Specify restic repository with fully-qualified domain name. Add service and timer unit definitions for restic backup and restic check to repository.

DNS changes: remove global configuration from resolved.conf; add access control and view specification for Docker networks to unbound.conf.
Update Caddyfile to match production.
2026-10-17 22:03:02 -04:00 · 2026-10-11 20:28:08 -04:00 · 2026-10-10 22:04:24 -04:00 · 2026-10-10 21:51:07 -04:00 · 2026-10-08 00:03:22 -04:00 · 2026-09-11 16:46:04 -04:00
7 changed files with 59 additions and 3 deletions
@@ -16,7 +16,7 @@

 # Envvars below will override those in _global.env.sh if present.

-export RESTIC_REPOSITORY="sftp:sftpuser@Cygnus:/Backup/restic/teal"   # *EDIT* fill with your repo name
+export RESTIC_REPOSITORY="sftp:sftpuser@cygnus.objectbrokers.com:/Backup/restic/teal"   # *EDIT* fill with your repo name

 # What to backup. Colon-separated paths e.g. to different mountpoints "/home:/mnt/usb_disk".
 # To backup only your home directory, set "/home/your-user"
@@ -21,8 +21,8 @@
 # Cloudflare: 1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com 2606:4700:4700::1001#cloudflare-dns.com
 # Google:     8.8.8.8#dns.google 8.8.4.4#dns.google 2001:4860:4860::8888#dns.google 2001:4860:4860::8844#dns.google
 # Quad9:      9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::fe#dns.quad9.net 2620:fe::9#dns.quad9.net
-DNS=192.168.88.231 192.168.88.40
-Domains=~objectbrokers.com
+#DNS=192.168.88.231 192.168.88.40
+#Domains=~objectbrokers.com
 #DNSSEC=no
 #DNSOverTLS=no
 #MulticastDNS=no
@@ -0,0 +1,17 @@
+[Unit]
+Description=Backup with restic to Backblaze B2
+# Email on failure require special setup. See README.md
+#OnFailure=status-email-user@%n.service
+# Prevent backup on unmetered connection. Needs special setup. See README.md.
+#Requires=nm-unmetered-connection.service
+#After=nm-unmetered-connection.service
+
+[Service]
+Type=simple
+Nice=10
+# $HOME or $XDG_CACHE_HOME must be set for restic to find /root/.cache/restic/
+Environment="HOME=/root"
+# pipefail: so that redirecting stderr from the script to systemd-cat does not hide the failed command from OnFailure above.
+# Random sleep (in seconds): in the case of multiple backup profiles. Many restic instances started at the same time could case high load or network bandwith usage.
+# `systemd-cat` allows showing the restic output to the systemd journal
+ExecStart=/bin/bash -c 'set -o pipefail; ps cax | grep -q restic && sleep $(shuf -i 0-300 -n 1); source /etc/restic/%I.env.sh && /bin/restic_backup.sh 2>&1 | systemd-cat'
@@ -0,0 +1,9 @@
+[Unit]
+Description=Backup with restic on schedule
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,15 @@
+[Unit]
+Description=Check restic backup Backblaze B2 for errors
+# Email on failure require special setup. See README.md
+#OnFailure=status-email-user@%n.service
+Conflicts=restic-backup.service
+# Prevent backup on unmetered connection. Needs special setup. See README.md.
+#Requires=nm-unmetered-connection.service
+#After=nm-unmetered-connection.service
+
+[Service]
+Type=simple
+Nice=10
+# pipefail: so that redirecting stderr from the script to systemd-cat does not hide the failed command from OnFailure above.
+# `systemd-cat`: allows showing the restic output to the systemd journal
+ExecStart=/bin/bash -c 'set -o pipefail; source /etc/restic/%I.env.sh && /bin/restic_check.sh 2>&1 | systemd-cat'
@@ -0,0 +1,9 @@
+[Unit]
+Description=Check restic backup Backblaze B2 for errors on a schedule
+
+[Timer]
+OnCalendar=monthly
+Persistent=true
+
+[Install]
+WantedBy=timers.target
@@ -27,16 +27,22 @@
    private-address: 100.64.0.0/10

    # addresses from the IP range that are allowed to connect to the resolver
+    # local physical LAN
    access-control: 192.168.88.0/24 allow
    # explicitly allow localhost access
    access-control: 127.0.0.0/8 allow
    # allow Tailnet
    access-control: 100.64.0.0/10 allow
+    # Docker bridge networks (default pool)
+    access-control: 172.16.0.0/12 allow
+    access-control: 192.168.0.0/16 allow
    # uncomment the following line to allow Tailnet IPv6
    # access-control: fd7a:115c:a1e0::/48 allow

    access-control-view: 192.168.88.0/24 lan
    access-control-view: 100.64.0.0/10 tailnet
+    access-control-view: 172.16.0.0/12 lan
+    access-control-view: 192.168.0.0/16 lan
    access-control-view: 127.0.0.0/8 lan
    
    do-ip4: yes
Author	SHA1	Message	Date
cjones	a8e118d267	Specify restic repository with fully-qualified domain name. Add service and timer unit definitions for restic backup and restic check to repository.	2026-10-17 22:03:02 -04:00
cjones	39a87feaf2	DNS changes: remove global configuration from resolved.conf; add access control and view specification for Docker networks to unbound.conf.	2026-10-11 20:28:08 -04:00
cjones	c3a59de697	Update Caddyfile to match production.	2026-10-10 22:04:24 -04:00
cjones	02a625d34a	Make dev branch match master to prepare for further dev work.	2026-10-10 21:51:07 -04:00
cjones	cc20f9bbbc	Caddyfile changes to support PXE serving	2026-10-08 00:03:22 -04:00
cjones	a0f475fa00	Update Caddyfile to match production on Teal.	2026-09-11 16:46:04 -04:00
cjones	65bd2a290b	Add all local devices to DNS	2026-04-12 00:05:03 -04:00