vh
c94024d238
Second ESH Docker host — light (filezilla + dockge + agents, /opt/docker
is 56 KB). Cross-site writes to the Anaheim rest-server since ESH has
no local rest-server.
Critical detail: vm-esh-nas NFS-mounts /mnt/{share,music,books,media}
from 10.0.50.50 (~400 TB). Profile's exclude patterns explicitly
reject those paths as a safety net on top of the source list not
including them — a careless future edit to sources can't nuke the
backup repo by pulling in 400 TB.
Sources include /home/ (lkraven/nas/user dirs) in addition to the
usual /opt/docker /etc /root /var/lib/docker/volumes — this host has
multiple user accounts worth preserving dotfiles for.
No pre-backup hook: no relational DBs.
README walks through the full setup: install restic (not present on
this host), add htpasswd entry on rest-server-ana, install creds,
init, install resticprofile, schedule timers. Also flags the 3.8 GB
RAM constraint.
94 lines
2.8 KiB
YAML
94 lines
2.8 KiB
YAML
# resticprofile config for vm-esh-nas.
|
|
#
|
|
# Second ESH Docker host (filezilla, dockge, agents). VM on esh-pve-nas.
|
|
# Covered by vzdump at the hypervisor level; this restic adds per-file
|
|
# restore + cross-site redundancy.
|
|
#
|
|
# Writes cross-site to the Anaheim rest-server (10.250.50.70:8000/vm-esh-nas/)
|
|
# because the ESH site has no local rest-server. Credentials live in
|
|
# /etc/restic/restic.env; passphrase in /etc/restic/password.
|
|
#
|
|
# Explicit NFS exclusions below are **critical** — this host mounts
|
|
# /mnt/{share,music,books,media} from 10.0.50.50 (hundreds of TB of
|
|
# media). They're not in the source list, but the exclude-patterns
|
|
# provide a second line of defense if the source list is ever edited
|
|
# carelessly.
|
|
#
|
|
# No DB hook needed: no relational databases on this host. Dockge /
|
|
# beszel-agent / dozzle-agent store trivial SQLite state captured raw.
|
|
|
|
version: "1"
|
|
|
|
global:
|
|
priority: low
|
|
ionice: true
|
|
ionice-class: 2
|
|
ionice-level: 7
|
|
min-memory: 100
|
|
|
|
default:
|
|
env-file: /etc/restic/restic.env
|
|
env:
|
|
RESTIC_PASSWORD_FILE: /etc/restic/password
|
|
initialize: false
|
|
lock: /var/lock/restic-vm-esh-nas.lock
|
|
|
|
backup:
|
|
verbose: 1
|
|
run-after:
|
|
- date +%s > /var/lib/restic/last-success
|
|
source:
|
|
- /opt/docker # compose files (~56 KB)
|
|
- /etc # host config
|
|
- /root # root's scripts, ssh keys, shell history
|
|
- /home # user home dirs (lkraven, nas, user)
|
|
- /var/lib/docker/volumes # beszel-agent, dozzle-agent, dockge state
|
|
exclude:
|
|
# CRITICAL: NFS mounts from 10.0.50.50 — never follow.
|
|
# These are in /mnt/, not in the source list, but pattern exclude
|
|
# protects against careless source edits.
|
|
- /mnt/share
|
|
- /mnt/music
|
|
- /mnt/books
|
|
- /mnt/media
|
|
# Docker internals
|
|
- /var/lib/docker/volumes/backingFsBlockDev
|
|
- /var/lib/docker/volumes/metadata.db
|
|
# Ephemeral / regenerable
|
|
- /opt/docker/compose/*/logs
|
|
- "**/*.log"
|
|
- "**/*.log.*"
|
|
- "**/*.pid"
|
|
# Per-user shell / app noise
|
|
- /root/.cache
|
|
- /root/.local/share/Trash
|
|
- /root/.python_history
|
|
- /home/*/.cache
|
|
- /home/*/.local/share/Trash
|
|
- /home/*/.npm
|
|
- /home/*/.mozilla/firefox/*/Cache
|
|
tag:
|
|
- host:vm-esh-nas
|
|
- site:esh
|
|
- fleet:home-lab
|
|
schedule: "*-*-* 01:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-backup.log
|
|
|
|
forget:
|
|
keep-daily: 7
|
|
keep-weekly: 4
|
|
keep-monthly: 12
|
|
keep-yearly: 3
|
|
tag:
|
|
- host:vm-esh-nas
|
|
schedule: "*-*-* 03:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-forget.log
|
|
|
|
check:
|
|
read-data-subset: 10%
|
|
schedule: "Sun *-*-* 05:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-check.log
|