Add Kopia backup stack with Backblaze B2 offsite target.

Protects /config, selective labdata, and nightly DB dumps; documents homelab improvement plan briefs.
2026-06-10 21:21:34 -05:00
parent 225078afbe
commit 7c7f6dfebc
47 changed files with 3105 additions and 1 deletions
@@ -0,0 +1,85 @@
+# backup stack — Kopia snapshots of /config, selected /storage1/labdata paths, and DB dumps.
+# Scope: stacks/backup/SCOPE.md + snapshot-paths.txt (excludes RomM art, registry, transient dirs).
+#
+# Offsite target: Backblaze B2 (S3-compatible). One-time repo setup — see README.md.
+# Schedule: backup-scheduler dumps databases ~02:50, Kopia snapshots ~03:00 (policy).
+#
+# Env convention: stack.env only (no Portainer UI vars). Kopia UI is internal-only
+# via Caddy after you add backup.ginnoir.com (optional, README).
+
+services:
+  kopia:
+    container_name: kopia
+    image: kopia/kopia:0.17
+    hostname: kopia
+    restart: unless-stopped
+    networks: [backup, edge]
+    env_file:
+      - stack.env
+    environment:
+      - KOPIA_PASSWORD=${KOPIA_REPOSITORY_PASSWORD}
+      - TZ=${TZ}
+      - B2_BUCKET=${B2_BUCKET}
+      - B2_KEY_ID=${B2_KEY_ID}
+      - B2_APPLICATION_KEY=${B2_APPLICATION_KEY}
+      - B2_ENDPOINT=${B2_ENDPOINT}
+    cap_add:
+      - SYS_ADMIN
+    security_opt:
+      - apparmor:unconfined
+    devices:
+      - /dev/fuse:/dev/fuse
+    volumes:
+      - /config/kopia/config:/app/config
+      - /config/kopia/cache:/app/cache
+      - /config/kopia/logs:/app/logs
+      - /config:/backup/config:ro
+      - /config/backup/dumps:/backup/dumps:ro
+      - /storage1/labdata/gitea/repositories:/backup/labdata/gitea/repositories:ro
+      - /storage1/labdata/gitea/lfs:/backup/labdata/gitea/lfs:ro
+      - /storage1/labdata/famapp/minio:/backup/labdata/famapp/minio:ro
+      - /storage1/labdata/resume/minio:/backup/labdata/resume/minio:ro
+      - /storage1/labdata/plane/minio:/backup/labdata/plane/minio:ro
+      - /storage1/labdata/romhacks/metadata:/backup/labdata/romhacks/metadata:ro
+      - /storage1/labdata/romhacks/library:/backup/labdata/romhacks/library:ro
+      - /storage1/labdata/romm/assets:/backup/labdata/romm/assets:ro
+      - ./init-kopia.sh:/init-kopia.sh:ro
+      - ./snapshot-paths.txt:/snapshot-paths.txt:ro
+    ports:
+      - "51515:51515"
+    entrypoint: ["/bin/sh", "/init-kopia.sh"]
+    labels:
+      - "com.centurylabs.watchtower.enable=false"
+
+  backup-scheduler:
+    container_name: backup_scheduler
+    image: alpine:3.20
+    restart: unless-stopped
+    networks: [backup]
+    env_file:
+      - stack.env
+    environment:
+      - TZ=${TZ}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /config/backup/dumps:/dumps
+      - ./scripts/backup-dump-databases.sh:/scripts/backup-dump-databases.sh:ro
+      - ./scripts/backup-run-snapshots.sh:/scripts/backup-run-snapshots.sh:ro
+      - ./snapshot-paths.txt:/snapshot-paths.txt:ro
+      - ./crontab:/etc/crontab:ro
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        apk add --no-cache docker-cli curl tzdata >/dev/null
+        printenv | grep -E '^(NTFY_|TZ=)' > /etc/backup.env || true
+        crond -f -l 8 -c /etc
+    depends_on:
+      - kopia
+
+networks:
+  backup:
+    name: backup
+    driver: bridge
+  edge:
+    name: edge
+    external: true