From 68a7778a7ac8b7cba241a214894be2978a7ac042 Mon Sep 17 00:00:00 2001
From: futile <git@futile.eu>
Date: Sat, 18 Jul 2026 20:54:30 +0100
Subject: [PATCH] implement basic automatic backup

---
 .env.example             |  6 ++++++
 README.md                | 10 ++++++++++
 scripts/volume-backup.sh | 26 ++++++++++++++++++++++++++
 vykar.yaml               | 28 ++++++++++++++++++++++++++++
 4 files changed, 70 insertions(+)
 create mode 100644 scripts/volume-backup.sh
 create mode 100644 vykar.yaml

diff --git a/.env.example b/.env.example
index 99ed170..3b3ba37 100644
--- a/.env.example
+++ b/.env.example
@@ -6,3 +6,9 @@ JMAP_SERVER_URL=https://m.example.org
 SESSION_SECRET=very_long_string
 SETTINGS_SYNC_ENABLED=true
 ADMIN_PASSWORD=password
+
+# vykar
+VYKAR_LABEL=borgbase
+VYKAR_URL=https://myrepo.repo.borgbase.com
+VYKAR_ACCESS_TOKEN=access_token
+VYKAR_ENCRYPTION_SECRET=very_long_string
diff --git a/README.md b/README.md
index e455974..b8fc98d 100644
--- a/README.md
+++ b/README.md
@@ -76,6 +76,16 @@ specifics for everything
 **useful links**
 - https://bulwarkmail.org/docs
 
+## backups
+
+- backups are done with [vykar](https://vykar.borgbase.com) to [borgbase](https://borgbase.com)
+- if on a new borgbase repo, run `vykar init` first
+- to back up automatically, run `sudo EDITOR=micro crontab -e` and add the following:
+  ```
+  TZ=UTC
+  0 * * * * /home/fedora/thingy/scripts/volume-backup.sh
+  ```
+
 ## todo
 - further secure the server (ratelimiting, hardening...)
 - more services
diff --git a/scripts/volume-backup.sh b/scripts/volume-backup.sh
new file mode 100644
index 0000000..7af511f
--- /dev/null
+++ b/scripts/volume-backup.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+THINGY_DIR="/home/fedora/thingy" # todo: better
+LOG_FILE="/var/log/volume-backup.log"
+
+function log() {
+    echo "[$(date -Iseconds)] $*" | tee -a "$LOG_FILE"
+}
+
+function cleanup() {
+    log "cleanup: starting docker services"
+    docker compose start || true
+    log "└───── backup finished ─────┘"
+}
+trap cleanup EXIT
+
+log "┌────── backup started ─────┐"
+
+cd "$THINGY_DIR"
+
+log "stopping docker services"
+docker compose stop
+
+log "running backup"
+/usr/local/bin/vykar backup
diff --git a/vykar.yaml b/vykar.yaml
new file mode 100644
index 0000000..cafa4d2
--- /dev/null
+++ b/vykar.yaml
@@ -0,0 +1,28 @@
+  env_file: .env
+
+  repositories:
+    - label: ${VYKAR_LABEL}
+      url: ${VYKAR_URL}
+      access_token: ${VYKAR_ACCESS_TOKEN}
+
+  sources:
+    - /var/lib/docker/volumes/
+
+  encryption:
+    mode: "chacha20poly1305"
+    passphrase: ${VYKAR_ENCRYPTION_SECRET}
+
+  retention:
+    keep_daily: 7
+    keep_weekly: 4
+
+  compression:
+    algorithm: zstd
+    zstd_level: 3
+
+  exclude_patterns: # .gitignore style, relative to each source dir
+    - "backingFsBlockDev"
+
+# schedule:
+#   enabled: true
+#   every: "24h"