# =============================================================================
# backup-agent configuration — docker-node-01 pilot
#
# Verified 2026-10-14 from the LAN:
#   * SeaweedFS S3 API answers on 192.168.1.16:10000 with PATH-STYLE addressing
#     (same as the aws-cli call in backup.sh).
#   * The bucket "backups" exists; "ghost-backups" (what backup.sh targets,
#     backup/.env) DOES NOT, so that script has never uploaded anything.
#   * The bucket is shared with Portainer's own config backups, which sit at the
#     bucket root. The node01- prefix and AWS_S3_PATH below are therefore
#     mandatory, not cosmetic: they are what keeps our archives out of
#     Portainer's files and vice versa.
# =============================================================================

# --- Schedule ---------------------------------------------------------------
# Verified end to end on 2026-10-14 using a temporary 2-minute schedule: the first
# archive is node01-2026-10-14T23-50-00.tar.zst.age (285.3 MiB), confirmed in the
# bucket. Nightly from here on.
#
# Note for future runs: exec-ing `backup` into this container is NOT a valid
# manual trigger. The image runs a singleton `backup -foreground`, so the exec
# exits immediately and its output is discarded, leaving no trace in the logs.
# Change this expression to test instead — that is the supported path.
BACKUP_CRON_EXPRESSION="0 3 * * *"

# --- Archive shape ----------------------------------------------------------
BACKUP_COMPRESSION="zst"
BACKUP_FILENAME="node01-%Y-%m-%dT%H-%M-%S.{{ .Extension }}"
BACKUP_PRUNING_PREFIX="node01-"
BACKUP_RETENTION_DAYS="14"
BACKUP_PRUNING_LEEWAY="30m"

# --- Encryption -------------------------------------------------------------
# age, ASYMMETRIC (switched from a passphrase on 2026-10-15).
#
#   public key  → below, safe to commit
#   private key → /home/mildgrim/.config/age/backup-identity.txt (0600, outside
#                 this repo entirely)
#   decrypt any archive with:  age -d -i <private-key> <archive>.age
#
# Why the switch: a passphrase-encrypted archive can only be decrypted through an
# interactive prompt — no env var, no -i file — which makes verifying a backup
# awkward to automate. A backup nobody has proven readable is a hypothesis.
#
# ESCROW THE PRIVATE KEY. Losing it makes every archive in the bucket unreadable.
# The single archive made before this switch (node01-2026-10-14T23-50-00…) is
# still passphrase-encrypted; that passphrase remains in this file's git history.
AGE_PUBLIC_KEYS="age12myl7hsh4vkvg8q2xmx8s0d6jkjlnyhnpg53hs4adxjrlca5f5psw52lgj"

# Identifies this agent for label-driven custom commands. Any container carrying
# a docker-volume-backup.* label must also set
# docker-volume-backup.exec-label=node-01, so its commands run on this host and
# not the other agent's. Required now that there is more than one agent.
EXEC_LABEL="node-01"

# --- Destination: SeaweedFS S3 (via the VPS edge, path style) ---------------
AWS_S3_BUCKET_NAME="backups"
AWS_S3_PATH="backup-agent/node-01"
AWS_ACCESS_KEY_ID="mildgrim"
AWS_SECRET_ACCESS_KEY="R3dal3rt"
# LAN-direct rather than the VPS edge name. Both work, but the edge routes
# LAN-to-LAN traffic out to the VPS and back over WireGuard: on node-02's first
# run the archive built in 38s and was still uploading 6 minutes later. For
# multi-GB archives that hairpin is the bottleneck. The edge name remains the
# documented fallback for an agent running off-LAN.
#
# GOTCHA (hit on the first run): dvb treats AWS_ENDPOINT as a host authority and
# never appends a port — a value with no port defaults to 443/80 and the upload
# fails *after* the archive has been built and encrypted. Hence the explicit port.
AWS_ENDPOINT="192.168.1.16:10000"
AWS_ENDPOINT_PROTO="http"
AWS_ENDPOINT_INSECURE="false"
AWS_PART_SIZE="64"

# --- Notifications ----------------------------------------------------------
# Left unset for the pilot: check the bucket rather than trusting a ping.
# NOTIFICATION_URLS="matrix://user:pass@host:port/?rooms=!room:host"
# NOTIFICATION_LEVEL="error"

# --- Timezone ---------------------------------------------------------------
TZ="Europe/Stockholm"

# --- Notifications: Matrix ---------------------------------------------------
# Used by the notify-matrix service, which watches this host's outbox and speaks
# for every report in it: coverage failures, stale archives, missing dumps and
# the offsite replication's own state. One credential, one room, everything loud.
#
# An access token, not a password — supply a bot's token, invite the bot to the
# room, and let it post. CHANGE_ME values leave the notifier up but silent, and
# it says so in its log rather than pretending to work.
MATRIX_HOMESERVER="https://matrix.mildgrim.com"
MATRIX_ACCESS_TOKEN="syt_YmFja3VwLWFnZW50_XHMXwtGmelKBaEoNbbla_4EQqgn"
MATRIX_ROOM_ID="!idzeoRKQdKuUsbnHMV:mildgrim.com"

# When the daily coverage and freshness check runs (UTC, like everything else
# here). 06:00 leaves two hours after the agents' 03:00 run.
CHECK_TIME="06:00"
