- /docker/backup: borgmatic container (daily 03:00 Berlin via BACKUP_CRON) - Backs up /docker (ro) to local encrypted repo /var/backups/borg (repokey-blake2) - Postgres prod+dev captured via pg_dumpall; live PG data/logs/build artifacts excluded - Retention: keep_daily 7, keep_weekly 4, keep_monthly 6; runs prune/compact/create/check - Secrets in backup/.env (gitignored, chmod 600)