restic/nh3-docker: profile + deployment guide

Adds file-level restic for the NH3 Docker VM. Targets the Synology rest-server (rest-server-nh3 at 10.100.50.50:8000) as user nh3-docker — site-local writes matching the fleet pattern. No pre-backup hook needed: none of the stacks on this host (adguard, dockge, beszel-agent, dozzle-agent, portainer) run relational DBs. The SQLite state in their named volumes is WAL-mode and restores cleanly from raw restic capture. Source paths mirror ana-ml2's template (/opt/docker, /etc, /root, /var/lib/docker/volumes) with the same exclude list (docker internals, logs, pids, root's shell/caches). ~1.6 MB of compose files + small volumes — expected snapshot size a few hundred MB at most, dominated by any AdGuard query log history. README walks through reuse (existing repo + htpasswd) vs fresh init paths, resticprofile install, timer generation, and verification via the Backrest UI.
2026-04-21 01:13:35 -07:00
parent 349f684d0b
commit de1eac2904
2 changed files with 241 additions and 0 deletions
@@ -0,0 +1,79 @@
+# resticprofile config for nh3-docker.
+#
+# nh3-docker is a VM on nh3-pve, so its disk image IS captured by vzdump
+# at the hypervisor layer. This file-level restic is additive: it gives
+# fast per-file restore without mounting the VM image, and ships to the
+# site-local rest-server for location-resilient recovery.
+#
+# Writes to the Synology rest-server at 10.100.50.50:8000 as user
+# `nh3-docker`. The full REST URL (with HTTP basic-auth creds) lives in
+# /etc/restic/restic.env. The client-side encryption passphrase lives in
+# /etc/restic/password.
+#
+# No DB dumps needed. None of the stacks on this host (adguard, dockge,
+# beszel-agent, dozzle-agent, portainer) run a relational DB — AdGuard
+# stores config as YAML, the rest use tiny SQLite state in their volumes
+# which restic captures raw (WAL-mode SQLite recovers cleanly).
+
+version: "1"
+
+global:
+  priority: low
+  ionice: true
+  ionice-class: 2
+  ionice-level: 7
+  min-memory: 100
+
+default:
+  env-file: /etc/restic/restic.env          # RESTIC_REPOSITORY=rest:http://user:pw@…
+  env:
+    RESTIC_PASSWORD_FILE: /etc/restic/password
+  initialize: false                         # repo created manually by `restic init`
+  lock: /var/lock/restic-nh3-docker.lock
+
+  backup:
+    verbose: 1
+    run-after:
+      - date +%s > /var/lib/restic/last-success
+    source:
+      - /opt/docker              # compose files (~1.6 MB on this host)
+      - /etc                     # host config (systemd, adguard upstream config, etc.)
+      - /root                    # root shell history, ssh keys, ad-hoc scripts
+      - /var/lib/docker/volumes  # adguard config, agent state, dockge state, etc.
+    exclude:
+      - /var/lib/docker/volumes/backingFsBlockDev
+      - /var/lib/docker/volumes/metadata.db
+      - /opt/docker/compose/*/logs
+      - "**/*.log"
+      - "**/*.log.*"
+      - "**/*.pid"
+      - /root/.cache
+      - /root/.local/share/Trash
+      - /root/.npm
+      - /root/.python_history
+    tag:
+      - host:nh3-docker
+      - site:nh3
+      - fleet:pfi
+    schedule: "*-*-* 01:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-backup.log
+
+  forget:
+    keep-daily: 7
+    keep-weekly: 4
+    keep-monthly: 12
+    keep-yearly: 3
+    # NOTE: no `prune: true` — rest-server runs with --append-only on both
+    # sites. See README.md "Prune ceremony".
+    tag:
+      - host:nh3-docker
+    schedule: "*-*-* 03:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-forget.log
+
+  check:
+    read-data-subset: 10%
+    schedule: "Sun *-*-* 05:00:00"
+    schedule-permission: system
+    schedule-log: /var/log/restic-check.log