Clément Désiles
ceca06ff2e
Restic-backed backups using a many-to-many repository/job model. - repository = destination: restic repository URL verbatim (s3, local, removable device), backend credentials via env passthrough, retention policy, and an optional per-repository ntfy notify channel - job = source set: paths, sqlite and postgres dumps (consistent .backup / pg_dump instead of torn live-file copies), pushed to one or more repos - systemd timer per job, per-repo + per-job flock serialisation, restic check with read_data_subset for rotating integrity verification Service roles declare what to back up (ntfy_backup_*, uptime_kuma_backup_*); the inventory declares where.
46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
---
|
|
# Ntfy version to deploy
|
|
ntfy_version: latest
|
|
|
|
# Storage location
|
|
ntfy_data_dir: "{{ podman_projects_dir }}/ntfy/data"
|
|
ntfy_cache_dir: "{{ podman_projects_dir }}/ntfy/cache"
|
|
|
|
# Backup manifest - consumed by roles/backup via inventory `backup_jobs`.
|
|
# The ntfy role owns WHAT gets backed up: it knows its storage layout. The
|
|
# operator owns WHERE (repositories, retention, schedule) in the inventory.
|
|
# - cache.db is the ephemeral message cache: excluded, churns every run for
|
|
# no restore value. attachments/ lives under cache/, hence the narrow glob.
|
|
# - user.db holds users, tokens and ACLs: excluded from the live tree and
|
|
# dumped with sqlite3 .backup instead, because copying a live SQLite file
|
|
# yields a torn snapshot (recent writes sit in the -wal sidecar).
|
|
ntfy_backup_paths:
|
|
- "{{ ntfy_data_dir | dirname }}" # project root: data/, cache/, server.yml, ntfy.yaml
|
|
ntfy_backup_exclude:
|
|
- "{{ ntfy_cache_dir }}/cache.db*"
|
|
- "{{ ntfy_data_dir }}/user.db*"
|
|
ntfy_backup_sqlite:
|
|
- "{{ ntfy_data_dir }}/user.db"
|
|
|
|
# Authentication configuration (REQUIRED - must be set explicitly)
|
|
# Ntfy admin user for managing topics and access control
|
|
ntfy_admin_user: admin
|
|
# ntfy_admin_password: "" # Intentionally undefined - role will fail if not set
|
|
|
|
# Network configuration
|
|
ntfy_port: 8090
|
|
|
|
# Container image
|
|
ntfy_image: binwiederhier/ntfy
|
|
|
|
# Server configuration
|
|
ntfy_base_url: http://localhost:{{ ntfy_port }}
|
|
ntfy_behind_proxy: false
|
|
ntfy_enable_signup: false # Disable public signup for security
|
|
ntfy_enable_login: true # Enable authentication
|
|
ntfy_enable_reservations: true # Only authenticated users can reserve topics
|
|
|
|
# Nginx reverse proxy configuration
|
|
ntfy_nginx_enabled: false
|
|
ntfy_nginx_hostname: ntfy.nas.local
|