vh
6e203dcb99
resticprofile schedule copies env-file values into the generated units, which
are 0644, so RESTIC_REPOSITORY (the rest-server basic-auth password included)
was readable by every local user on every restic host.
New playbooks/restic-repository-file.yaml:
- derives /etc/restic/repository (root 0400) from restic.env;
- uploads the profile switched to repository-file, but only when the live
profile's sha matches the repo copy it was edited from (drift guard);
- checks the repository is reachable through the new profile (cat config);
- regenerates the units and verifies they exist and contain no rest:http.
Applied to ana-docker, fv-ml1 (configs/restic/ana-ml2), esh-docker-vm,
esh-vm-db, irv-ml1, nh3-dev and nh3-docker. An independent check across all
eight restic hosts (these seven plus esh-ml1) found 0 leaking units. nh3-docker's
scheduled unit ran a real backup afterwards (snapshot a29b889d). Each host's
URL and passphrase are vaulted as <host>/etc/restic/{repository,password}.
restic.env is kept (root 0600) because the per-host READMEs and the freshness
probe source it. A rotation must update the vault, restic.env and repository.
vm-esh-nas has no infra-ops account. Its in-place migration script is staged
for Prime to run with sudo, and its repo profile is pre-edited to match.
Also mirrors augaman-dev's 401df2d (compose header only). The config hash on
esh-ml1 is unchanged.
115 lines
3.9 KiB
YAML
115 lines
3.9 KiB
YAML
# resticprofile config for nh3-dev.
|
|
#
|
|
# User workstation at the NH3 site (nh3-dev.phasefinal.com). Primary
|
|
# payload is /home/lkraven — ~12 GB of active development code, shell
|
|
# history, dotfiles, notes, Claude Code memory, etc. Not a server; no
|
|
# Docker stacks to dump. No databases.
|
|
#
|
|
# Writes to the Synology rest-server at 10.100.50.50:8000 as user
|
|
# `nh3-dev` — site-local, matches the pattern nh3-docker uses.
|
|
#
|
|
# Schedule accommodates a workstation that may be off/sleeping at the
|
|
# scheduled time: systemd timer uses Persistent=true (resticprofile sets
|
|
# this by default for schedule-permission: system) so a missed run
|
|
# catches up on next boot.
|
|
#
|
|
# Excludes trim ~8 GB of regenerable caches from the 22 GB home. First
|
|
# snapshot should land at ~14 GB; incrementals much smaller.
|
|
|
|
version: "1"
|
|
|
|
global:
|
|
priority: low
|
|
ionice: true
|
|
ionice-class: 2
|
|
ionice-level: 7
|
|
min-memory: 200 # workstation has more RAM than agents; give restic a bit more
|
|
|
|
default:
|
|
repository-file: /etc/restic/repository # URL incl. rest-server creds (root 0400).
|
|
# NOT env-file: `resticprofile schedule` copies env-file values into the
|
|
# world-readable systemd units (docs/runbooks/backups.md, Known gaps).
|
|
env:
|
|
RESTIC_PASSWORD_FILE: /etc/restic/password
|
|
initialize: false
|
|
lock: /var/lock/restic-nh3-dev.lock
|
|
|
|
backup:
|
|
verbose: 1
|
|
run-after:
|
|
- date +%s > /var/lib/restic/last-success
|
|
source:
|
|
- /home/lkraven # the whole reason this backup exists
|
|
- /etc # host config
|
|
- /root # root's state, ssh keys, etc.
|
|
exclude:
|
|
# ---- Language / toolchain caches (all regenerable) -------------------
|
|
- /home/lkraven/.cache
|
|
- /home/lkraven/.rustup
|
|
- /home/lkraven/.cargo/registry
|
|
- /home/lkraven/.cargo/git
|
|
- /home/lkraven/.npm
|
|
- /home/lkraven/.pnpm-store
|
|
- /home/lkraven/.m2
|
|
- /home/lkraven/.gradle
|
|
- /home/lkraven/.conda
|
|
- /home/lkraven/go/pkg
|
|
- /home/lkraven/.dotnet
|
|
# ---- Editor / remote-dev caches ---------------------------------------
|
|
- /home/lkraven/.vscode-server
|
|
- /home/lkraven/.vscode
|
|
# ---- Project build outputs (often committed to .gitignore) ------------
|
|
- "**/node_modules"
|
|
- "**/__pycache__"
|
|
- "**/.venv"
|
|
- "**/venv"
|
|
- "**/target" # Rust/Java/other — regenerable from source
|
|
- "**/dist"
|
|
- "**/build"
|
|
- "**/.pytest_cache"
|
|
- "**/.tox"
|
|
- "**/.next" # Next.js
|
|
- "**/.nuxt" # Nuxt
|
|
# ---- Trash / shell noise ---------------------------------------------
|
|
- /home/lkraven/.local/share/Trash
|
|
- /home/lkraven/.mozilla/firefox/*/Cache*
|
|
- /home/lkraven/.thumbnails
|
|
- /home/lkraven/.zcompdump*
|
|
# ---- Browser profiles (if any) ----------------------------------------
|
|
- /home/lkraven/snap
|
|
- /home/lkraven/.steam
|
|
- /home/lkraven/Steam
|
|
# ---- Root side ---------------------------------------------------------
|
|
- /root/.cache
|
|
- /root/.npm
|
|
- /root/.local/share/Trash
|
|
# ---- Logs / pids ------------------------------------------------------
|
|
- "**/*.log"
|
|
- "**/*.log.*"
|
|
- "**/*.pid"
|
|
tag:
|
|
- host:nh3-dev
|
|
- site:nh3
|
|
- fleet:pfi
|
|
- role:workstation
|
|
schedule: "*-*-* 01:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-backup.log
|
|
|
|
forget:
|
|
keep-daily: 7
|
|
keep-weekly: 4
|
|
keep-monthly: 12
|
|
keep-yearly: 3
|
|
tag:
|
|
- host:nh3-dev
|
|
# Schedule removed 2026-04-21: forget against --append-only rest-server
|
|
# always fails (delete ops blocked). Run manually during the prune
|
|
# ceremony when --append-only is temporarily off.
|
|
|
|
check:
|
|
read-data-subset: 10%
|
|
schedule: "Sun *-*-* 05:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-check.log
|