# resticprofile config for vm-esh-nas.
#
# Second ESH Docker host (filezilla, dockge, agents). VM on esh-pve-nas.
# Covered by vzdump at the hypervisor level; this restic adds per-file
# restore + cross-site redundancy.
#
# Writes cross-site to the Anaheim rest-server (10.250.50.70:8000/vm-esh-nas/)
# because the ESH site has no local rest-server. Credentials live in
# /etc/restic/restic.env; passphrase in /etc/restic/password.
#
# Explicit NFS exclusions below are **critical** — this host mounts
# /mnt/{share,music,books,media} from 10.0.50.50 (hundreds of TB of
# media). They're not in the source list, but the exclude-patterns
# provide a second line of defense if the source list is ever edited
# carelessly.
#
# No DB hook needed: no relational databases on this host. Dockge /
# beszel-agent / dozzle-agent store trivial SQLite state captured raw.

version: "1"

global:
  priority: low
  ionice: true
  ionice-class: 2
  ionice-level: 7
  min-memory: 100

default:
  env-file: /etc/restic/restic.env
  env:
    RESTIC_PASSWORD_FILE: /etc/restic/password
  initialize: false
  lock: /var/lock/restic-vm-esh-nas.lock

  backup:
    verbose: 1
    run-after:
      - date +%s > /var/lib/restic/last-success
    source:
      - /opt/docker              # compose files (~56 KB)
      - /etc                     # host config
      - /root                    # root's scripts, ssh keys, shell history
      - /home                    # user home dirs (lkraven, nas, user)
      - /var/lib/docker/volumes  # beszel-agent, dozzle-agent, dockge state
    exclude:
      # CRITICAL: NFS mounts from 10.0.50.50 — never follow.
      # These are in /mnt/, not in the source list, but pattern exclude
      # protects against careless source edits.
      - /mnt/share
      - /mnt/music
      - /mnt/books
      - /mnt/media
      # Docker internals
      - /var/lib/docker/volumes/backingFsBlockDev
      - /var/lib/docker/volumes/metadata.db
      # Ephemeral / regenerable
      - /opt/docker/compose/*/logs
      - "**/*.log"
      - "**/*.log.*"
      - "**/*.pid"
      # Per-user shell / app noise
      - /root/.cache
      - /root/.local/share/Trash
      - /root/.python_history
      - /home/*/.cache
      - /home/*/.local/share/Trash
      - /home/*/.npm
      - /home/*/.mozilla/firefox/*/Cache
    tag:
      - host:vm-esh-nas
      - site:esh
      - fleet:home-lab
    schedule: "*-*-* 01:00:00"
    schedule-permission: system
    schedule-log: /var/log/restic-backup.log

  forget:
    keep-daily: 7
    keep-weekly: 4
    keep-monthly: 12
    keep-yearly: 3
    tag:
      - host:vm-esh-nas
    # Schedule removed 2026-04-21: forget against --append-only rest-server
    # always fails (delete ops blocked). Run manually during the prune
    # ceremony when --append-only is temporarily off.

  check:
    read-data-subset: 10%
    schedule: "Sun *-*-* 05:00:00"
    schedule-permission: system
    schedule-log: /var/log/restic-check.log