vh
1e24e0f799
Closes the last file-level backup gap. Primary ESH home-lab Docker host
— five services with state worth consistent dumps:
- paperless-ngx → external Postgres on 10.0.50.60 (host pg_dump)
- home-assistant → local SQLite ~50MB (host sqlite3 .backup)
- calibre-web-automated → local SQLite (in-container sqlite3)
- pgadmin → local SQLite (host sqlite3)
- uptime-kuma → local SQLite (host sqlite3; container name may vary
after force-recreate, detect by label)
Unique to this host: HA/pgadmin/uptime-kuma images don't bundle sqlite3.
Rather than maintaining custom images, pre-backup.sh runs sqlite3 from
the HOST against the volume bind-mount paths. Requires sqlite3 +
postgresql-client installed on esh-docker-vm.
Cross-site writes to rest-server-ana since ESH has no local rest-server.
NFS mounts (/mnt/{backup,books,compose,documents}) explicitly excluded
— hundreds of GB of NAS-side content backed up at the NAS layer. Also
excludes offen-sidecar buffer volumes (paperless + pgadmin currently
run offen/docker-volume-backup alongside — retire once restic has a
week of clean runs).
Found in audit (non-blocking but noted in README follow-ups):
- paperless-ngx Postgres password is literally "paperless-ng" —
trivially weak, rotate at next opportunity.
94 lines
2.8 KiB
YAML
94 lines
2.8 KiB
YAML
# resticprofile config for esh-docker-vm.
|
|
#
|
|
# ESH home-lab Docker host — VM on esh-pve. Covered by vzdump at the
|
|
# hypervisor (3/3 on esh-pve after the VM 108 retirement), and by this
|
|
# file-level restic for fast per-file restore + app-consistent DB dumps.
|
|
#
|
|
# Writes cross-site to rest-server-ana (10.250.50.70:8000/esh-docker-vm/)
|
|
# because the ESH site has no local rest-server.
|
|
#
|
|
# Multiple DB-bearing services live here (see pre-backup.sh). Several
|
|
# containers don't bundle sqlite3, so the pre-backup script runs
|
|
# sqlite3 and pg_dump from the HOST against volume bind-mount paths
|
|
# (simpler than building custom container images).
|
|
|
|
version: "1"
|
|
|
|
global:
|
|
priority: low
|
|
ionice: true
|
|
ionice-class: 2
|
|
ionice-level: 7
|
|
min-memory: 100
|
|
|
|
default:
|
|
env-file: /etc/restic/restic.env
|
|
env:
|
|
RESTIC_PASSWORD_FILE: /etc/restic/password
|
|
initialize: false
|
|
lock: /var/lock/restic-esh-docker-vm.lock
|
|
|
|
backup:
|
|
verbose: 1
|
|
run-before:
|
|
- /etc/restic/pre-backup.sh
|
|
run-after:
|
|
- date +%s > /var/lib/restic/last-success
|
|
source:
|
|
- /opt/docker # compose files + bind-mount conf (~12 MB)
|
|
- /etc # host config
|
|
- /root # root's ad-hoc scripts, ssh keys, history
|
|
- /home # user home dirs
|
|
- /var/lib/docker/volumes # HA, paperless, pgadmin, CWA, dockge, etc.
|
|
- /var/lib/restic/stage # DB dumps produced by pre-backup.sh
|
|
exclude:
|
|
# CRITICAL: NFS mounts from 10.0.50.50 — hundreds of GB / TB at least.
|
|
# /mnt/backup specifically holds offen-sidecar tarballs which are
|
|
# redundant once restic is authoritative.
|
|
- /mnt/backup
|
|
- /mnt/books
|
|
- /mnt/compose
|
|
- /mnt/documents
|
|
# Docker internals
|
|
- /var/lib/docker/volumes/backingFsBlockDev
|
|
- /var/lib/docker/volumes/metadata.db
|
|
# Offen sidecar's buffer / tmp (if any left behind)
|
|
- /var/lib/docker/volumes/*_offen_backup_data
|
|
# Ephemeral / regenerable
|
|
- /opt/docker/compose/*/logs
|
|
- "**/*.log"
|
|
- "**/*.log.*"
|
|
- "**/*.pid"
|
|
# Per-user shell / app noise
|
|
- /root/.cache
|
|
- /root/.local/share/Trash
|
|
- /root/.python_history
|
|
- /home/*/.cache
|
|
- /home/*/.local/share/Trash
|
|
- /home/*/.npm
|
|
- /home/*/.mozilla/firefox/*/Cache
|
|
tag:
|
|
- host:esh-docker-vm
|
|
- site:esh
|
|
- fleet:home-lab
|
|
schedule: "*-*-* 01:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-backup.log
|
|
|
|
forget:
|
|
keep-daily: 7
|
|
keep-weekly: 4
|
|
keep-monthly: 12
|
|
keep-yearly: 3
|
|
tag:
|
|
- host:esh-docker-vm
|
|
schedule: "*-*-* 03:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-forget.log
|
|
|
|
check:
|
|
read-data-subset: 10%
|
|
schedule: "Sun *-*-* 05:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-check.log
|