vh
76a0768fdb
Forget against an --append-only rest-server fails every night (delete ops blocked). The resulting daily failure cluttered service status and logs without ever actually retiring old snapshots. Schedule is now removed from the forget block in all six profiles; the keep-daily / keep-weekly / keep-monthly / keep-yearly policy remains so manual invocations (during prune ceremonies, when --append-only is temporarily off) honor the intended retention. Files: configs/restic/ana-docker/profiles.yaml configs/restic/ana-ml2/profiles.yaml configs/restic/nh3-docker/profiles.yaml configs/restic/esh-docker-vm/profiles.yaml configs/restic/vm-esh-nas/profiles.yaml configs/restic/nh3-dev/profiles.yaml Each file has an inline comment marking why the schedule was dropped so a future reader doesn't re-add it thinking it was an oversight. STATUS.md: removed the "install Backrest nightly-restart timer" line item. User confirmed the UI timeout hits even at startup, so periodic restart wouldn't actually help. Root cause remains deferred.
80 lines
2.7 KiB
YAML
80 lines
2.7 KiB
YAML
# resticprofile config for nh3-docker.
|
|
#
|
|
# nh3-docker is a VM on nh3-pve, so its disk image IS captured by vzdump
|
|
# at the hypervisor layer. This file-level restic is additive: it gives
|
|
# fast per-file restore without mounting the VM image, and ships to the
|
|
# site-local rest-server for location-resilient recovery.
|
|
#
|
|
# Writes to the Synology rest-server at 10.100.50.50:8000 as user
|
|
# `nh3-docker`. The full REST URL (with HTTP basic-auth creds) lives in
|
|
# /etc/restic/restic.env. The client-side encryption passphrase lives in
|
|
# /etc/restic/password.
|
|
#
|
|
# No DB dumps needed. None of the stacks on this host (adguard, dockge,
|
|
# beszel-agent, dozzle-agent, portainer) run a relational DB — AdGuard
|
|
# stores config as YAML, the rest use tiny SQLite state in their volumes
|
|
# which restic captures raw (WAL-mode SQLite recovers cleanly).
|
|
|
|
version: "1"
|
|
|
|
global:
|
|
priority: low
|
|
ionice: true
|
|
ionice-class: 2
|
|
ionice-level: 7
|
|
min-memory: 100
|
|
|
|
default:
|
|
env-file: /etc/restic/restic.env # RESTIC_REPOSITORY=rest:http://user:pw@…
|
|
env:
|
|
RESTIC_PASSWORD_FILE: /etc/restic/password
|
|
initialize: false # repo created manually by `restic init`
|
|
lock: /var/lock/restic-nh3-docker.lock
|
|
|
|
backup:
|
|
verbose: 1
|
|
run-after:
|
|
- date +%s > /var/lib/restic/last-success
|
|
source:
|
|
- /opt/docker # compose files (~1.6 MB on this host)
|
|
- /etc # host config (systemd, adguard upstream config, etc.)
|
|
- /root # root shell history, ssh keys, ad-hoc scripts
|
|
- /var/lib/docker/volumes # adguard config, agent state, dockge state, etc.
|
|
exclude:
|
|
- /var/lib/docker/volumes/backingFsBlockDev
|
|
- /var/lib/docker/volumes/metadata.db
|
|
- /opt/docker/compose/*/logs
|
|
- "**/*.log"
|
|
- "**/*.log.*"
|
|
- "**/*.pid"
|
|
- /root/.cache
|
|
- /root/.local/share/Trash
|
|
- /root/.npm
|
|
- /root/.python_history
|
|
tag:
|
|
- host:nh3-docker
|
|
- site:nh3
|
|
- fleet:pfi
|
|
schedule: "*-*-* 01:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-backup.log
|
|
|
|
forget:
|
|
keep-daily: 7
|
|
keep-weekly: 4
|
|
keep-monthly: 12
|
|
keep-yearly: 3
|
|
# NOTE: no `prune: true` — rest-server runs with --append-only on both
|
|
# sites. See README.md "Prune ceremony".
|
|
tag:
|
|
- host:nh3-docker
|
|
# Schedule removed 2026-04-21: forget against --append-only rest-server
|
|
# always fails (delete ops blocked). Run manually during the prune
|
|
# ceremony when --append-only is temporarily off.
|
|
|
|
check:
|
|
read-data-subset: 10%
|
|
schedule: "Sun *-*-* 05:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-check.log
|