dev2 backups: keep 2 days of full dumps locally, 7 off-box

[ralyodio]

dev2's root disk hit 94%. ~300 GB of it was 8 days of daily full dumps (nichedb ~18 GB, rssamplifier ~14 GB, bittorrented ~5 GB per day).

• KEEP_FULL_DAYS default 7 → 2. The newest full per DB is still always kept.
• The seed box's pull-dev2-backups.sh (not in this repo; lives on the seed box) now pulls the fulls too, only once they are 60+ minutes old so a half-written dump is never copied, and keeps 7 days. It has ~3 TB free.
• Frequent (4-hourly) retention is unchanged at 7 days.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

33 finding(s)

HIGH/CRITICAL: 7 | MEDIUM: 12 | LOW: 14

Severity	Rule	Location
HIGH	py-ssrf-outbound-request	dev2/dev2-site:151
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1060
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1771
HIGH	sh-remote-script-execution	root-ubuntu.sh:3250
HIGH	sh-remote-script-execution	root-ubuntu.sh:3251
HIGH	sh-remote-script-execution	root-ubuntu.sh:5146
HIGH	sh-remote-script-execution	root-ubuntu.sh:5150
MEDIUM	sql-template-interpolation	dev2/dev2-site:1286
MEDIUM	sql-template-interpolation	dev2/dev2-site:1363
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:5354
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
MEDIUM	redos-nested-quantifier	src/emoji.ts:167
MEDIUM	redos-nested-quantifier	src/icon.ts:166
MEDIUM	redos-nested-quantifier	src/mail.ts:1047
MEDIUM	sql-template-interpolation	src/users-dump.ts:487
MEDIUM	sql-string-concatenation	src/users-dump.ts:507
MEDIUM	sql-template-interpolation	src/users-dump.ts:540
MEDIUM	sql-string-concatenation	src/users-dump.ts:574
MEDIUM	redos-nested-quantifier	src/wcag.ts:556
LOW	secret-generic-credential	src/credentials.ts:36
LOW	secret-generic-credential	src/credentials.ts:53
LOW	secret-generic-credential	src/credentials.ts:56
LOW	secret-generic-credential	src/credentials.ts:61
LOW	secret-generic-credential	src/user-export.ts:689
LOW	secret-generic-credential	src/user-export.ts:695
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	secret-generic-credential	test/mail.test.ts:141
LOW	secret-generic-credential	test/proxy.test.ts:69
LOW	secret-generic-credential	test/proxy.test.ts:85
LOW	secret-generic-credential	test/shorten.test.ts:36
LOW	secret-database-url	test/users-dump.test.ts:108
LOW	secret-database-url	test/users-dump.test.ts:119
LOW	secret-database-url	test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.