Specify restic repository with fully-qualified domain name. Add service and timer unit definitions for restic backup and restic check to repository.

devices/teal/config/etc/restic/default.env.sh

@@ -16,7 +16,7 @@
 
 # Envvars below will override those in _global.env.sh if present.
 
-export RESTIC_REPOSITORY="sftp:sftpuser@Cygnus:/Backup/restic/teal"   # *EDIT* fill with your repo name
+export RESTIC_REPOSITORY="sftp:sftpuser@cygnus.objectbrokers.com:/Backup/restic/teal"   # *EDIT* fill with your repo name
 
 # What to backup. Colon-separated paths e.g. to different mountpoints "/home:/mnt/usb_disk".
 # To backup only your home directory, set "/home/your-user"

devices/teal/config/etc/systemd/resolved.conf

@@ -21,8 +21,8 @@
 # Cloudflare: 1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com
 # Google:     8.8.8.8#dns.google 8.8.4.4#dns.google 2001:4860:4860::8888#dns.google 2001:4860:4860::8844#dns.google
 # Quad9:      9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
-DNS=192.168.88.231 192.168.88.40
+#DNS=192.168.88.231 192.168.88.40
-Domains=~objectbrokers.com
+#Domains=~objectbrokers.com
 #DNSSEC=no
 #DNSOverTLS=no
 #MulticastDNS=no

devices/teal/config/etc/systemd/system/restic-backup@.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Backup with restic to Backblaze B2
+# Email on failure require special setup. See README.md
+#OnFailure=status-email-user@%n.service
+# Prevent backup on unmetered connection. Needs special setup. See README.md.
+#Requires=nm-unmetered-connection.service
+#After=nm-unmetered-connection.service
+
+[Service]
+Type=simple
+Nice=10
+# $HOME or $XDG_CACHE_HOME must be set for restic to find /root/.cache/restic/
+Environment="HOME=/root"
+# pipefail: so that redirecting stderr from the script to systemd-cat does not hide the failed command from OnFailure above.
+# Random sleep (in seconds): in the case of multiple backup profiles. Many restic instances started at the same time could case high load or network bandwith usage.
+# `systemd-cat` allows showing the restic output to the systemd journal
+ExecStart=/bin/bash -c 'set -o pipefail; ps cax | grep -q restic && sleep $(shuf -i 0-300 -n 1); source /etc/restic/%I.env.sh && /bin/restic_backup.sh 2>&1 | systemd-cat'

devices/teal/config/etc/systemd/system/restic-backup@.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Backup with restic on schedule
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+
+[Install]
+WantedBy=timers.target

devices/teal/config/etc/systemd/system/restic-check@.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Check restic backup Backblaze B2 for errors
+# Email on failure require special setup. See README.md
+#OnFailure=status-email-user@%n.service
+Conflicts=restic-backup.service
+# Prevent backup on unmetered connection. Needs special setup. See README.md.
+#Requires=nm-unmetered-connection.service
+#After=nm-unmetered-connection.service
+
+[Service]
+Type=simple
+Nice=10
+# pipefail: so that redirecting stderr from the script to systemd-cat does not hide the failed command from OnFailure above.
+# `systemd-cat`: allows showing the restic output to the systemd journal
+ExecStart=/bin/bash -c 'set -o pipefail; source /etc/restic/%I.env.sh && /bin/restic_check.sh 2>&1 | systemd-cat'

devices/teal/config/etc/systemd/system/restic-check@.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Check restic backup Backblaze B2 for errors on a schedule
+
+[Timer]
+OnCalendar=monthly
+Persistent=true
+
+[Install]
+WantedBy=timers.target

devices/teal/config/usr/local/etc/unbound/unbound.conf

@@ -27,16 +27,22 @@
     private-address: 100.64.0.0/10
 
     # addresses from the IP range that are allowed to connect to the resolver
+    # local physical LAN
     access-control: 192.168.88.0/24 allow
     # explicitly allow localhost access
     access-control: 127.0.0.0/8 allow
     # allow Tailnet
     access-control: 100.64.0.0/10 allow
+    # Docker bridge networks (default pool)
+    access-control: 172.16.0.0/12 allow
+    access-control: 192.168.0.0/16 allow
     # uncomment the following line to allow Tailnet IPv6
     # access-control: fd7a:115c:a1e0::/48 allow
 
     access-control-view: 192.168.88.0/24 lan
     access-control-view: 100.64.0.0/10 tailnet
+    access-control-view: 172.16.0.0/12 lan
+    access-control-view: 192.168.0.0/16 lan
     access-control-view: 127.0.0.0/8 lan
     
     do-ip4: yes