esh-pfi-infrastructure/configs/restic/nh3-dev/README.md

restic / nh3-dev

User workstation at the NH3 site (nh3-dev.phasefinal.com). Not a server — active dev machine with ~12 GB of code in ~/development that wasn't being captured by any fleet backup.

Writes site-local to the Synology rest-server (10.100.50.50:8000) as user nh3-dev. Same target as nh3-docker.

What's backed up

Path	Purpose
/home/lkraven	Dev code, dotfiles, shell history, notes, Claude Code memory, scripts
/etc	Host config
/root	Root's state (ssh keys, scripts)

What's excluded

Roughly 8 GB of regenerable caches/build-outputs:

• Language toolchain caches: .cache, .rustup, .cargo/registry, .cargo/git, .npm, .pnpm-store, .m2, .gradle, .conda, go/pkg, .dotnet
• Editor caches: .vscode-server, .vscode
• Project build output: node_modules, __pycache__, .venv, venv, target, dist, build, .pytest_cache, .tox, .next, .nuxt
• Trash, browser caches, Steam

Expected first snapshot: ~14 GB. Incrementals should be small once dedup kicks in.

Deploy

1. Install resticprofile (restic already present)

sudo bash -c "
  curl -sfL https://raw.githubusercontent.com/creativeprojects/resticprofile/master/install.sh \
    | sh -s -- -b /usr/local/bin
"
/usr/local/bin/resticprofile version

2. Add nh3-dev entry on the Synology rest-server .htpasswd

The Synology-side .htpasswd for rest-server-nh3 lives wherever its DATA_DIR points (see stacks/rest-server-nh3/README.md — probably /volume1/Backup/restic/.htpasswd or similar).

Generate the bcrypt line from this workstation using the same pattern we used for ana side:

# Generate locally, print the hash line
docker run --rm httpd:2.4-alpine htpasswd -nbB nh3-dev "<NEW-PW>"
# Copy the output line to clipboard

Then append it on the Synology. Options in order of friction:

• DSM File Station: navigate to the restic data dir → open .htpasswd in the built-in text editor → paste the line → save.
• DSM Container Manager: open the rest-server-nh3 container's Terminal tab → echo '<bcrypt-line>' >> /data/.htpasswd (exact path matches the container's volume mount for DATA_DIR).
• Once SSH to the Synology is set up (tabled earlier): ssh + docker exec rest-server-nh3 sh -c '...' or direct file append.

3. Install restic creds on nh3-dev (local workstation)

sudo install -d -o root -g root -m 0700 /etc/restic /var/lib/restic

# REST URL
sudo bash -c "cat > /etc/restic/restic.env && chmod 600 /etc/restic/restic.env"
# paste: RESTIC_REPOSITORY=rest:http://nh3-dev:<HTPASSWD-PW>@10.100.50.50:8000/nh3-dev/
# Enter, Ctrl-D

# Passphrase (generate in password manager first, then paste)
sudo bash -c "cat > /etc/restic/password && chmod 600 /etc/restic/password"
# paste: <REPO-PASSPHRASE>
# Enter, Ctrl-D

4. Init the repo

sudo bash -c '
  set -a; . /etc/restic/restic.env; set +a
  restic init
'
# prompt for passphrase twice — paste the same one you just installed

If you get config file already exists, a repo was created in an earlier session. Either use the existing passphrase (overwrite /etc/restic/password with it) or wipe and reinit — same dance as we did for ana-ml2 and esh-docker-vm.

5. Verify

sudo bash -c '
  set -a; . /etc/restic/restic.env; set +a
  RESTIC_PASSWORD_FILE=/etc/restic/password restic snapshots
'
# expect: no snapshots found

6. Deploy profile

sudo install -o root -g root -m 0644 \
  /home/lkraven/development/eshpfi-management/configs/restic/nh3-dev/profiles.yaml \
  /etc/restic/profiles.yaml

sudo resticprofile --config /etc/restic/profiles.yaml show

7. Schedule + first backup

sudo resticprofile --config /etc/restic/profiles.yaml schedule --all
systemctl list-timers "resticprofile*"

# First backup — this will take a while (14 GB, initial dedup work)
sudo resticprofile --config /etc/restic/profiles.yaml backup --verbose

Expect the first run to take 5-15 minutes depending on NH3 LAN speed and how much of /home/lkraven/development has high-entropy (compressed) content.

Restoring

sudo bash -c '
  set -a; . /etc/restic/restic.env; set +a
  RESTIC_PASSWORD_FILE=/etc/restic/password \
    restic restore --target /tmp/restore latest --path /home/lkraven/development
'

Watch items after first run

• First snapshot size — if much above 14 GB, something large slipped past excludes. Inspect with restic stats latest --host nh3-dev.
• Schedule catches missed runs — the workstation is frequently off at 01:00. systemd's Persistent=true (resticprofile sets this by default for system-level schedules) catches up after boot. After a few days of normal use, confirm timer history with:

  journalctl -u "resticprofile-backup@profile-default.service" --no-pager -n 20