vh
de1eac2904
Adds file-level restic for the NH3 Docker VM. Targets the Synology rest-server (rest-server-nh3 at 10.100.50.50:8000) as user nh3-docker — site-local writes matching the fleet pattern. No pre-backup hook needed: none of the stacks on this host (adguard, dockge, beszel-agent, dozzle-agent, portainer) run relational DBs. The SQLite state in their named volumes is WAL-mode and restores cleanly from raw restic capture. Source paths mirror ana-ml2's template (/opt/docker, /etc, /root, /var/lib/docker/volumes) with the same exclude list (docker internals, logs, pids, root's shell/caches). ~1.6 MB of compose files + small volumes — expected snapshot size a few hundred MB at most, dominated by any AdGuard query log history. README walks through reuse (existing repo + htpasswd) vs fresh init paths, resticprofile install, timer generation, and verification via the Backrest UI.
80 lines
2.6 KiB
YAML
80 lines
2.6 KiB
YAML
# resticprofile config for nh3-docker.
|
|
#
|
|
# nh3-docker is a VM on nh3-pve, so its disk image IS captured by vzdump
|
|
# at the hypervisor layer. This file-level restic is additive: it gives
|
|
# fast per-file restore without mounting the VM image, and ships to the
|
|
# site-local rest-server for location-resilient recovery.
|
|
#
|
|
# Writes to the Synology rest-server at 10.100.50.50:8000 as user
|
|
# `nh3-docker`. The full REST URL (with HTTP basic-auth creds) lives in
|
|
# /etc/restic/restic.env. The client-side encryption passphrase lives in
|
|
# /etc/restic/password.
|
|
#
|
|
# No DB dumps needed. None of the stacks on this host (adguard, dockge,
|
|
# beszel-agent, dozzle-agent, portainer) run a relational DB — AdGuard
|
|
# stores config as YAML, the rest use tiny SQLite state in their volumes
|
|
# which restic captures raw (WAL-mode SQLite recovers cleanly).
|
|
|
|
version: "1"
|
|
|
|
global:
|
|
priority: low
|
|
ionice: true
|
|
ionice-class: 2
|
|
ionice-level: 7
|
|
min-memory: 100
|
|
|
|
default:
|
|
env-file: /etc/restic/restic.env # RESTIC_REPOSITORY=rest:http://user:pw@…
|
|
env:
|
|
RESTIC_PASSWORD_FILE: /etc/restic/password
|
|
initialize: false # repo created manually by `restic init`
|
|
lock: /var/lock/restic-nh3-docker.lock
|
|
|
|
backup:
|
|
verbose: 1
|
|
run-after:
|
|
- date +%s > /var/lib/restic/last-success
|
|
source:
|
|
- /opt/docker # compose files (~1.6 MB on this host)
|
|
- /etc # host config (systemd, adguard upstream config, etc.)
|
|
- /root # root shell history, ssh keys, ad-hoc scripts
|
|
- /var/lib/docker/volumes # adguard config, agent state, dockge state, etc.
|
|
exclude:
|
|
- /var/lib/docker/volumes/backingFsBlockDev
|
|
- /var/lib/docker/volumes/metadata.db
|
|
- /opt/docker/compose/*/logs
|
|
- "**/*.log"
|
|
- "**/*.log.*"
|
|
- "**/*.pid"
|
|
- /root/.cache
|
|
- /root/.local/share/Trash
|
|
- /root/.npm
|
|
- /root/.python_history
|
|
tag:
|
|
- host:nh3-docker
|
|
- site:nh3
|
|
- fleet:pfi
|
|
schedule: "*-*-* 01:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-backup.log
|
|
|
|
forget:
|
|
keep-daily: 7
|
|
keep-weekly: 4
|
|
keep-monthly: 12
|
|
keep-yearly: 3
|
|
# NOTE: no `prune: true` — rest-server runs with --append-only on both
|
|
# sites. See README.md "Prune ceremony".
|
|
tag:
|
|
- host:nh3-docker
|
|
schedule: "*-*-* 03:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-forget.log
|
|
|
|
check:
|
|
read-data-subset: 10%
|
|
schedule: "Sun *-*-* 05:00:00"
|
|
schedule-permission: system
|
|
schedule-log: /var/log/restic-check.log
|