vh
a448699a9d
nh3-dev is the author's active dev workstation at the NH3 site
(nh3-dev.phasefinal.com). 22 GB home with 12 GB of development code,
shell history, dotfiles, Claude Code memory, and scripts that weren't
being captured by any fleet backup.
Writes site-local to the Synology rest-server (10.100.50.50:8000)
matching the nh3-docker pattern.
Excludes trim ~8 GB of regenerable caches + build outputs:
- language toolchains (.cargo, .rustup, .npm, .m2, .gradle, go/pkg, etc.)
- editor caches (.vscode-server, .vscode)
- project build directories (node_modules, __pycache__, .venv, target,
dist, build, .pytest_cache, .tox, .next, .nuxt) via `**/` patterns
- trash / browser caches / steam / snap
Expected first snapshot ~14 GB, incrementals much smaller due to
content-defined dedup across dev code.
README walks through the full setup: resticprofile install, Synology-
side htpasswd addition (via DSM File Station or Container Manager since
the DSM SSH setup is tabled), repo init, profile deploy, timer enable,
first backup. Schedule is nightly 01:00 with systemd's Persistent=true
behavior so missed runs catch up at next boot (workstation is often
off/sleeping at backup time).
README.md fleet-coverage table updated to reflect 6/6 file-level
coverage (ana-docker, ana-ml2, nh3-docker, esh-docker-vm, vm-esh-nas,
nh3-dev).
156 lines
4.8 KiB
Markdown
156 lines
4.8 KiB
Markdown
# restic / nh3-dev
|
|
|
|
**User workstation** at the NH3 site (`nh3-dev.phasefinal.com`). Not a
|
|
server — active dev machine with ~12 GB of code in `~/development` that
|
|
wasn't being captured by any fleet backup.
|
|
|
|
Writes site-local to the Synology rest-server (`10.100.50.50:8000`) as
|
|
user `nh3-dev`. Same target as nh3-docker.
|
|
|
|
## What's backed up
|
|
|
|
| Path | Purpose |
|
|
|---|---|
|
|
| `/home/lkraven` | Dev code, dotfiles, shell history, notes, Claude Code memory, scripts |
|
|
| `/etc` | Host config |
|
|
| `/root` | Root's state (ssh keys, scripts) |
|
|
|
|
## What's excluded
|
|
|
|
Roughly 8 GB of regenerable caches/build-outputs:
|
|
|
|
- Language toolchain caches: `.cache`, `.rustup`, `.cargo/registry`,
|
|
`.cargo/git`, `.npm`, `.pnpm-store`, `.m2`, `.gradle`, `.conda`,
|
|
`go/pkg`, `.dotnet`
|
|
- Editor caches: `.vscode-server`, `.vscode`
|
|
- Project build output: `node_modules`, `__pycache__`, `.venv`, `venv`,
|
|
`target`, `dist`, `build`, `.pytest_cache`, `.tox`, `.next`, `.nuxt`
|
|
- Trash, browser caches, Steam
|
|
|
|
Expected first snapshot: **~14 GB**. Incrementals should be small once
|
|
dedup kicks in.
|
|
|
|
## Deploy
|
|
|
|
### 1. Install resticprofile (restic already present)
|
|
|
|
```bash
|
|
sudo bash -c "
|
|
curl -sfL https://raw.githubusercontent.com/creativeprojects/resticprofile/master/install.sh \
|
|
| sh -s -- -b /usr/local/bin
|
|
"
|
|
/usr/local/bin/resticprofile version
|
|
```
|
|
|
|
### 2. Add `nh3-dev` entry on the Synology rest-server `.htpasswd`
|
|
|
|
The Synology-side `.htpasswd` for `rest-server-nh3` lives wherever its
|
|
DATA_DIR points (see `stacks/rest-server-nh3/README.md` — probably
|
|
`/volume1/Backup/restic/.htpasswd` or similar).
|
|
|
|
Generate the bcrypt line from this workstation using the same pattern
|
|
we used for ana side:
|
|
|
|
```bash
|
|
# Generate locally, print the hash line
|
|
docker run --rm httpd:2.4-alpine htpasswd -nbB nh3-dev "<NEW-PW>"
|
|
# Copy the output line to clipboard
|
|
```
|
|
|
|
Then append it on the Synology. Options in order of friction:
|
|
|
|
- **DSM File Station**: navigate to the restic data dir → open `.htpasswd`
|
|
in the built-in text editor → paste the line → save.
