# borgmatic configuration for linumiq.net — local encrypted daily backup (v1).
# borgmatic 2.x flat schema. Secrets are interpolated from the container
# environment (see ../.env): POSTGRES_PASSWORD_PROD, POSTGRES_PASSWORD_DEV,
# BORG_PASSPHRASE.

# ---------------------------------------------------------------------------
# What to back up (files)
# ---------------------------------------------------------------------------
source_directories:
    - /docker

# Repository (bind-mounted from host /var/backups/borg).
repositories:
    - path: /repository
      label: linumiq-local

# Encryption passphrase (repokey-blake2). Set in ../.env, kept offsite too.
encryption_passphrase: ${BORG_PASSPHRASE}

# ---------------------------------------------------------------------------
# Exclusions: raw live PG data (captured via logical dumps below), transient
# logs, regenerable build artifacts, and remediation snapshots.
# ---------------------------------------------------------------------------
exclude_patterns:
    - /docker/supabase/volumes/db/data
    - /docker/dev/supabase/volumes/db/data
    - /docker/supabase/volumes/logs
    - /docker/dev/supabase/volumes/logs
    - /docker/caddy/config/caddy/autosave.json
    - sh:/docker/**/.remediation-backup
    - sh:/docker/**/node_modules
    - sh:/docker/**/.next
exclude_caches: true
exclude_if_present:
    - .nobackup

# Keep the archive listing manageable.
one_file_system: false

# ---------------------------------------------------------------------------
# Postgres logical dumps (streamed into the archive, not written to disk).
# name "all" => pg_dumpall (roles + all databases + extensions).
# ---------------------------------------------------------------------------
postgresql_databases:
    - name: all
      hostname: supabase-db
      port: 5432
      username: postgres
      password: ${POSTGRES_PASSWORD_PROD}
    - name: all
      hostname: supabase-dev-db
      port: 5432
      username: postgres
      password: ${POSTGRES_PASSWORD_DEV}

# ---------------------------------------------------------------------------
# Retention
# ---------------------------------------------------------------------------
keep_daily: 7
keep_weekly: 4
keep_monthly: 6

# Tag archives so prune groups them correctly.
archive_name_format: "linumiq-{now:%Y-%m-%dT%H:%M:%S}"
match_archives: "sh:linumiq-*"

# ---------------------------------------------------------------------------
# Consistency checks (run as part of the default daily action set).
# ---------------------------------------------------------------------------
checks:
    - name: repository
    - name: archives

# Surface command output/errors in logs.