vh
d0c4e46e73
ana-ml2 is not on any Proxmox hypervisor, so vzdump doesn't touch it. This closes the biggest single backup gap per the 2026-04-20 pipeline audit. Sources: /opt/docker (~110 MB), /etc, /root, /var/lib/docker/volumes. Excludes /tank/* (model weights — regenerable from Hugging Face and would blow repo size budget). No pre-backup DB hook — none of the llama-swap / vllm / comfyui / kokoro / parakeet / vibevoice stacks use relational databases. README walks through the one-time setup: rest-server .htpasswd entry, restic init with fresh passphrase, resticprofile install, systemd timer generation, verification against the Backrest UI.
83 lines
2.7 KiB
YAML
83 lines
2.7 KiB
YAML
# resticprofile config for ana-ml2.
|
|
#
|
|
# **Bare metal** — not protected by any Proxmox vzdump. This is the only
|
|
# backup for this host's config/state, so it's the highest-stakes repo in
|
|
# the fleet. Writes to the Anaheim rest-server at 10.250.50.70 as user
|
|
# `ana-ml2`. The full REST URL (with HTTP basic auth creds) lives in
|
|
# /etc/restic/restic.env. The client-side encryption passphrase lives in
|
|
# /etc/restic/password.
|
|
#
|
|
# Notable exclusions:
|
|
# - /tank/* is NOT in source paths. That's ~TB of model weights (HF
|
|
# caches, llama.cpp GGUFs, ComfyUI models, etc.) — all regenerable
|
|
# from upstream. Backing them up would blow the repo size budget.
|
|
# - No DB dumps needed. None of the stacks on this host (llama-swap,
|
|
# vllm-qwen3, comfyui, kokoro, parakeet, vibevoice, beszel-agent,
|
|
# dozzle-agent, dockge) store relational data.
|
|
|
|
version: "1"
|
|
|
|
global:
|
|
priority: low
|
|
ionice: true
|
|
ionice-class: 2
|
|
ionice-level: 7
|
|
min-memory: 100
|
|
|
|
default:
|
|
env-file: /etc/restic/restic.env # RESTIC_REPOSITORY=rest:http://user:pw@…
|
|
env:
|
|
RESTIC_PASSWORD_FILE: /etc/restic/password
|
|
initialize: false # repo created manually by `restic init`
|
|
lock: /var/lock/restic-ana-ml2.lock
|
|
|
|
backup:
|
|
verbose: 1
|
|
run-after:
|
|
- date +%s > /var/lib/restic/last-success
|
|
source:
|
|
- /opt/docker # compose files + host-level configs — small (~100MB)
|
|
- /etc # host config (systemd units, chrony, apparmor, ssh, etc.)
|
|
- /root # root shell history, ssh keys, any ad-hoc scripts
|
|
- /var/lib/docker/volumes # named volumes (small; models live on /tank, not here)
|
|
exclude:
|
|
# Docker internals we never want in a backup
|
|
- /var/lib/docker/volumes/backingFsBlockDev
|
|
- /var/lib/docker/volumes/metadata.db
|
|
# Ephemeral / regenerable junk
|
|
- /opt/docker/compose/*/logs
|
|
- "**/*.log"
|
|
- "**/*.log.*"
|
|
- "**/*.pid"
|
|
# Root's noise — shell caches, tmp
|
|
- /root/.cache
|
|
- /root/.local/share/Trash
|
|
- /root/.npm
|
|
- /root/.python_history
|
|
tag:
|
|
- host:ana-ml2
|
|
- site:ana
|
|
- fleet:pfi
|
|
schedule: "*-*-* 01:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-backup.log
|
|
|
|
forget:
|
|
keep-daily: 7
|
|
keep-weekly: 4
|
|
keep-monthly: 12
|
|
keep-yearly: 3
|
|
# NOTE: no `prune: true` — rest-server runs with --append-only.
|
|
# See README.md "Prune ceremony".
|
|
tag:
|
|
- host:ana-ml2
|
|
schedule: "*-*-* 03:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-forget.log
|
|
|
|
check:
|
|
read-data-subset: 10%
|
|
schedule: "Sun *-*-* 05:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-check.log
|