Add Kopia backup stack with Backblaze B2 offsite target.

Protects /config, selective labdata, and nightly DB dumps; documents homelab improvement plan briefs.

stacks/backup/README.md

@@ -0,0 +1,39 @@
+# backup stack
+
+Kopia → Backblaze B2. Backs up `/config`, **selected** `labdata` paths (see `SCOPE.md`), and nightly SQL dumps.
+
+## Before first deploy
+
+1. **Backblaze B2** (recommended offsite — ~$6/TB/mo)
+   - Create a bucket (e.g. `valhalla-homelab-backup`)
+   - Create an **Application Key** scoped to that bucket
+   - Note the S3 endpoint for your region
+
+2. **Fill `stack.env`**
+   - `KOPIA_REPOSITORY_PASSWORD` — `openssl rand -hex 32`
+   - `B2_KEY_ID`, `B2_APPLICATION_KEY`, `B2_BUCKET`, `B2_ENDPOINT`
+
+3. **Host paths** (auto-created on first start if missing)
+   - `/config/kopia/{config,cache,logs}`
+   - `/config/backup/dumps`
+
+4. **Register** new Portainer git stack → `stacks/backup` (one-time)
+
+5. **Push** → Portainer redeploys within 5 min
+
+## After deploy
+
+- UI: `http://valhalla:51515` (or add `backup.ginnoir.com` internal-only in Caddy)
+- Subscribe phone to ntfy topic `backup` (or path in `NTFY_URL`)
+- **Restore test** (do once): pick a small dump from `/config/backup/dumps/`, restore to a throwaway container
+
+## Schedule
+
+| Time | What |
+|------|------|
+| 02:50 | `backup-dump-databases.sh` — SQL dumps |
+| 03:00 | Kopia snapshots (paths in `snapshot-paths.txt`) |
+
+## If B2 creds are empty
+
+Kopia still starts with UI — configure repository manually, then set policies for each path in `snapshot-paths.txt`.