31 lines
1.3 KiB
YAML
31 lines
1.3 KiB
YAML
---
|
|
# Required
|
|
backup_source_name: "" # "headscale" -> headscale_<ts>.tar.gz.age
|
|
backup_source_description: "" # "Headscale"
|
|
backup_source_dump_command: "" # must write the payload to STDOUT
|
|
|
|
# Placement
|
|
backup_source_dir: "/opt/backups/{{ backup_source_name }}"
|
|
backup_source_artifact_suffix: "tar.gz.age"
|
|
|
|
# Encryption. Asymmetric: the host holds only the public key and cannot decrypt
|
|
# what it produces.
|
|
backup_source_recipient: "{{ age_backup_recipient }}"
|
|
|
|
# The unprivileged account small-backups-box pulls as. It owns the dump
|
|
# directory and nothing else; it deliberately has no sudo.
|
|
backup_source_pull_user: backup-pull
|
|
backup_source_pull_key: "{{ backup_pull_public_key }}"
|
|
|
|
# Safety. Give either a systemd unit, or an explicit pair of commands for
|
|
# services that are not systemd-managed (vaultwarden is a docker compose stack).
|
|
# Whichever is used, a trap guarantees the restart.
|
|
backup_source_stop_service: "" # systemd unit stopped for the dump
|
|
backup_source_stop_command: "" # overrides stop_service when set
|
|
backup_source_start_command: "" # required alongside stop_command
|
|
|
|
# Retention here is LOCAL and short; small-backups-box keeps the long tail.
|
|
backup_source_retention_days: 7
|
|
|
|
# Schedule. The box pulls at 04:00, so dumps must land before that.
|
|
backup_source_on_calendar: "*-*-* 02:00:00"
|