restic/esh-docker-vm: profile + DB hooks + deploy guide

Closes the last file-level backup gap. Primary ESH home-lab Docker host — five services with state worth consistent dumps: - paperless-ngx → external Postgres on 10.0.50.60 (host pg_dump) - home-assistant → local SQLite ~50MB (host sqlite3 .backup) - calibre-web-automated → local SQLite (in-container sqlite3) - pgadmin → local SQLite (host sqlite3) - uptime-kuma → local SQLite (host sqlite3; container name may vary after force-recreate, detect by label) Unique to this host: HA/pgadmin/uptime-kuma images don't bundle sqlite3. Rather than maintaining custom images, pre-backup.sh runs sqlite3 from the HOST against the volume bind-mount paths. Requires sqlite3 + postgresql-client installed on esh-docker-vm. Cross-site writes to rest-server-ana since ESH has no local rest-server. NFS mounts (/mnt/{backup,books,compose,documents}) explicitly excluded — hundreds of GB of NAS-side content backed up at the NAS layer. Also excludes offen-sidecar buffer volumes (paperless + pgadmin currently run offen/docker-volume-backup alongside — retire once restic has a week of clean runs). Found in audit (non-blocking but noted in README follow-ups): - paperless-ngx Postgres password is literally "paperless-ng" — trivially weak, rotate at next opportunity.
2026-04-21 11:04:37 -07:00
parent 8c70372cc4
commit 1e24e0f799
4 changed files with 438 additions and 0 deletions
@@ -0,0 +1,93 @@
+# resticprofile config for esh-docker-vm.
+#
+# ESH home-lab Docker host — VM on esh-pve. Covered by vzdump at the
+# hypervisor (3/3 on esh-pve after the VM 108 retirement), and by this
+# file-level restic for fast per-file restore + app-consistent DB dumps.
+#
+# Writes cross-site to rest-server-ana (10.250.50.70:8000/esh-docker-vm/)
+# because the ESH site has no local rest-server.
+#
+# Multiple DB-bearing services live here (see pre-backup.sh). Several
+# containers don't bundle sqlite3, so the pre-backup script runs
+# sqlite3 and pg_dump from the HOST against volume bind-mount paths
+# (simpler than building custom container images).
+
+version: "1"
+
+global:
+  priority: low
+  ionice: true
+  ionice-class: 2
+  ionice-level: 7
+  min-memory: 100
+
+default:
+  env-file: /etc/restic/restic.env
+  env:
+    RESTIC_PASSWORD_FILE: /etc/restic/password
+  initialize: false
+  lock: /var/lock/restic-esh-docker-vm.lock
+
+  backup:
+    verbose: 1
+    run-before:
+      - /etc/restic/pre-backup.sh
+    run-after:
+      - date +%s > /var/lib/restic/last-success
+    source:
+      - /opt/docker              # compose files + bind-mount conf (~12 MB)
+      - /etc                     # host config
+      - /root                    # root's ad-hoc scripts, ssh keys, history
+      - /home                    # user home dirs
+      - /var/lib/docker/volumes  # HA, paperless, pgadmin, CWA, dockge, etc.
+      - /var/lib/restic/stage    # DB dumps produced by pre-backup.sh
+    exclude:
+      # CRITICAL: NFS mounts from 10.0.50.50 — hundreds of GB / TB at least.
+      # /mnt/backup specifically holds offen-sidecar tarballs which are
+      # redundant once restic is authoritative.
+      - /mnt/backup
+      - /mnt/books
+      - /mnt/compose
+      - /mnt/documents
+      # Docker internals
+      - /var/lib/docker/volumes/backingFsBlockDev
+      - /var/lib/docker/volumes/metadata.db
+      # Offen sidecar's buffer / tmp (if any left behind)
+      - /var/lib/docker/volumes/*_offen_backup_data
+      # Ephemeral / regenerable
+      - /opt/docker/compose/*/logs
+      - "**/*.log"
+      - "**/*.log.*"
+      - "**/*.pid"
+      # Per-user shell / app noise
+      - /root/.cache
+      - /root/.local/share/Trash
+      - /root/.python_history
+      - /home/*/.cache
+      - /home/*/.local/share/Trash
+      - /home/*/.npm
+      - /home/*/.mozilla/firefox/*/Cache
+    tag:
+      - host:esh-docker-vm
+      - site:esh
+      - fleet:home-lab
+    schedule: "*-*-* 01:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-backup.log
+
+  forget:
+    keep-daily: 7
+    keep-weekly: 4
+    keep-monthly: 12
+    keep-yearly: 3
+    tag:
+      - host:esh-docker-vm
+    schedule: "*-*-* 03:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-forget.log
+
+  check:
+    read-data-subset: 10%
+    schedule: "Sun *-*-* 05:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-check.log