53 lines
2.5 KiB
Markdown
53 lines
2.5 KiB
Markdown
# Backup Policy
|
||
|
||
## Current State (Known Gaps)
|
||
- **No off-site backup** — this is a known gap, improvement pending
|
||
- Serenity has local ZFS snapshots and replication
|
||
- PlausibleDeniability now has repo-documented automated backup scaffolding deployed to PD for Postgres dumps plus rsync replication to Serenity
|
||
|
||
## Serenity Backup Strategy
|
||
- Sanoid snapshots cache/appdata: 7 daily, 4 weekly, 6 monthly
|
||
- Syncoid replicates cache/appdata → malcolm/zfs_backups_array (strict-mirror)
|
||
- qBit Mover script: pauses torrents 0–4 days old then runs Unraid mover
|
||
- Mover Status script: sends Discord webhook notifications
|
||
|
||
## PlausibleDeniability Backup Scope
|
||
Back up at minimum:
|
||
- Compose repo: `/mnt/docker-ssd/docker/compose` (in git — GitHub + Gitea)
|
||
- Local SSD appdata: `/mnt/docker-ssd/docker/appdata/`
|
||
- Databases: `/mnt/docker-ssd/docker/databases/`
|
||
- Selected appdata/backups on tank: `/mnt/tank/docker/`
|
||
- .env files (separately — gitignored, handle via encrypted backup or private repo)
|
||
|
||
## Database Backups
|
||
- Keep app-consistent dumps for major databases
|
||
- Do not rely only on raw volume copies for restores
|
||
- Document restore procedure per major service
|
||
|
||
Recommended dump locations: `/mnt/tank/docker/backups/db-dumps/`
|
||
|
||
Repo-side scaffolding now lives under `automation/`:
|
||
|
||
- `automation/bin/pd_backup_postgres.sh`
|
||
- `automation/bin/pd_backup_sync_to_serenity.sh`
|
||
- `automation/bin/run_pd_backups.sh`
|
||
|
||
These helper scripts are now the live PD backup runner model, with deployment details tracked in `docs/operations/PD_BACKUP_DEPLOYMENT.md`.
|
||
|
||
Recommended live deployment model on PD: a plain **root cron** job invoking `/usr/bin/bash bin/run_pd_backups.sh` from `/mnt/docker-ssd/docker/compose/automation`.
|
||
|
||
## .env File Backup Options
|
||
1. **Private Gitea repo** — short term, push all .env files to a private repo on your local Gitea
|
||
2. **Encrypted restic** — include .env files in restic backup with encryption, push offsite (Backblaze B2)
|
||
3. **Vaultwarden** — store each .env as a secure note (best long-term once deployed)
|
||
|
||
## Restore Practice
|
||
- Test restores quarterly
|
||
- Test at least one app DB restore and one full-config restore
|
||
- Verify that restored stacks can start with current compose files
|
||
|
||
## Operational Notes
|
||
- Media libraries on Unraid are large and may not need the same backup frequency as configs/databases
|
||
- SSD-local DB and SQLite workloads are highest priority for backup validation
|
||
- Serenity malcolm pool is heavily utilized — capacity planning needed before it fills
|