Update README with all features, commands, and usage docs

chiefMarlin · chiefMarlin · commit 14aff1b4fc1c · 2026-02-27T10:41:13.000-05:00
diff --git a/README.md b/README.md
@@ -4,6 +4,45 @@ A single Go binary that wraps [restic](https://restic.net/) for reliable, automa
 
 Built for backing up financial documents and other critical files where reliability matters more than anything else.
 
+## Quick Start
+
+```powershell
+# 1. Download restic-sentry.exe from the latest release
+#    https://github.com/8ff/restic-sentry/releases/latest
+
+# 2. Install restic (downloads latest to C:\restic\restic.exe)
+restic-sentry.exe install-restic
+
+# 3. Generate config file
+restic-sentry.exe init-config
+
+# 4. Edit restic-sentry.json with your S3 credentials, backup paths, and Slack webhook
+
+# 5. Run a test backup
+restic-sentry.exe backup
+
+# 6. Schedule automatic backups (run as Administrator)
+restic-sentry.exe install
+```
+
+That's it. Backups will run every 6 hours (configurable), and you'll get Slack notifications on success or failure.
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `backup` | Run the full backup pipeline (preflight, unlock, init, backup, verify, prune, notify) |
+| `check` | Run a full integrity check — reads and verifies all stored data |
+| `status` | Show repository snapshots, stats, and scheduler status |
+| `install` | Register in Windows Task Scheduler (requires Administrator) |
+| `uninstall` | Remove from Windows Task Scheduler |
+| `install-restic` | Download and install latest restic to `C:\restic\restic.exe` |
+| `update` | Self-update restic-sentry to the latest release |
+| `init-config` | Generate an example config file |
+| `version` | Print version |
+
+Commands that interact with the backup repository (`backup`, `check`, `status`, `install`, `uninstall`) require a config file via `--config <path>` (defaults to `restic-sentry.json` next to the binary).
+
 ## Features
 
 ### Backup Pipeline
@@ -25,84 +64,63 @@ Every `backup` run executes a full 6-step pipeline:
 - **Process lock file** — prevents overlapping runs when the scheduler fires while a backup is still in progress. The lock is PID-aware: if the holding process is dead, the lock is automatically cleared. A 6-hour max age acts as a safety net so backups never get permanently stuck
 - **Stale restic lock cleanup** — runs `restic unlock` before every backup to clear repository locks left by crashed/killed restic processes
 
-### Notifications
+### Slack Notifications
 
-Slack webhook notifications with color-coded severity:
+Color-coded by severity:
 
 - **Green** — backup successful, shows duration, files processed, data added
 - **Orange** — backup completed with warnings (some files were skipped due to permissions/locks)
 - **Red** — backup failed, preflight failed, or integrity check failed
 
-### Observability
+### Copy-Pasteable Commands
 
-Every restic command is logged to stderr with the full copy-pasteable command, including env vars (credentials masked with `***`):
+Every restic command is logged to stderr with the full command including env vars (credentials masked with `***`):
 
 ```
 RESTIC_REPOSITORY=s3:s3.us-east-1.amazonaws.com/my-backups RESTIC_PASSWORD=*** AWS_ACCESS_KEY_ID=*** AWS_SECRET_ACCESS_KEY=*** AWS_DEFAULT_REGION=us-east-1 restic backup --verbose --use-fs-snapshot --exclude *.tmp "C:\Users\Me\Documents\Financial"
 ```
 
-You can grab any logged command, fill in your real credentials, and run it manually.
-
-### Scheduling
-
-Self-registers in Windows Task Scheduler via `schtasks.exe`. Runs with `HIGHEST` privileges (required for VSS). Configurable interval (default: every 6 hours).
-
-## Commands
-
-| Command | Description |
-|---------|-------------|
-| `backup` | Run the full 6-step backup pipeline |
-| `check` | Run a full integrity check (`--read-data-subset=100%`) |
-| `status` | Show repository snapshots, stats, and scheduler status |
-| `install` | Register in Windows Task Scheduler |
-| `uninstall` | Remove from Windows Task Scheduler |
-| `init-config` | Generate an example config file |
-| `version` | Print version |
-
-All commands except `init-config` and `version` accept `--config <path>` (defaults to `restic-sentry.json` next to the binary).
-
-## Quick Start
+Grab any logged command, fill in your real credentials, and run it manually for debugging.
 
