102 lines
4.1 KiB
Markdown
102 lines
4.1 KiB
Markdown
---
|
|
schema_version: 1
|
|
id: home-server.backups
|
|
type: reference
|
|
scope: [jupiter, backrest, restic, google-drive, recovery]
|
|
sensitivity: private-infrastructure
|
|
last_reviewed: "2026-10-06"
|
|
sources:
|
|
- kind: owner-report
|
|
reference: "Backrest plan JSON, destination, key custody and no restore test, 2026-10-06"
|
|
- kind: owner-report
|
|
reference: "Updated four-service Backrest plan and deployed Portainer bind mount/container name, 2026-10-06"
|
|
- kind: owner-report
|
|
reference: "Only restic key has independent custody; no independent credential recovery or backup/restore evidence, 2026-10-06"
|
|
- kind: repository
|
|
repository: jupiter-stacks
|
|
revision: 610e325ef6a98850511ce7a089b0b9a77bfecf15
|
|
paths:
|
|
- stacks/backrest/docker-compose.yml
|
|
- stacks/gitea/docker-compose.yml
|
|
- stacks/paperless-ngx/docker-compose.yml
|
|
- stacks/vaultwarden/docker-compose.yml
|
|
related: [home-server.reference, home-server.storage, home-server.portainer, home-server.authentication, home-server.operations]
|
|
update_triggers: [backup-plan-change, destination-change, hook-change, credential-change, restore-test]
|
|
unknowns:
|
|
- last-successful-backup-and-repository-check
|
|
- google-drive-repository-path
|
|
- measured-rpo-and-rto
|
|
---
|
|
|
|
# Backups
|
|
|
|
| Setting | Value |
|
|
| --- | --- |
|
|
| Engine | Backrest / restic; plan `jupiter-backup` |
|
|
| Repository | `jayo60013-gdrive`; Google Drive; account `jayo60013` |
|
|
| Schedule | `0 3 * * *`; UTC; daily 03:00 |
|
|
| Retention | `policyKeepLastN: 4`; last four snapshots, not four days |
|
|
| Encryption key | iCloud password app; no key stored here |
|
|
| Independent credential recovery | None beyond the restic encryption key |
|
|
| Backup / integrity evidence | None supplied |
|
|
| Restore test | Never performed |
|
|
|
|
## Coverage
|
|
|
|
Backrest bind-mounts host `/data` at container `/userdata:ro`.
|
|
|
|
| Host source | Plan path |
|
|
| --- | --- |
|
|
| `/data/gitea` | `/userdata/gitea` |
|
|
| `/data/paperless-ngx` | `/userdata/paperless-ngx` |
|
|
| `/data/portainer` | `/userdata/portainer` |
|
|
| `/data/vaultwarden` | `/userdata/vaultwarden` |
|
|
|
|
Case-insensitive exclusion: `/userdata/gitea/gitea/packages`.
|
|
`excludes: []`; CLI `--skip-if-unchanged` supplied despite
|
|
plan `skipIfUnchanged: false`. Unchanged runs may create no snapshot.
|
|
|
|
## Consistency hooks
|
|
|
|
Stop timeout `120s`; chains use `&&`. Errors: `ON_ERROR_FATAL`,
|
|
except Portainer restart (`ON_ERROR_IGNORE`).
|
|
|
|
| Event | Ordered commands / containers |
|
|
| --- | --- |
|
|
| `SNAPSHOT_START` | Stop `paperless` -> `paperless_db` |
|
|
| `SNAPSHOT_START` | Stop `gitea_runner` -> `gitea` -> `gitea_db` |
|
|
| `SNAPSHOT_START` | Stop `vaultwarden` |
|
|
| `SNAPSHOT_START` | Stop `portainer` |
|
|
| `SNAPSHOT_END`, `SNAPSHOT_ERROR` | Start `paperless_db` -> `paperless` |
|
|
| `SNAPSHOT_END`, `SNAPSHOT_ERROR` | Start `gitea_db` -> `gitea` -> `gitea_runner` |
|
|
| `SNAPSHOT_END`, `ANY_ERROR` | Start `vaultwarden` |
|
|
| `SNAPSHOT_END`, `SNAPSHOT_ERROR` | Start `portainer`; ignore hook failure |
|
|
|
|
Cold filesystem copies of applications/databases; no database dumps supplied.
|
|
Broker stays running. `docker start` does not wait for database readiness.
|
|
Hook failure can leave services stopped; recovery is not demonstrated.
|
|
Portainer restart failure does not fail the backup operation.
|
|
|
|
## Backrest state
|
|
|
|
| Host path | Container path |
|
|
| --- | --- |
|
|
| `/data/backrest/data` | `/data` |
|
|
| `/data/backrest/config` | `/config`; plan/repository configuration `config.json` |
|
|
| `/data/backrest/rclone` | `/root/.config/rclone` |
|
|
| `/home/jay/data/backrest/cache` | `/cache` |
|
|
| `/data/backrest/restore` | `/restore` |
|
|
| `/var/run/docker.sock` | `/var/run/docker.sock`; lifecycle hooks |
|
|
|
|
## Recovery limits
|
|
|
|
Only the four listed directories are covered. No supplied coverage for Authelia,
|
|
Traefik, Backrest configuration, Docker named volumes, OS, or Mercury.
|
|
|
|
Full-host recovery requires independently retrievable repository credentials,
|
|
configuration and restic key. Key custody alone does not establish recoverability.
|
|
No independent Google Drive/rclone credential recovery or Backrest-config
|
|
recovery arrangement exists. Recovering backed-up Portainer state is not a
|
|
substitute for first being able to retrieve the backup.
|
|
`/restore` is on the same RAID array; not an independent backup.
|