Backups

Two producers × two plans × two destinations. Verify, don't assume: plan windows live in Backrest (vps-apps) and the restic-backup@ timers (pi-home); this page records what the timers show.

source	driver	plans	local copy	off-site copy
vps-apps	Backrest (:9898)	two daily flows — data, then config	pushed to /mnt/pi-hdd/backups/vps-apps/<branch> over wg-direct	mirrored to gdrive:backups/vps-apps/<branch>
pi-home	native restic-backup@data / @config timers	data 00:00 UTC · config 00:30 UTC	local repos under /mnt/pi-hdd/backups/pi-home/<branch>	mirrored to gdrive:backups/pi-home/<branch>
All 8 repositories (2 hosts × data/config × 2 destinations) are periodically
verified. Restic deduplicates unchanged data, so nightly snapshots stay
cheap.

Locations

node	config root (tracked)	data root
vps-apps	/opt/homelab/vps-apps/<app>/	/opt/homelab-data/<app>/
vps-net	/root/	Docker volumes root_netbird_*
pi-home	systemd units + /etc	dietpi userdata tree

Excluded by design

• /mnt/pi-hdd/share/{open,temp} — scratch drop, disposable.
• Container logs, builder cache, anything docker-prune removes.

Nothing else is excluded: every data-holding application joins the restic set.

Hard rules

1. Opencloud data stays on vps-apps local disk — the ocis data provider panics on NFS; never move it to a network filesystem.
2. A new service with state requires a backup plan in the same change.
3. Never prune or down -v without approval — volumes are data.

Recovery

Procedures: runbooks/restore.md (restic), runbooks/rebuild.md (node-from-scratch), runbooks/netbird-down.md (control-plane loss).