---
# Required
backup_source_name: ""                  # "headscale" -> headscale_<ts>.tar.gz.age
backup_source_description: ""           # "Headscale"
backup_source_dump_command: ""          # must write the payload to STDOUT

# Placement
backup_source_dir: "/opt/backups/{{ backup_source_name }}"
backup_source_artifact_suffix: "tar.gz.age"

# Encryption. Asymmetric: the host holds only the public key and cannot decrypt
# what it produces.
backup_source_recipient: "{{ age_backup_recipient }}"

# The unprivileged account small-backups-box pulls as. It owns the dump
# directory and nothing else; it deliberately has no sudo.
backup_source_pull_user: backup-pull
backup_source_pull_key: "{{ backup_pull_public_key }}"

# Safety. Give either a systemd unit, or an explicit pair of commands for
# services that are not systemd-managed (vaultwarden is a docker compose stack).
# Whichever is used, a trap guarantees the restart.
backup_source_stop_service: ""          # systemd unit stopped for the dump
backup_source_stop_command: ""          # overrides stop_service when set
backup_source_start_command: ""         # required alongside stop_command

# Retention here is LOCAL and short; small-backups-box keeps the long tail.
backup_source_retention_days: 7

# Schedule. The box pulls at 04:00, so dumps must land before that.
backup_source_on_calendar: "*-*-* 02:00:00"