28 lines
1 KiB
YAML
28 lines
1 KiB
YAML
|
---
|
||
|
|
# Required
|
||
|
|
backup_source_name: "" # "headscale" -> headscale_<ts>.tar.gz.age
|
||
|
|
backup_source_description: "" # "Headscale"
|
||
|
|
backup_source_dump_command: "" # must write the payload to STDOUT
|
||
|
|
|
||
|
|
# Placement
|
||
|
|
backup_source_dir: "/opt/backups/{{ backup_source_name }}"
|
||
|
|
backup_source_artifact_suffix: "tar.gz.age"
|
||
|
|
|
||
|
|
# Encryption. Asymmetric: the host holds only the public key and cannot decrypt
|
||
|
|
# what it produces.
|
||
|
|
backup_source_recipient: "{{ age_backup_recipient }}"
|
||
|
|
|
||
|
|
# The unprivileged account small-backups-box pulls as. It owns the dump
|
||
|
|
# directory and nothing else; it deliberately has no sudo.
|
||
|
|
backup_source_pull_user: backup-pull
|
||
|
|
backup_source_pull_key: "{{ backup_pull_public_key }}"
|
||
|
|
|
||
|
|
# Safety
|
||
|
|
backup_source_stop_service: "" # local unit stopped for the dump, restored by a trap
|
||
|
|
|
||
|
|
# Retention here is LOCAL and short; small-backups-box keeps the long tail.
|
||
|
|
backup_source_retention_days: 7
|
||
|
|
|
||
|
|
# Schedule. The box pulls at 04:00, so dumps must land before that.
|
||
|
|
backup_source_on_calendar: "*-*-* 02:00:00"
|