Nightly restic backup to Wasabi #14

Manually merged

marvin8 merged 2 commits from feat/issue-13-restic-nightly-backup into main

2026-09-07 23:36:10 +00:00

agent-pi commented

2026-09-07 23:15:33 +00:00

Collaborator

The box has no backup: agent memory/skills (~~/.pi), the forge signing key (~~/.ssh), and the tailscale authkey exist only on this disk. This adds an unattended nightly encrypted restic backup to a dedicated Wasabi bucket.

services.restic.backups.nightly: root-run (module default; needed to read 0600 files in ~/.ssh and /etc/tailscale), initialize = true, runCheck = true, createWrapper gives restic-nightly for manual inspection
Explicit path list only: /etc/tailscale/authkey, ~/.pi, ~/.ssh, ~/.config, fish/zoxide state, devbox.json — ~/wip repos are on the forge, caches/podman storage re-downloadable
Prune --keep-daily 7 --group-by '' (matches the VPS; longer history is the secondary backup's job)
Timer: 02:00 Australia/Brisbane nightly, Persistent, 10 min random delay
Uptime Kuma push on success and failure (onFailure fires an explicit status=down, so a failed backup is red immediately, not after the monitor timeout). Push URL (contains token) is read at runtime from /etc/restic/kuma-push.url so it never lands in the repo or world-readable /nix/store
SETUP.md §8: bucket/access-key/Kuma provisioning, secret file placement, first-run verification, restore commands

Secrets (/etc/restic/{password,wasabi.env,kuma-push.url}) are provisioned at console per SETUP.md §8 — not in the repo.

Closes #13

The box has no backup: agent memory/skills (~/.pi), the forge signing key (~/.ssh), and the tailscale authkey exist only on this disk. This adds an unattended nightly encrypted restic backup to a dedicated Wasabi bucket. - `services.restic.backups.nightly`: root-run (module default; needed to read 0600 files in `~/.ssh` and `/etc/tailscale`), `initialize = true`, `runCheck = true`, `createWrapper` gives `restic-nightly` for manual inspection - Explicit path list only: `/etc/tailscale/authkey`, `~/.pi`, `~/.ssh`, `~/.config`, fish/zoxide state, `devbox.json` — `~/wip` repos are on the forge, caches/podman storage re-downloadable - Prune `--keep-daily 7 --group-by ''` (matches the VPS; longer history is the secondary backup's job) - Timer: 02:00 Australia/Brisbane nightly, `Persistent`, 10 min random delay - Uptime Kuma push on success **and** failure (`onFailure` fires an explicit `status=down`, so a failed backup is red immediately, not after the monitor timeout). Push URL (contains token) is read at runtime from `/etc/restic/kuma-push.url` so it never lands in the repo or world-readable `/nix/store` - SETUP.md §8: bucket/access-key/Kuma provisioning, secret file placement, first-run verification, restore commands Secrets (`/etc/restic/{password,wasabi.env,kuma-push.url}`) are provisioned at console per SETUP.md §8 — not in the repo. Closes #13

agent-pi added 2 commits

2026-09-07 23:15:33 +00:00

✨ feat: nightly restic backup to Wasabi (root-run, 02:00, keep-daily 7) 11a86ad0de