# restic / nh3-dev

**User workstation** at the NH3 site (`nh3-dev.phasefinal.com`). Not a
server — active dev machine with ~12 GB of code in `~/development` that
wasn't being captured by any fleet backup.

Writes site-local to the Synology rest-server (`10.100.50.50:8000`) as
user `nh3-dev`. Same target as nh3-docker.

## What's backed up

| Path | Purpose |
|---|---|
| `/home/lkraven` | Dev code, dotfiles, shell history, notes, Claude Code memory, scripts |
| `/etc` | Host config |
| `/root` | Root's state (ssh keys, scripts) |

## What's excluded

Roughly 8 GB of regenerable caches/build-outputs:

- Language toolchain caches: `.cache`, `.rustup`, `.cargo/registry`,
  `.cargo/git`, `.npm`, `.pnpm-store`, `.m2`, `.gradle`, `.conda`,
  `go/pkg`, `.dotnet`
- Editor caches: `.vscode-server`, `.vscode`
- Project build output: `node_modules`, `__pycache__`, `.venv`, `venv`,
  `target`, `dist`, `build`, `.pytest_cache`, `.tox`, `.next`, `.nuxt`
- Trash, browser caches, Steam

Expected first snapshot: **~14 GB**. Incrementals should be small once
dedup kicks in.

## Deploy

### 1. Install resticprofile (restic already present)

```bash
sudo bash -c "
  curl -sfL https://raw.githubusercontent.com/creativeprojects/resticprofile/master/install.sh \
    | sh -s -- -b /usr/local/bin
"
/usr/local/bin/resticprofile version
```

### 2. Add `nh3-dev` entry on the Synology rest-server `.htpasswd`

The Synology-side `.htpasswd` for `rest-server-nh3` lives wherever its
DATA_DIR points (see `stacks/rest-server-nh3/README.md` — probably
`/volume1/Backup/restic/.htpasswd` or similar).

Generate the bcrypt line from this workstation using the same pattern
we used for ana side:

```bash
# Generate locally, print the hash line
docker run --rm httpd:2.4-alpine htpasswd -nbB nh3-dev "<NEW-PW>"
# Copy the output line to clipboard
```

Then append it on the Synology. Options in order of friction:

- **DSM File Station**: navigate to the restic data dir → open `.htpasswd`
  in the built-in text editor → paste the line → save.
- **DSM Container Manager**: open the rest-server-nh3 container's
  Terminal tab → `echo '<bcrypt-line>' >> /data/.htpasswd` (exact path
  matches the container's volume mount for DATA_DIR).
- **Once SSH to the Synology is set up** (tabled earlier): ssh +
  `docker exec rest-server-nh3 sh -c '...'` or direct file append.

### 3. Install restic creds on nh3-dev (local workstation)

```bash
sudo install -d -o root -g root -m 0700 /etc/restic /var/lib/restic

# REST URL
sudo bash -c "cat > /etc/restic/restic.env && chmod 600 /etc/restic/restic.env"
# paste: RESTIC_REPOSITORY=rest:http://nh3-dev:<HTPASSWD-PW>@10.100.50.50:8000/nh3-dev/
# Enter, Ctrl-D

# Passphrase (generate in password manager first, then paste)
sudo bash -c "cat > /etc/restic/password && chmod 600 /etc/restic/password"
# paste: <REPO-PASSPHRASE>
# Enter, Ctrl-D
```

### 4. Init the repo

```bash
sudo bash -c '
  set -a; . /etc/restic/restic.env; set +a
  restic init
'
# prompt for passphrase twice — paste the same one you just installed
```

If you get `config file already exists`, a repo was created in an earlier
session. Either use the existing passphrase (overwrite
`/etc/restic/password` with it) or wipe and reinit — same dance as we
did for ana-ml2 and esh-docker-vm.

### 5. Verify

```bash
sudo bash -c '
  set -a; . /etc/restic/restic.env; set +a
  RESTIC_PASSWORD_FILE=/etc/restic/password restic snapshots
'
# expect: no snapshots found
```

### 6. Deploy profile

```bash
sudo install -o root -g root -m 0644 \
  /home/lkraven/development/eshpfi-management/configs/restic/nh3-dev/profiles.yaml \
  /etc/restic/profiles.yaml

sudo resticprofile --config /etc/restic/profiles.yaml show
```

### 7. Schedule + first backup

```bash
sudo resticprofile --config /etc/restic/profiles.yaml schedule --all
systemctl list-timers "resticprofile*"

# First backup — this will take a while (14 GB, initial dedup work)
sudo resticprofile --config /etc/restic/profiles.yaml backup --verbose
```

Expect the first run to take 5-15 minutes depending on NH3 LAN speed
and how much of `/home/lkraven/development` has high-entropy
(compressed) content.

## Restoring

```bash
sudo bash -c '
  set -a; . /etc/restic/restic.env; set +a
  RESTIC_PASSWORD_FILE=/etc/restic/password \
    restic restore --target /tmp/restore latest --path /home/lkraven/development
'
```

## Watch items after first run

- **First snapshot size** — if much above 14 GB, something large slipped
  past excludes. Inspect with `restic stats latest --host nh3-dev`.
- **Schedule catches missed runs** — the workstation is frequently off at
  01:00. systemd's `Persistent=true` (resticprofile sets this by default
  for system-level schedules) catches up after boot. After a few days of
  normal use, confirm timer history with:
  ```bash
  journalctl -u "resticprofile-backup@profile-default.service" --no-pager -n 20
  ```