vh
76a0768fdb
Forget against an --append-only rest-server fails every night (delete ops blocked). The resulting daily failure cluttered service status and logs without ever actually retiring old snapshots. Schedule is now removed from the forget block in all six profiles; the keep-daily / keep-weekly / keep-monthly / keep-yearly policy remains so manual invocations (during prune ceremonies, when --append-only is temporarily off) honor the intended retention. Files: configs/restic/ana-docker/profiles.yaml configs/restic/ana-ml2/profiles.yaml configs/restic/nh3-docker/profiles.yaml configs/restic/esh-docker-vm/profiles.yaml configs/restic/vm-esh-nas/profiles.yaml configs/restic/nh3-dev/profiles.yaml Each file has an inline comment marking why the schedule was dropped so a future reader doesn't re-add it thinking it was an oversight. STATUS.md: removed the "install Backrest nightly-restart timer" line item. User confirmed the UI timeout hits even at startup, so periodic restart wouldn't actually help. Root cause remains deferred.
77 lines
2.4 KiB
YAML
77 lines
2.4 KiB
YAML
# resticprofile config for ana-docker.
|
|
#
|
|
# Writes to the Anaheim-side rest-server at 10.250.50.70 as user
|
|
# `ana-docker`. The full REST URL (including HTTP basic-auth creds)
|
|
# lives in /etc/restic/restic.env — loaded via env-file so this YAML
|
|
# carries zero secrets and is safe to version-control.
|
|
#
|
|
# The client-side encryption passphrase lives in /etc/restic/password.
|
|
|
|
version: "1"
|
|
|
|
global:
|
|
priority: low
|
|
ionice: true
|
|
ionice-class: 2
|
|
ionice-level: 7
|
|
min-memory: 100
|
|
|
|
default:
|
|
env-file: /etc/restic/restic.env # provides RESTIC_REPOSITORY=rest:http://user:pw@…
|
|
env:
|
|
RESTIC_PASSWORD_FILE: /etc/restic/password
|
|
initialize: false # repo was created by `restic init`
|
|
lock: /var/lock/restic-ana-docker.lock
|
|
|
|
backup:
|
|
verbose: 1
|
|
run-before:
|
|
- /etc/restic/pre-backup.sh
|
|
run-after:
|
|
- date +%s > /var/lib/restic/last-success
|
|
source:
|
|
- /opt/docker
|
|
- /var/lib/docker/volumes
|
|
- /var/lib/restic/stage
|
|
exclude:
|
|
# Docker internals we never want in a backup
|
|
- /var/lib/docker/volumes/backingFsBlockDev
|
|
- /var/lib/docker/volumes/metadata.db
|
|
# Raw DB files — we dump them via pre-backup.sh into /var/lib/restic/stage
|
|
- /var/lib/docker/volumes/synapse-db-data
|
|
- /var/lib/docker/volumes/synapse_synapse-db-data
|
|
- /var/lib/docker/volumes/seafile_db
|
|
# Ephemeral / regenerable junk
|
|
- /opt/docker/compose/*/logs
|
|
- /opt/docker/conf/traefik-ana/acme.json # secret material; excluded everywhere
|
|
- /opt/docker/conf/crowdsec/hub # upstream-managed, regenerable
|
|
- "**/*.log"
|
|
- "**/*.log.*"
|
|
- "**/*.pid"
|
|
tag:
|
|
- host:ana-docker
|
|
- site:ana
|
|
- fleet:pfi
|
|
schedule: "*-*-* 01:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-backup.log
|
|
|
|
forget:
|
|
keep-daily: 7
|
|
keep-weekly: 4
|
|
keep-monthly: 12
|
|
keep-yearly: 3
|
|
# NOTE: no `prune: true` — rest-server runs with --append-only, which
|
|
# blocks the destructive half of prune. See README.md "Prune ceremony".
|
|
tag:
|
|
- host:ana-docker
|
|
# Schedule removed 2026-04-21: forget against --append-only rest-server
|
|
# always fails (delete ops blocked). Run manually during the prune
|
|
# ceremony when --append-only is temporarily off.
|
|
|
|
check:
|
|
read-data-subset: 10%
|
|
schedule: "Sun *-*-* 05:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-check.log
|