# =============================================================================
# backup-agent-vps configuration — vps.mildgrim.com
#
# Committed deliberately, matching this project's secret-management policy:
# the archive is age-encrypted, and the S3/Matrix/DB credentials are the same
# values the home agents already carry in their committed .env files.
# =============================================================================

# --- Schedule ---------------------------------------------------------------
# 04:00 Europe/Stockholm, staggered after the two home agents' 03:00 window.
# For a forced test, temporarily change this to a near-future minute and push;
# `podman exec backup-agent-vps backup` is NOT a valid trigger (singleton
# foreground process, output discarded).
#
# Note when planning maintenance: dvb stops every container labelled
# docker-volume-backup.stop-during-backup, and Stalwart carries that label, so
# any window that runs past 04:00 will have the mail container stopped
# underneath it. Move this expression for the night rather than racing it.
BACKUP_CRON_EXPRESSION="0 4 * * *"

# --- Archive shape ----------------------------------------------------------
BACKUP_COMPRESSION="zst"
BACKUP_FILENAME="vps-%Y-%m-%dT%H-%M-%S.{{ .Extension }}"
BACKUP_PRUNING_PREFIX="vps-"
BACKUP_RETENTION_DAYS="14"
BACKUP_PRUNING_LEEWAY="30m"

# --- Encryption -------------------------------------------------------------
# Asymmetric age, reusing the estate recipient. The matching private key lives
# at /home/mildgrim/.config/age/backup-identity.txt on the dev host and must
# stay escrowed outside this repository.
AGE_PUBLIC_KEYS="age12myl7hsh4vkvg8q2xmx8s0d6jkjlnyhnpg53hs4adxjrlca5f5psw52lgj"

# Identifies this agent for label-driven stop/start. Stalwart carries
# docker-volume-backup.exec-label=vps so only this agent acts on it.
EXEC_LABEL="vps"

# --- Destination: SeaweedFS S3 through the VPS edge -------------------------
# s3.mildgrim.com is fronted by the VPS Caddy edge and proxied to SeaweedFS at
# home with path-style addressing. From the VPS this is the documented off-LAN
# route; the LAN address is not reachable directly.
AWS_S3_BUCKET_NAME="backups"
AWS_S3_PATH="backup-agent/vps"
AWS_ACCESS_KEY_ID="mildgrim"
AWS_SECRET_ACCESS_KEY="R3dal3rt"
AWS_ENDPOINT="s3.mildgrim.com"
AWS_ENDPOINT_PROTO="https"
AWS_ENDPOINT_INSECURE="false"
AWS_PART_SIZE="64"

# --- Timezone ---------------------------------------------------------------
TZ="Europe/Stockholm"

# --- Matrix notifications ---------------------------------------------------
# Reuse the estate's backup bot and room.
MATRIX_HOMESERVER="https://matrix.mildgrim.com"
MATRIX_ACCESS_TOKEN="syt_YmFja3VwLWFnZW50_XHMXwtGmelKBaEoNbbla_4EQqgn"
MATRIX_ROOM_ID="!idzeoRKQdKuUsbnHMV:mildgrim.com"

# --- Coverage and freshness -------------------------------------------------
# The check runs daily at 07:00 UTC, after the 04:00 local archive window.
CHECK_TIME="07:00"
DUMP_REFRESH_TIME="02:00"

# --- db-backup connection password -----------------------------------------
# Same value as PG_PASS in authentik/stack.env. Rotate both together or the
# nightly dump silently goes stale.
DBB_AUTHENTIK_PASSWORD="0fsZnZrEF9UnezYjzWFy"
