---
# Nightly restic backup of the host to Hetzner Object Storage, one
# repository per region, written independently: losing one region or one
# repository leaves the other complete.

# renovate: datasource=github-releases depName=restic/restic
restic_version: "0.19.1"

restic_password: "{{ vault_restic_password }}"
restic_s3_access_key: "{{ s3_access_key }}"
restic_s3_secret_key: "{{ s3_secret_key }}"

restic_repositories:
  hel1: "s3:https://hel1.your-objectstorage.com/{{ s3_bucket_backups_main }}/restic/{{ inventory_hostname }}"
  fsn1: "s3:https://fsn1.your-objectstorage.com/{{ s3_bucket_backups_repl }}/restic/{{ inventory_hostname }}"

# Dumps and snapshots taken by the hooks land here and are backed up too
restic_stage_dir: /var/backups/restic-stage

restic_paths: [/etc, /opt]
restic_excludes: []
# Shell lines run in order before the backup, with $STAGE set. A failing
# hook marks the run as failed but the backup still runs.
restic_pre_hooks: []

restic_keep: "--keep-daily 7 --keep-weekly 4 --keep-monthly 6"
restic_schedule: "*-*-* 03:30:00"
# Prune (rewrites pack files, so costs S3 requests) once a week only
restic_prune_weekday: Sun

# Failure mail, through Forgejo's SMTP account
restic_alert_smtp_host: smtp.fastmail.com
restic_alert_smtp_port: 587
restic_alert_smtp_user: "{{ vault_forgejo_smtp_user }}"
restic_alert_smtp_password: "{{ vault_forgejo_smtp_password }}"
restic_alert_recipient: "{{ vault_crawler_recipient }}"