# resticprofile config for esh-docker-vm.
#
# ESH home-lab Docker host — VM on esh-pve. Covered by vzdump at the
# hypervisor (3/3 on esh-pve after the VM 108 retirement), and by this
# file-level restic for fast per-file restore + app-consistent DB dumps.
#
# Writes cross-site to rest-server-ana (10.250.50.70:8000/esh-docker-vm/)
# because the ESH site has no local rest-server.
#
# Multiple DB-bearing services live here (see pre-backup.sh). Several
# containers don't bundle sqlite3, so the pre-backup script runs
# sqlite3 and pg_dump from the HOST against volume bind-mount paths
# (simpler than building custom container images).

version: "1"

global:
  priority: low
  ionice: true
  ionice-class: 2
  ionice-level: 7
  min-memory: 100

default:
  repository-file: /etc/restic/repository  # URL incl. rest-server creds (root 0400).
  # NOT env-file: `resticprofile schedule` copies env-file values into the
  # world-readable systemd units (docs/runbooks/backups.md, Known gaps).
  env:
    RESTIC_PASSWORD_FILE: /etc/restic/password
  initialize: false
  lock: /var/lock/restic-esh-docker-vm.lock

  backup:
    verbose: 1
    run-before:
      - /etc/restic/pre-backup.sh
    run-after:
      - date +%s > /var/lib/restic/last-success
    source:
      - /opt/docker              # compose files + bind-mount conf (~12 MB)
      - /etc                     # host config
      - /root                    # root's ad-hoc scripts, ssh keys, history
      - /home                    # user home dirs
      - /var/lib/docker/volumes  # HA, paperless, pgadmin, CWA, dockge, etc.
      - /var/lib/restic/stage    # DB dumps produced by pre-backup.sh
    exclude:
      # CRITICAL: NFS mounts from 10.0.50.50 — hundreds of GB / TB at least.
      # /mnt/backup specifically holds offen-sidecar tarballs which are
      # redundant once restic is authoritative.
      - /mnt/backup
      - /mnt/books
      - /mnt/compose
      - /mnt/documents
      # Docker internals
      - /var/lib/docker/volumes/backingFsBlockDev
      - /var/lib/docker/volumes/metadata.db
      # Offen `*_offen_backup_data` exclude removed 2026-04-23 — offen
      # sidecars retired fleet-wide; no more offen-scratch volumes exist.
      # Ephemeral / regenerable
      - /opt/docker/compose/*/logs
      # ESPHome PlatformIO toolchain + build artifacts (added 2026-09-14 with
      # the config relocation). The CONFIG is 5 files / 3 KB and is the whole
      # point of pulling this dir into coverage; these two subtrees are 539 MB
      # of regenerable cache -- a 45x inflation of the /opt/docker source,
      # which this profile's own comment budgets at ~12 MB. PlatformIO
      # re-downloads them on demand.
      - /opt/docker/conf/esphome/.esphome/platformio
      - /opt/docker/conf/esphome/.esphome/build
      - "**/*.log"
      - "**/*.log.*"
      - "**/*.pid"
      # Per-user shell / app noise
      - /root/.cache
      - /root/.local/share/Trash
      - /root/.python_history
      - /home/*/.cache
      - /home/*/.local/share/Trash
      - /home/*/.npm
      - /home/*/.mozilla/firefox/*/Cache
    tag:
      - host:esh-docker-vm
      - site:esh
      - fleet:home-lab
    schedule: "*-*-* 01:00:00"
    schedule-permission: system
    schedule-log: /var/log/restic-backup.log

  forget:
    keep-daily: 7
    keep-weekly: 4
    keep-monthly: 12
    keep-yearly: 3
    tag:
      - host:esh-docker-vm
    # Schedule removed 2026-04-21: forget against --append-only rest-server
    # always fails (delete ops blocked). Run manually during the prune
    # ceremony when --append-only is temporarily off.

  check:
    read-data-subset: 10%
    schedule: "Sun *-*-* 05:00:00"
    schedule-permission: system
    schedule-log: /var/log/restic-check.log