Add Kopia backup stack with Backblaze B2 offsite target.

Protects /config, selective labdata, and nightly DB dumps; documents homelab improvement plan briefs.

stacks/backup/init-kopia.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+# One-time (or idempotent) Kopia repo + policy setup, then start server UI.
+set -e
+
+CONFIG_DIR=/app/config
+export KOPIA_CONFIG_PATH="${CONFIG_DIR}/repository.config"
+
+mkdir -p "${CONFIG_DIR}" /app/cache /app/logs
+
+# Connect or create B2 repository when credentials are present.
+if [ -n "${B2_KEY_ID}" ] && [ -n "${B2_APPLICATION_KEY}" ] && [ -n "${B2_BUCKET}" ]; then
+  if [ ! -f "${KOPIA_CONFIG_PATH}" ]; then
+    echo "init-kopia: creating S3 repository on bucket ${B2_BUCKET}"
+    kopia repository create s3 \
+      --bucket="${B2_BUCKET}" \
+      --access-key="${B2_KEY_ID}" \
+      --secret-access-key="${B2_APPLICATION_KEY}" \
+      --endpoint="${B2_ENDPOINT}" \
+      --password="${KOPIA_PASSWORD}"
+  else
+    echo "init-kopia: repository config exists, skipping create"
+  fi
+
+  while IFS= read -r path || [ -n "${path}" ]; do
+    case "${path}" in ''|\#*) continue ;; esac
+    kopia policy set "${path}" \
+      --keep-latest 14 \
+      --keep-daily 30 \
+      --keep-weekly 12 \
+      --keep-monthly 24 \
+      --compression=zstd \
+      --snapshot-time=03:00 \
+      --enable-actions=false \
+      2>/dev/null || kopia policy set "${path}" \
+      --keep-latest 14 \
+      --keep-daily 30 \
+      --keep-weekly 12 \
+      --keep-monthly 24 \
+      --compression=zstd \
+      --snapshot-time=03:00
+  done < /snapshot-paths.txt
+else
+  echo "init-kopia: B2 credentials empty — start UI only; configure repo manually (see README)"
+fi
+
+exec kopia server start --ui --insecure --address=0.0.0.0:51515