feat: guarantee 100% restore via explicit two-pillar backup model

gitops_backup/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.2.0
+
+- Docs: make the two-pillar backup model explicit — config repo (this add-on)
+  + encrypted HA full backup (e.g. Google Drive Backup) = 100% restorable;
+  neither alone is enough. Sharpened the "what is backed up where" table
+  (names exactly what `.storage/` holds and what lives outside `/config`).
+- Security: seed `.gitignore` now also excludes `*.token` / `.google.token`
+  so OAuth tokens (e.g. Google Calendar) never land in the repo.
+- First bootstrap now logs a disaster-recovery warning: this add-on versions
+  declarative config only; run HA full backups for a complete restore.
+
 ## 0.1.1
 
 - Fix: keep the addon's own runtime files (`.gitops_backup_status`,

gitops_backup/DOCS.md

@@ -66,11 +66,19 @@ Run both layers:
 |------|----------------------|--------------------------|
 | Config YAML (automations, dashboards, …) | ✅ versioned, reviewable diffs | ✅ inside the archive |
 | `secrets.yaml` | ❌ **never** (gitignored) | ✅ inside the **encrypted** archive |
-| `.storage/` (auth, entity registry) | ❌ never | ✅ |
+| `.storage/` — UI-added **integrations**, **logins/tokens**, **device/entity/area registries**, **UI (Lovelace) dashboards**, helpers | ❌ never (holds secrets) | ✅ **most restore-critical item** |
+| Credentials: `*.token`, `.google.token`, `*.key`, `*.pem`, `.cloud/` | ❌ never | ✅ |
 | Databases, history, logs | ❌ never | ✅ (recorder DB, if selected) |
-| Add-ons + their data | ❌ | ✅ |
+| Add-on configs/data, TLS certs (`/ssl`) — live **outside** `/config` | ❌ add-on can't see them | ✅ |
 | Media, camera recordings | ❌ | usually excluded — external drive |
 
+> **The 100% guarantee: config repo + encrypted full backup. Neither alone is
+> enough.** Restore from the git repo *only* and you'd get your YAML back but
+> have to re-do by hand every UI-added integration, all logins/tokens, device
+> and entity names, UI dashboards, `secrets.yaml`, and every add-on — because
+> those live in `.storage/`, `secrets.yaml`, or outside `/config`. That's why a
+> full backup (Pillar 2) is mandatory, not optional.
+
 **Recommended stack:**
 
 ```text
@@ -114,8 +122,9 @@ already live on the box and git history simply resumes.
 ## What is committed
 
 Everything in your config folder **except** the seeded `.gitignore` exclusions:
-`secrets.yaml`, `.storage/`, `.cloud/`, databases, logs, `known_devices.yaml`,
-`ip_bans.yaml`, and the add-on's own status/log files.
+`secrets.yaml`, `.storage/`, `.cloud/`, databases, logs, `*.token`,
+`.google.token`, `known_devices.yaml`, `ip_bans.yaml`, and the add-on's own
+status/log files.
 
 ## Status in Home Assistant
 

gitops_backup/config.json

@@ -1,6 +1,6 @@
 {
   "name": "HA GitOps",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "slug": "gitops_backup",
   "description": "PR-gated GitHub backup for your Home Assistant config \u2014 nothing force-pushes, every change is reviewable, CI validates before merge",
   "url": "https://github.com/askb/ha-gitops",

gitops_backup/rootfs/app/gitops_backup.sh

@@ -65,6 +65,8 @@ seed_gitignore() {
 secrets.yaml
 *.pem
 *.key
+*.token
+.google.token
 .git-credentials
 .cloud/
 .storage/
@@ -130,6 +132,7 @@ bootstrap_if_needed() {
     # Returns 0 if bootstrap ran (caller should stop), 1 if repo already exists
     if [ -d .git ]; then return 1; fi
     log "No git repo in ${CONFIG_DIR} — bootstrapping"
+    log "⚠ This add-on versions DECLARATIVE config only. It does NOT back up secrets.yaml, .storage/ (UI-configured integrations, logins, device/entity registries, dashboards), the database, or add-on data — those are excluded on purpose. For a 100% restore you MUST also run HA full backups (e.g. the Google Drive Backup add-on). See this add-on's DOCS → 'What is backed up where'."
     if [ "$DRY_RUN" = "true" ]; then
         seed_gitignore
         log "DRY RUN: would git init, commit initial import, push to ${BASE_BRANCH}"