# backup stack

Kopia → Backblaze B2. Backs up `/config`, **selected** `labdata` paths (see `SCOPE.md`), and nightly SQL dumps.

## Before first deploy

1. **Backblaze B2** (recommended offsite — ~$6/TB/mo)
   - Create a bucket (e.g. `valhalla-homelab-backup`)
   - Create an **Application Key** scoped to that bucket
   - Note the S3 endpoint for your region

2. **Fill `stack.env`**
   - `KOPIA_REPOSITORY_PASSWORD` — `openssl rand -hex 32`
   - `B2_KEY_ID`, `B2_APPLICATION_KEY`, `B2_BUCKET`, `B2_ENDPOINT`

3. **Host paths**
   - `/config/kopia/{config,cache,logs}` — Kopia state
   - `/config/backup/dumps` — nightly SQL dumps
   - `/config/backup/{init-kopia.sh,snapshot-paths.txt,crontab,scripts/}` — copied from this repo (Portainer CE cannot bind-mount relative git paths; sync after editing those files)

4. **Register** new Portainer git stack → `stacks/backup` (one-time)

5. **Push** → Portainer redeploys within 5 min

## After deploy

- UI: https://backup.ginnoir.com (LAN/Tailscale) — username `kopia`, password = `KOPIA_REPOSITORY_PASSWORD` in `stack.env`
- Subscribe phone to ntfy topic `backup` (or path in `NTFY_URL`)
- **Restore test** (done 2026-06-11): `postgres_resume` SQL dump + Gitea repos Kopia snapshot from B2

## Schedule

| Time | What |
|------|------|
| 02:50 | `backup-dump-databases.sh` — SQL dumps |
| 03:00 | Kopia snapshots (paths in `snapshot-paths.txt`) |

## If B2 creds are empty

Kopia still starts with UI — configure repository manually, then set policies for each path in `snapshot-paths.txt`.