-### 1. Build
+### Self-Update
 
-```bash
-# From source (cross-compile for Windows from any OS)
-make build-windows    # produces restic-sentry.exe
-
-# Or just for your current platform
-make build
+```powershell
+restic-sentry.exe update
 ```
 
-### 2. Configure
+Checks the latest release on GitHub, downloads the new binary, and replaces itself. The old binary is kept as `restic-sentry.exe.old` as a safety net. If the update fails mid-write, it rolls back automatically.
 
-```powershell
-# Generate example config
-restic-sentry.exe init-config
+### Restic Installer
 
-# Edit restic-sentry.json with your values
+```powershell
+restic-sentry.exe install-restic
 ```
 
-### 3. Test
+Downloads the latest restic release from GitHub, extracts `restic.exe` to `C:\restic\restic.exe`. The default config already points to this path, so no extra configuration needed.
+
+### Scheduling
 
 ```powershell
-# Run a backup manually to make sure everything works
-restic-sentry.exe backup --config restic-sentry.json
+# Run as Administrator
+restic-sentry.exe install
 ```
 
-### 4. Schedule
+Registers itself in Windows Task Scheduler via `schtasks.exe`. Runs with `HIGHEST` privileges (required for VSS). Default interval is every 6 hours, configurable via `schedule_interval_hours` in the config.
 
 ```powershell
-# Run as Administrator — registers in Task Scheduler
-restic-sentry.exe install --config restic-sentry.json
+# Remove the scheduled task
+restic-sentry.exe uninstall
 ```
 
 ## Configuration
 
+Generated by `restic-sentry.exe init-config`:
+
 ```jsonc
 {
   // S3 backend
   "s3": {
-    "endpoint": "",                    // custom S3 endpoint (leave empty for AWS)
+    "endpoint": "",                         // custom S3 endpoint (leave empty for AWS)
     "bucket": "my-backups",
     "access_key": "AKIA...",
     "secret_key": "...",
@@ -112,8 +130,8 @@ restic-sentry.exe install --config restic-sentry.json
   // Restic repo encryption password
   "restic_password": "...",
 
-  // Path to restic binary (default: "restic", i.e. on PATH)
-  "restic_binary": "",
+  // Path to restic binary (default: C:\restic\restic.exe)
+  "restic_binary": "C:\\restic\\restic.exe",
 
   // Directories to back up
   "paths": [
@@ -124,19 +142,19 @@ restic-sentry.exe install --config restic-sentry.json
   "excludes": ["*.tmp", "~$*"],
 
   // Slack webhook URL
-  "slack_webhook_url": "https://hooks.slack.com/services/T.../B.../...",
+  "slack_webhook_url": "https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK",
 
   // How often to run (hours) — used by 'install' command
   "schedule_interval_hours": 6,
 
   // Retry on transient failures
   "retry": {
-    "max_attempts": 3,        // number of attempts
-    "base_delay_sec": 30      // delay doubles each retry: 30s, 60s, 120s
+    "max_attempts": 3,                      // number of attempts
+    "base_delay_sec": 30                    // delay doubles each retry: 30s, 60s, 120s
   },
 
   // Retention policy
-  "keep_last": 0,             // 0 = disabled
+  "keep_last": 0,                           // 0 = disabled
   "keep_daily": 7,
   "keep_weekly": 4,
   "keep_monthly": 12,
@@ -146,6 +164,25 @@ restic-sentry.exe install --config restic-sentry.json
 }
 ```
 
+### Configuration Notes
+
+- All fields except `restic_binary`, `endpoint`, `excludes`, `keep_last`, and `retry` are required
+- The config file has secrets in plaintext — set file permissions accordingly (`icacls config.json /inheritance:r /grant:r "%USERNAME%:F"`)
+- S3 endpoint can be left empty for AWS, or set to a custom endpoint for MinIO, Backblaze B2, etc.
+
+## Building from Source
+
+```bash
+# Build for Windows (from any OS)
+make build-windows    # produces restic-sentry.exe
+
+# Build for current platform
+make build
+
+# Run tests
+make test
+```
+
 ## Project Structure
 
 ```
@@ -160,16 +197,12 @@ internal/
   scheduler/scheduler.go             Windows Task Scheduler via schtasks.exe
   slack/slack.go                     Webhook notifications (green/orange/red)
   logger/logger.go                   Structured JSON logging to stderr
+  install/github.go                  GitHub API client for release fetching
+  install/restic.go                  Restic binary downloader/installer
+  install/selfupdate.go              Self-update mechanism
 Makefile                             Build targets
 ```
 
-## Prerequisites
-
-- [restic](https://restic.net/) installed and on PATH (or provide full path in config)
-- An S3 bucket (AWS, MinIO, Backblaze B2 with S3 compatibility, etc.)
-- A Slack incoming webhook URL
-- Windows (for VSS and Task Scheduler features; backup/check work on any OS)
-
 ## S3 Recommendations
 
 - **Enable bucket versioning** — belt-and-suspenders against accidental deletion or repo corruption
