# resticprofile config for nh3-docker.
#
# nh3-docker is a VM on nh3-pve, so its disk image IS captured by vzdump
# at the hypervisor layer. This file-level restic is additive: it gives
# fast per-file restore without mounting the VM image, and ships to the
# site-local rest-server for location-resilient recovery.
#
# Writes to the Synology rest-server at 10.100.50.50:8000 as user
# `nh3-docker`. The full REST URL (with HTTP basic-auth creds) lives in
# /etc/restic/restic.env. The client-side encryption passphrase lives in
# /etc/restic/password.
#
# No DB dumps needed. None of the stacks on this host (adguard, dockge,
# beszel-agent, dozzle-agent, portainer) run a relational DB — AdGuard
# stores config as YAML, the rest use tiny SQLite state in their volumes
# which restic captures raw (WAL-mode SQLite recovers cleanly).

version: "1"

global:
  priority: low
  ionice: true
  ionice-class: 2
  ionice-level: 7
  min-memory: 100

default:
  env-file: /etc/restic/restic.env          # RESTIC_REPOSITORY=rest:http://user:pw@…
  env:
    RESTIC_PASSWORD_FILE: /etc/restic/password
  initialize: false                         # repo created manually by `restic init`
  lock: /var/lock/restic-nh3-docker.lock

  backup:
    verbose: 1
    run-after:
      - date +%s > /var/lib/restic/last-success
    source:
      - /opt/docker              # compose files (~1.6 MB on this host)
      - /etc                     # host config (systemd, adguard upstream config, etc.)
      - /root                    # root shell history, ssh keys, ad-hoc scripts
      - /var/lib/docker/volumes  # adguard config, agent state, dockge state, etc.
    exclude:
      - /var/lib/docker/volumes/backingFsBlockDev
      - /var/lib/docker/volumes/metadata.db
      - /opt/docker/compose/*/logs
      - "**/*.log"
      - "**/*.log.*"
      - "**/*.pid"
      - /root/.cache
      - /root/.local/share/Trash
      - /root/.npm
      - /root/.python_history
    tag:
      - host:nh3-docker
      - site:nh3
      - fleet:pfi
    schedule: "*-*-* 01:00:00"
    schedule-permission: system
    schedule-log: /var/log/restic-backup.log

  forget:
    keep-daily: 7
    keep-weekly: 4
    keep-monthly: 12
    keep-yearly: 3
    # NOTE: no `prune: true` — rest-server runs with --append-only on both
    # sites. See README.md "Prune ceremony".
    tag:
      - host:nh3-docker
    # Schedule removed 2026-04-21: forget against --append-only rest-server
    # always fails (delete ops blocked). Run manually during the prune
    # ceremony when --append-only is temporarily off.

  check:
    read-data-subset: 10%
    schedule: "Sun *-*-* 05:00:00"
    schedule-permission: system
    schedule-log: /var/log/restic-check.log