From 7daba4343e3518deca587de3853bf875549fc4c3 Mon Sep 17 00:00:00 2001
From: Chris Zerafa <chris@zerafa.com>
Date: Mon, 27 Jul 2026 22:40:58 -0400
Subject: [PATCH] Add automated Restic backups for edge01

---
 .gitignore                                    |  4 +++
 edge01/restic/edge01.env.example              |  4 +++
 edge01/restic/restic-edge01-backup            | 25 +++++++++++++++++++
 edge01/restic/restic-edge01-backup.service    | 11 ++++++++
 edge01/restic/restic-edge01-backup.timer      | 11 ++++++++
 edge01/restic/restic-edge01-retention         | 24 ++++++++++++++++++
 edge01/restic/restic-edge01-retention.service | 11 ++++++++
 edge01/restic/restic-edge01-retention.timer   | 11 ++++++++
 8 files changed, 101 insertions(+)
 create mode 100644 edge01/restic/edge01.env.example
 create mode 100755 edge01/restic/restic-edge01-backup
 create mode 100644 edge01/restic/restic-edge01-backup.service
 create mode 100644 edge01/restic/restic-edge01-backup.timer
 create mode 100755 edge01/restic/restic-edge01-retention
 create mode 100644 edge01/restic/restic-edge01-retention.service
 create mode 100644 edge01/restic/restic-edge01-retention.timer

diff --git a/.gitignore b/.gitignore
index fc87922..5c091f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,7 @@ presharedkey
 # Environment and credential files
 .env
 .env.*
+
+# Restic credentials
+*.env
+!*.env.example
diff --git a/edge01/restic/edge01.env.example b/edge01/restic/edge01.env.example
new file mode 100644
index 0000000..1d1145d
--- /dev/null
+++ b/edge01/restic/edge01.env.example
@@ -0,0 +1,4 @@
+export RESTIC_REPOSITORY="b2:zerafa-infrastructure:/edge01"
+export B2_ACCOUNT_ID="REPLACE_ME"
+export B2_ACCOUNT_KEY="REPLACE_ME"
+export RESTIC_PASSWORD="REPLACE_ME"
diff --git a/edge01/restic/restic-edge01-backup b/edge01/restic/restic-edge01-backup
new file mode 100755
index 0000000..6a5baf8
--- /dev/null
+++ b/edge01/restic/restic-edge01-backup
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source /etc/restic/edge01.env
+
+exec 9>/run/restic-edge01.lock
+
+if ! flock -n 9; then
+    echo "Another Restic operation is already running."
+    exit 1
+fi
+
+echo "Starting edge01 backup at $(date --iso-8601=seconds)"
+
+restic backup \
+    /etc \
+    /home/debian \
+    /opt \
+    --exclude /opt/backups \
+    --exclude '/opt/docker/gitea/data/git/repositories/*/*.git/tmp' \
+    --tag edge01 \
+    --tag automatic
+
+echo "Backup completed at $(date --iso-8601=seconds)"
diff --git a/edge01/restic/restic-edge01-backup.service b/edge01/restic/restic-edge01-backup.service
new file mode 100644
index 0000000..ca6ef0a
--- /dev/null
+++ b/edge01/restic/restic-edge01-backup.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Restic backup of edge01 to Backblaze B2
+Wants=network-online.target
+After=network-online.target docker.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/restic-edge01-backup
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
diff --git a/edge01/restic/restic-edge01-backup.timer b/edge01/restic/restic-edge01-backup.timer
new file mode 100644
index 0000000..e97e8e4
--- /dev/null
+++ b/edge01/restic/restic-edge01-backup.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Nightly Restic backup of edge01
+
+[Timer]
+OnCalendar=*-*-* 03:15:00
+RandomizedDelaySec=10m
+Persistent=true
+Unit=restic-edge01-backup.service
+
+[Install]
+WantedBy=timers.target
diff --git a/edge01/restic/restic-edge01-retention b/edge01/restic/restic-edge01-retention
new file mode 100755
index 0000000..37c5652
--- /dev/null
+++ b/edge01/restic/restic-edge01-retention
@@ -0,0 +1,24 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source /etc/restic/edge01.env
+
+exec 9>/run/restic-edge01.lock
+
+if ! flock -n 9; then
+    echo "Another Restic operation is already running."
+    exit 1
+fi
+
+echo "Starting Restic retention at $(date --iso-8601=seconds)"
+
+restic forget \
+    --host edge01 \
+    --tag automatic \
+    --keep-daily 7 \
+    --keep-weekly 4 \
+    --keep-monthly 12 \
+    --prune
+
+echo "Retention completed at $(date --iso-8601=seconds)"
diff --git a/edge01/restic/restic-edge01-retention.service b/edge01/restic/restic-edge01-retention.service
new file mode 100644
index 0000000..bb74163
--- /dev/null
+++ b/edge01/restic/restic-edge01-retention.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Restic retention and pruning for edge01
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/restic-edge01-retention
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
diff --git a/edge01/restic/restic-edge01-retention.timer b/edge01/restic/restic-edge01-retention.timer
new file mode 100644
index 0000000..5bc4204
--- /dev/null
+++ b/edge01/restic/restic-edge01-retention.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Weekly Restic retention for edge01
+
+[Timer]
+OnCalendar=Sun *-*-* 04:15:00
+RandomizedDelaySec=15m
+Persistent=true
+Unit=restic-edge01-retention.service
+
+[Install]
+WantedBy=timers.target