage: entity registry, auth, UI dashboards) age-encrypted and uploaded to GitHub Releases with rotation. The private age key never touches the HA host — a compromised host cannot read its own backups. Answers "the SSD died" with a 30-minute restore.
Plus: HA automations (daily commit at 03:30, a pre-update tag, a sync button, a failure alert), a health sensor, a restore runbook and a mandatory monthly restore drill — because a backup you have never restored is a hypothesis, not a backup.
Quick start
1. Create an empty PRIVATE GitHub repo (e.g. ha-config).
2. Follow references/setup.md: deploy key → scripts to /config/.git-sync/bin → install.sh.
3. Add assets/configuration_snippet.yaml + assets/automations.yaml, restart HA (full restart).
4. Circuit 2: age key + fine-grained PAT (Contents RW, ONE repo) → backup_offsite.sh.
5. Run the first restore drill immediately (references/restore-runbook.md).
Start with SKILL.md — it is written as a Claude skill (drop it into
.claude/skills/ and Claude will walk you through installation, incidents and drills), but it
reads just as well as plain documentation for humans.
Field-tested: the secret scanner ships canary-tested (see LESSON-05 — a BusyBox grep quirk silently disabled the private-key pattern until a planted-secret test caught it).