implement basic automatic backup

.env.example

@@ -6,3 +6,9 @@ JMAP_SERVER_URL=https://m.example.org
 SESSION_SECRET=very_long_string
 SETTINGS_SYNC_ENABLED=true
 ADMIN_PASSWORD=password
+
+# vykar
+VYKAR_LABEL=borgbase
+VYKAR_URL=https://myrepo.repo.borgbase.com
+VYKAR_ACCESS_TOKEN=access_token
+VYKAR_ENCRYPTION_SECRET=very_long_string

README.md

@@ -76,6 +76,16 @@ specifics for everything
 **useful links**
 - https://bulwarkmail.org/docs
 
+## backups
+
+- backups are done with [vykar](https://vykar.borgbase.com) to [borgbase](https://borgbase.com)
+- if on a new borgbase repo, run `vykar init` first
+- to back up automatically, run `sudo EDITOR=micro crontab -e` and add the following:
+  ```
+  TZ=UTC
+  0 * * * * /home/fedora/thingy/scripts/volume-backup.sh
+  ```
+
 ## todo
 - further secure the server (ratelimiting, hardening...)
 - more services

scripts/volume-backup.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+THINGY_DIR="/home/fedora/thingy" # todo: better
+LOG_FILE="/var/log/volume-backup.log"
+
+function log() {
+    echo "[$(date -Iseconds)] $*" | tee -a "$LOG_FILE"
+}
+
+function cleanup() {
+    log "cleanup: starting docker services"
+    docker compose start || true
+    log "└───── backup finished ─────┘"
+}
+trap cleanup EXIT
+
+log "┌────── backup started ─────┐"
+
+cd "$THINGY_DIR"
+
+log "stopping docker services"
+docker compose stop
+
+log "running backup"
+/usr/local/bin/vykar backup

vykar.yaml

@@ -0,0 +1,28 @@
+  env_file: .env
+
+  repositories:
+    - label: ${VYKAR_LABEL}
+      url: ${VYKAR_URL}
+      access_token: ${VYKAR_ACCESS_TOKEN}
+
+  sources:
+    - /var/lib/docker/volumes/
+
+  encryption:
+    mode: "chacha20poly1305"
+    passphrase: ${VYKAR_ENCRYPTION_SECRET}
+
+  retention:
+    keep_daily: 7
+    keep_weekly: 4
+
+  compression:
+    algorithm: zstd
+    zstd_level: 3
+
+  exclude_patterns: # .gitignore style, relative to each source dir
+    - "backingFsBlockDev"
+
+# schedule:
+#   enabled: true
+#   every: "24h"