#!/bin/bash
# Guest-level restic backup for bastion -> Backblaze B2 (b2:ctg-backups:/bastion/).
#
# Unlike the host-level vzdump image (abandoned 2026-08-27 -- LUKS ciphertext
# does not compress or dedupe, and blew past the local pool's headroom once
# this disk was grown to 512G), this backs up the DECRYPTED filesystem from
# inside the VM, so restic's content-defined chunking can actually dedupe
# across nightly runs.
#
# Excludes reproducible toolchain/cache dirs, not user data:
#   .cache, .cargo, .rustup, .npm
# Nextcloud/ and repos/ ARE included deliberately (208G initial seed) -- do
# not add them to the exclude list without checking with the user first.
set -euo pipefail

source /root/.restic-env
export HOME=/root

exec restic     --password-file /root/.resticpwd     --verbose     backup     --exclude-caches     --exclude '/home/canutethegreat/.cache'     --exclude '/home/canutethegreat/.cargo'     --exclude '/home/canutethegreat/.rustup'     --exclude '/home/canutethegreat/.npm'     /etc /root /home/canutethegreat
