From 38a45194d55ddc4cbd46e15c4f7728ce4978fe4b Mon Sep 17 00:00:00 2001 From: Christopher Jones Date: Sun, 18 Oct 2026 09:50:42 -0400 Subject: [PATCH] Merge DNS changes and adjustments to automated restic backup on teal from dev branch --- devices/teal/config/etc/restic/default.env.sh | 2 +- devices/teal/config/etc/systemd/resolved.conf | 6 +++--- .../etc/systemd/system/restic-backup@.service | 17 +++++++++++++++++ .../etc/systemd/system/restic-backup@.timer | 9 +++++++++ .../etc/systemd/system/restic-check@.service | 15 +++++++++++++++ .../etc/systemd/system/restic-check@.timer | 9 +++++++++ .../config/usr/local/etc/unbound/unbound.conf | 6 ++++++ 7 files changed, 60 insertions(+), 4 deletions(-) create mode 100644 devices/teal/config/etc/systemd/system/restic-backup@.service create mode 100644 devices/teal/config/etc/systemd/system/restic-backup@.timer create mode 100644 devices/teal/config/etc/systemd/system/restic-check@.service create mode 100644 devices/teal/config/etc/systemd/system/restic-check@.timer diff --git a/devices/teal/config/etc/restic/default.env.sh b/devices/teal/config/etc/restic/default.env.sh index 1233da6..95c9ce9 100644 --- a/devices/teal/config/etc/restic/default.env.sh +++ b/devices/teal/config/etc/restic/default.env.sh @@ -16,7 +16,7 @@ # Envvars below will override those in _global.env.sh if present. -export RESTIC_REPOSITORY="sftp:sftpuser@Cygnus:/Backup/restic/teal" # *EDIT* fill with your repo name +export RESTIC_REPOSITORY="sftp:sftpuser@cygnus.objectbrokers.com:/Backup/restic/teal" # *EDIT* fill with your repo name # What to backup. Colon-separated paths e.g. to different mountpoints "/home:/mnt/usb_disk". # To backup only your home directory, set "/home/your-user" diff --git a/devices/teal/config/etc/systemd/resolved.conf b/devices/teal/config/etc/systemd/resolved.conf index aaccefa..c4a7503 100644 --- a/devices/teal/config/etc/systemd/resolved.conf +++ b/devices/teal/config/etc/systemd/resolved.conf @@ -21,9 +21,8 @@ # Cloudflare: 1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com # Google: 8.8.8.8#dns.google 8.8.4.4#dns.google 2001:4860:4860::8888#dns.google 2001:4860:4860::8844#dns.google # Quad9: 9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net -#DNS=192.168.88.1 -DNS=127.0.0.1 -Domains=~objectbrokers.com +#DNS=192.168.88.231 192.168.88.40 +#Domains=~objectbrokers.com #DNSSEC=no #DNSOverTLS=no #MulticastDNS=no @@ -35,3 +34,4 @@ DNSStubListener=no #ReadEtcHosts=yes #ResolveUnicastSingleLabel=no #StaleRetentionSec=0 + diff --git a/devices/teal/config/etc/systemd/system/restic-backup@.service b/devices/teal/config/etc/systemd/system/restic-backup@.service new file mode 100644 index 0000000..b3606cd --- /dev/null +++ b/devices/teal/config/etc/systemd/system/restic-backup@.service @@ -0,0 +1,17 @@ +[Unit] +Description=Backup with restic to Backblaze B2 +# Email on failure require special setup. See README.md +#OnFailure=status-email-user@%n.service +# Prevent backup on unmetered connection. Needs special setup. See README.md. +#Requires=nm-unmetered-connection.service +#After=nm-unmetered-connection.service + +[Service] +Type=simple +Nice=10 +# $HOME or $XDG_CACHE_HOME must be set for restic to find /root/.cache/restic/ +Environment="HOME=/root" +# pipefail: so that redirecting stderr from the script to systemd-cat does not hide the failed command from OnFailure above. +# Random sleep (in seconds): in the case of multiple backup profiles. Many restic instances started at the same time could case high load or network bandwith usage. +# `systemd-cat` allows showing the restic output to the systemd journal +ExecStart=/bin/bash -c 'set -o pipefail; ps cax | grep -q restic && sleep $(shuf -i 0-300 -n 1); source /etc/restic/%I.env.sh && /bin/restic_backup.sh 2>&1 | systemd-cat' diff --git a/devices/teal/config/etc/systemd/system/restic-backup@.timer b/devices/teal/config/etc/systemd/system/restic-backup@.timer new file mode 100644 index 0000000..c492c33 --- /dev/null +++ b/devices/teal/config/etc/systemd/system/restic-backup@.timer @@ -0,0 +1,9 @@ +[Unit] +Description=Backup with restic on schedule + +[Timer] +OnCalendar=daily +Persistent=true + +[Install] +WantedBy=timers.target diff --git a/devices/teal/config/etc/systemd/system/restic-check@.service b/devices/teal/config/etc/systemd/system/restic-check@.service new file mode 100644 index 0000000..92d35bb --- /dev/null +++ b/devices/teal/config/etc/systemd/system/restic-check@.service @@ -0,0 +1,15 @@ +[Unit] +Description=Check restic backup Backblaze B2 for errors +# Email on failure require special setup. See README.md +#OnFailure=status-email-user@%n.service +Conflicts=restic-backup.service +# Prevent backup on unmetered connection. Needs special setup. See README.md. +#Requires=nm-unmetered-connection.service +#After=nm-unmetered-connection.service + +[Service] +Type=simple +Nice=10 +# pipefail: so that redirecting stderr from the script to systemd-cat does not hide the failed command from OnFailure above. +# `systemd-cat`: allows showing the restic output to the systemd journal +ExecStart=/bin/bash -c 'set -o pipefail; source /etc/restic/%I.env.sh && /bin/restic_check.sh 2>&1 | systemd-cat' diff --git a/devices/teal/config/etc/systemd/system/restic-check@.timer b/devices/teal/config/etc/systemd/system/restic-check@.timer new file mode 100644 index 0000000..097fd1e --- /dev/null +++ b/devices/teal/config/etc/systemd/system/restic-check@.timer @@ -0,0 +1,9 @@ +[Unit] +Description=Check restic backup Backblaze B2 for errors on a schedule + +[Timer] +OnCalendar=monthly +Persistent=true + +[Install] +WantedBy=timers.target diff --git a/devices/teal/config/usr/local/etc/unbound/unbound.conf b/devices/teal/config/usr/local/etc/unbound/unbound.conf index 1bf4e2f..cc79d32 100644 --- a/devices/teal/config/usr/local/etc/unbound/unbound.conf +++ b/devices/teal/config/usr/local/etc/unbound/unbound.conf @@ -27,16 +27,22 @@ private-address: 100.64.0.0/10 # addresses from the IP range that are allowed to connect to the resolver + # local physical LAN access-control: 192.168.88.0/24 allow # explicitly allow localhost access access-control: 127.0.0.0/8 allow # allow Tailnet access-control: 100.64.0.0/10 allow + # Docker bridge networks (default pool) + access-control: 172.16.0.0/12 allow + access-control: 192.168.0.0/16 allow # uncomment the following line to allow Tailnet IPv6 # access-control: fd7a:115c:a1e0::/48 allow access-control-view: 192.168.88.0/24 lan access-control-view: 100.64.0.0/10 tailnet + access-control-view: 172.16.0.0/12 lan + access-control-view: 192.168.0.0/16 lan access-control-view: 127.0.0.0/8 lan do-ip4: yes