linumiq_net-user
e7a7cafa89
- /docker/backup: borgmatic container (daily 03:00 Berlin via BACKUP_CRON) - Backs up /docker (ro) to local encrypted repo /var/backups/borg (repokey-blake2) - Postgres prod+dev captured via pg_dumpall; live PG data/logs/build artifacts excluded - Retention: keep_daily 7, keep_weekly 4, keep_monthly 6; runs prune/compact/create/check - Secrets in backup/.env (gitignored, chmod 600)
75 lines
2.6 KiB
YAML
75 lines
2.6 KiB
YAML
# borgmatic configuration for linumiq.net — local encrypted daily backup (v1).
|
|
# borgmatic 2.x flat schema. Secrets are interpolated from the container
|
|
# environment (see ../.env): POSTGRES_PASSWORD_PROD, POSTGRES_PASSWORD_DEV,
|
|
# BORG_PASSPHRASE.
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# What to back up (files)
|
|
# ---------------------------------------------------------------------------
|
|
source_directories:
|
|
- /docker
|
|
|
|
# Repository (bind-mounted from host /var/backups/borg).
|
|
repositories:
|
|
- path: /repository
|
|
label: linumiq-local
|
|
|
|
# Encryption passphrase (repokey-blake2). Set in ../.env, kept offsite too.
|
|
encryption_passphrase: ${BORG_PASSPHRASE}
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Exclusions: raw live PG data (captured via logical dumps below), transient
|
|
# logs, regenerable build artifacts, and remediation snapshots.
|
|
# ---------------------------------------------------------------------------
|
|
exclude_patterns:
|
|
- /docker/supabase/volumes/db/data
|
|
- /docker/dev/supabase/volumes/db/data
|
|
- /docker/supabase/volumes/logs
|
|
- /docker/dev/supabase/volumes/logs
|
|
- /docker/caddy/config/caddy/autosave.json
|
|
- sh:/docker/**/.remediation-backup
|
|
- sh:/docker/**/node_modules
|
|
- sh:/docker/**/.next
|
|
exclude_caches: true
|
|
exclude_if_present:
|
|
- .nobackup
|
|
|
|
# Keep the archive listing manageable.
|
|
one_file_system: false
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Postgres logical dumps (streamed into the archive, not written to disk).
|
|
# name "all" => pg_dumpall (roles + all databases + extensions).
|
|
# ---------------------------------------------------------------------------
|
|
postgresql_databases:
|
|
- name: all
|
|
hostname: supabase-db
|
|
port: 5432
|
|
username: postgres
|
|
password: ${POSTGRES_PASSWORD_PROD}
|
|
- name: all
|
|
hostname: supabase-dev-db
|
|
port: 5432
|
|
username: postgres
|
|
password: ${POSTGRES_PASSWORD_DEV}
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Retention
|
|
# ---------------------------------------------------------------------------
|
|
keep_daily: 7
|
|
keep_weekly: 4
|
|
keep_monthly: 6
|
|
|
|
# Tag archives so prune groups them correctly.
|
|
archive_name_format: "linumiq-{now:%Y-%m-%dT%H:%M:%S}"
|
|
match_archives: "sh:linumiq-*"
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Consistency checks (run as part of the default daily action set).
|
|
# ---------------------------------------------------------------------------
|
|
checks:
|
|
- name: repository
|
|
- name: archives
|
|
|
|
# Surface command output/errors in logs.
|