Skip to content

Rexit

Rexit maintains a private, incremental archive of Reddit messages and media on infra-services.

  • URL: https://rexit.infra.realemail.app
  • Host: infra-services
  • Data: /srv/rexit
  • Schedule: weekly, Sunday around 03:20 America/Los_Angeles
  • Authentication: Authentik forward auth
  • Backup: Tier 1 Restic with an offsite B2 copy

Design

The Rexit image is a one-shot exporter, not an HTTP server. A profile-gated exporter runs from rexit-export.service; an unprivileged static Nginx container serves the generated gallery.html. Only the gallery joins the Traefik network.

Images are pinned by digest. The exporter runs as UID/GID 65532, writes only to /srv/rexit, and uses both systemd and application-level locks to prevent overlapping exports.

Operator commands

sudo systemctl start rexit-export.service
sudo journalctl -fu rexit-export.service
systemctl list-timers rexit-export.timer

The service emits Node Exporter textfile metrics. Prometheus warns on missing or failed runs and pages when no export has succeeded for eight days.

Troubleshooting

Export failed

  1. Inspect journalctl -u rexit-export.service.
  2. Confirm the bearer token is current in services/rexit/.env.sops.yaml.
  3. Confirm the Harbor robot account can pull the pinned digest.
  4. Confirm /srv/rexit is owned by UID/GID 65532 and has free space.
  5. Reapply the rexit Ansible tag, then start the service manually.
  1. Confirm an export has produced /srv/rexit/gallery.html.
  2. Check docker logs rexit-gallery.
  3. Check the Komodo rexit stack and Traefik route.
  4. Verify the authentik@file middleware is healthy.

Lock contention

Do not delete a lock while an export process is running. Check systemctl status rexit-export.service and docker ps first. A stale .rexit.lock file is harmless because the operating-system lock, not the file's existence, controls ownership.

Restore validation

Run:

sudo /opt/homelab/backups/restore-test.sh rexit

The test restores into an isolated temporary directory and validates the manifest, SQLite database, hardened gallery, and a deterministic media sample. See the service source README for full secret, deployment, and recovery details.