|
|
- **DSM Container Manager**: open the rest-server-nh3 container's
|
|
Terminal tab → `echo '<bcrypt-line>' >> /data/.htpasswd` (exact path
|
|
matches the container's volume mount for DATA_DIR).
|
|
- **Once SSH to the Synology is set up** (tabled earlier): ssh +
|
|
`docker exec rest-server-nh3 sh -c '...'` or direct file append.
|
|
|
|
### 3. Install restic creds on nh3-dev (local workstation)
|
|
|
|
```bash
|
|
sudo install -d -o root -g root -m 0700 /etc/restic /var/lib/restic
|
|
|
|
# REST URL
|
|
sudo bash -c "cat > /etc/restic/restic.env && chmod 600 /etc/restic/restic.env"
|
|
# paste: RESTIC_REPOSITORY=rest:http://nh3-dev:<HTPASSWD-PW>@10.100.50.50:8000/nh3-dev/
|
|
# Enter, Ctrl-D
|
|
|
|
# Passphrase (generate in password manager first, then paste)
|
|
sudo bash -c "cat > /etc/restic/password && chmod 600 /etc/restic/password"
|
|
# paste: <REPO-PASSPHRASE>
|
|
# Enter, Ctrl-D
|
|
```
|
|
|
|
### 4. Init the repo
|
|
|
|
```bash
|
|
sudo bash -c '
|
|
set -a; . /etc/restic/restic.env; set +a
|
|
restic init
|
|
'
|
|
# prompt for passphrase twice — paste the same one you just installed
|
|
```
|
|
|
|
If you get `config file already exists`, a repo was created in an earlier
|
|
session. Either use the existing passphrase (overwrite
|
|
`/etc/restic/password` with it) or wipe and reinit — same dance as we
|
|
did for ana-ml2 and esh-docker-vm.
|
|
|
|
### 5. Verify
|
|
|
|
```bash
|
|
sudo bash -c '
|
|
set -a; . /etc/restic/restic.env; set +a
|
|
RESTIC_PASSWORD_FILE=/etc/restic/password restic snapshots
|
|
'
|
|
# expect: no snapshots found
|
|
```
|
|
|
|
### 6. Deploy profile
|
|
|
|
```bash
|
|
sudo install -o root -g root -m 0644 \
|
|
/home/lkraven/development/eshpfi-management/configs/restic/nh3-dev/profiles.yaml \
|
|
/etc/restic/profiles.yaml
|
|
|
|
sudo resticprofile --config /etc/restic/profiles.yaml show
|
|
```
|
|
|
|
### 7. Schedule + first backup
|
|
|
|
```bash
|
|
sudo resticprofile --config /etc/restic/profiles.yaml schedule --all
|
|
systemctl list-timers "resticprofile*"
|
|
|
|
# First backup — this will take a while (14 GB, initial dedup work)
|
|
sudo resticprofile --config /etc/restic/profiles.yaml backup --verbose
|
|
```
|
|
|
|
Expect the first run to take 5-15 minutes depending on NH3 LAN speed
|
|
and how much of `/home/lkraven/development` has high-entropy
|
|
(compressed) content.
|
|
|
|
## Restoring
|
|
|
|
```bash
|
|
sudo bash -c '
|
|
set -a; . /etc/restic/restic.env; set +a
|
|
RESTIC_PASSWORD_FILE=/etc/restic/password \
|
|
restic restore --target /tmp/restore latest --path /home/lkraven/development
|
|
'
|
|
```
|
|
|
|
## Watch items after first run
|
|
|
|
- **First snapshot size** — if much above 14 GB, something large slipped
|
|
past excludes. Inspect with `restic stats latest --host nh3-dev`.
|
|
- **Schedule catches missed runs** — the workstation is frequently off at
|
|
01:00. systemd's `Persistent=true` (resticprofile sets this by default
|
|
for system-level schedules) catches up after boot. After a few days of
|
|
normal use, confirm timer history with:
|
|
```bash
|
|
journalctl -u "resticprofile-backup@profile-default.service" --no-pager -n 20
|
|
```
|