restic: ana-ml2 profile — cover the only bare-metal host in the fleet

ana-ml2 is not on any Proxmox hypervisor, so vzdump doesn't touch it. This closes the biggest single backup gap per the 2026-04-20 pipeline audit. Sources: /opt/docker (~110 MB), /etc, /root, /var/lib/docker/volumes. Excludes /tank/* (model weights — regenerable from Hugging Face and would blow repo size budget). No pre-backup DB hook — none of the llama-swap / vllm / comfyui / kokoro / parakeet / vibevoice stacks use relational databases. README walks through the one-time setup: rest-server .htpasswd entry, restic init with fresh passphrase, resticprofile install, systemd timer generation, verification against the Backrest UI.
2026-04-20 23:06:25 -07:00
parent 1431768596
commit d0c4e46e73
2 changed files with 233 additions and 0 deletions
@@ -0,0 +1,82 @@
+# resticprofile config for ana-ml2.
+#
+# **Bare metal** — not protected by any Proxmox vzdump. This is the only
+# backup for this host's config/state, so it's the highest-stakes repo in
+# the fleet. Writes to the Anaheim rest-server at 10.250.50.70 as user
+# `ana-ml2`. The full REST URL (with HTTP basic auth creds) lives in
+# /etc/restic/restic.env. The client-side encryption passphrase lives in
+# /etc/restic/password.
+#
+# Notable exclusions:
+#   - /tank/* is NOT in source paths. That's ~TB of model weights (HF
+#     caches, llama.cpp GGUFs, ComfyUI models, etc.) — all regenerable
+#     from upstream. Backing them up would blow the repo size budget.
+#   - No DB dumps needed. None of the stacks on this host (llama-swap,
+#     vllm-qwen3, comfyui, kokoro, parakeet, vibevoice, beszel-agent,
+#     dozzle-agent, dockge) store relational data.
+
+version: "1"
+
+global:
+  priority: low
+  ionice: true
+  ionice-class: 2
+  ionice-level: 7
+  min-memory: 100
+
+default:
+  env-file: /etc/restic/restic.env          # RESTIC_REPOSITORY=rest:http://user:pw@…
+  env:
+    RESTIC_PASSWORD_FILE: /etc/restic/password
+  initialize: false                         # repo created manually by `restic init`
+  lock: /var/lock/restic-ana-ml2.lock
+
+  backup:
+    verbose: 1
+    run-after:
+      - date +%s > /var/lib/restic/last-success
+    source:
+      - /opt/docker          # compose files + host-level configs — small (~100MB)
+      - /etc                 # host config (systemd units, chrony, apparmor, ssh, etc.)
+      - /root                # root shell history, ssh keys, any ad-hoc scripts
+      - /var/lib/docker/volumes  # named volumes (small; models live on /tank, not here)
+    exclude:
+      # Docker internals we never want in a backup
+      - /var/lib/docker/volumes/backingFsBlockDev
+      - /var/lib/docker/volumes/metadata.db
+      # Ephemeral / regenerable junk
+      - /opt/docker/compose/*/logs
+      - "**/*.log"
+      - "**/*.log.*"
+      - "**/*.pid"
+      # Root's noise — shell caches, tmp
+      - /root/.cache
+      - /root/.local/share/Trash
+      - /root/.npm
+      - /root/.python_history
+    tag:
+      - host:ana-ml2
+      - site:ana
+      - fleet:pfi
+    schedule: "*-*-* 01:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-backup.log
+
+  forget:
+    keep-daily: 7
+    keep-weekly: 4
+    keep-monthly: 12
+    keep-yearly: 3
+    # NOTE: no `prune: true` — rest-server runs with --append-only.
+    # See README.md "Prune ceremony".
+    tag:
+      - host:ana-ml2
+    schedule: "*-*-* 03:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-forget.log
+
+  check:
+    read-data-subset: 10%
+    schedule: "Sun *-*-* 05:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-check.log