# resticprofile config for esh-vm-db.
#
# Two-database host (Postgres 15 on :5432, MongoDB on :27017). Small
# VM on an ESH hypervisor; backed up at VM-image level by PBS-ANA via
# its hypervisor. This restic profile captures:
#
#   1. Host config (/etc, /root) — fast config recovery without
#      waiting for VM-image restore
#   2. Per-DB dumps via pre-backup hook — pg_dumpall + mongodump,
#      written to /var/lib/restic/stage/ and included in the restic
#      snapshot. Gives us DB-level restore granularity alongside the
#      VM-image restore from PBS.
#
# What's DELIBERATELY NOT in source:
#   - /var/lib/postgresql — raw live PGDATA. Inconsistent if captured
#     while postgres is running; pg_dumpall above covers this.
#   - /var/lib/mongodb — same reasoning; mongodump covers it.
#
# Writes cross-site to rest-server-ana (10.250.50.70:8000). No local
# NH3-style rest-server on the ESH side; esh-docker-vm and vm-esh-nas
# also use rest-server-ana, so this follows fleet pattern.

version: "1"

global:
  priority: low
  ionice: true
  ionice-class: 2
  ionice-level: 7
  min-memory: 100

default:
  env-file: /etc/restic/restic.env
  env:
    RESTIC_PASSWORD_FILE: /etc/restic/password
  initialize: false
  lock: /var/lock/restic-esh-vm-db.lock

  backup:
    verbose: 1
    run-before:
      - /etc/restic/pre-backup.sh
    run-after:
      - date +%s > /var/lib/restic/last-success
    source:
      - /etc                   # host config
      - /root                  # root's scripts, ssh keys, shell history
      - /home                  # user home dirs
      - /var/lib/restic/stage  # pg_dumpall + mongodump outputs from pre-backup
    exclude:
      # Raw DB data is captured via pre-backup dumps, not volume-level
      - /var/lib/postgresql
      - /var/lib/mongodb
      # NFS mount from esh-nas (backup target for other stacks — not ours to mirror)
      - /mnt/backup
      # Ephemeral / regenerable
      - "**/*.log"
      - "**/*.log.*"
      - "**/*.pid"
      - /root/.cache
      - /root/.local/share/Trash
      - /root/.npm
      - /root/.python_history
      - /home/*/.cache
      - /home/*/.local/share/Trash
      - /home/*/.npm
    tag:
      - host:esh-vm-db
      - site:esh
      - fleet:home-lab
    schedule: "*-*-* 01:00:00"
    schedule-permission: system
    schedule-log: /var/log/restic-backup.log

  forget:
    keep-daily: 7
    keep-weekly: 4
    keep-monthly: 12
    keep-yearly: 3
    tag:
      - host:esh-vm-db
    # Schedule removed: forget against --append-only rest-server always
    # fails (delete ops blocked). Run manually during prune ceremony.

  check:
    read-data-subset: 10%
    schedule: "Sun *-*-* 05:00:00"
    schedule-permission: system
    schedule-log: /var/log/restic-check.log