#!/bin/bash
# Host-level restic backup for azkaban -> Backblaze B2 (b2:ctg-backups:/azkaban/).
#
# SCOPE: host configuration only. Guest disks live on zvols under /dev/zvol and
# are handled by vzdump (job `az-guests`), not here.
#
# /var/lib/vz/dump IS included, so the nightly guest images produced by the
# `az-guests` vzdump job reach B2. This is the only offsite copy of the router
# config, DHCP leases and authoritative DNS records.
#
# Two guests are excluded, both for upload volume rather than importance:
#   102 captainjack - 257 GB of incompressible LUKS data.
#   101 bastion     - ~25-35 GB compressed. Each nightly vzdump is a fresh
#                     archive, so compressed output dedupes poorly and restic
#                     would push that much EVERY night; with keep-daily 7 the
#                     repo would run to hundreds of GB over a home uplink.
# Net effect: only the small guests (100 OpenWrt, 103/104 the DNS pair) go
# offsite -- roughly 2.5 GB nightly. Both excluded guests still have local
# nightly images under keep-last=3.
#
# NOTE on VMIDs: they were reassigned during the migration from kingscrossstation.
# Here 100 is OpenWrt (tiny) and 102 is captainjack (huge) -- the reverse of an
# earlier assumption. Verify with `qm list` before changing these excludes; getting
# it backwards means either skipping the router or uploading 257 GB.
#
# Run via systemd (restic-backup.service, package ctg-pve-backup), which applies resource caps.
set -euo pipefail

source /root/.restic-env
export HOME=/root

# Flag placement: --password-file/--option/--verbose are GLOBAL and must precede
# the subcommand; --exclude*/--read-concurrency belong to `backup` and follow it.
exec restic \
    --password-file /root/.resticpwd \
    --verbose \
    --limit-upload "${CTG_LIMIT_UPLOAD:-6144}" \
    backup \
    --exclude-caches \
    --exclude /root/.cache \
    --exclude /root/.restic-env \
    --exclude /root/.resticpwd \
    --exclude /etc/pve/.rrd \
    --exclude /etc/pve/.clusterlog \
    --exclude /etc/pve/.vmlist \
    --exclude /etc/pve/.members \
    --exclude /etc/pve/.version \
    --exclude '/var/lib/vz/dump/vzdump-qemu-101-*' \
    --exclude '/var/lib/vz/dump/vzdump-qemu-102-*' \
    /etc /root /var/lib/pve-cluster /usr/local/bin /usr/local/sbin /var/spool/cron /var/lib/vz/dump
