DOCS-1: Init document work

content/vps/automated-backups.md

@@ -0,0 +1,253 @@
+---
+title: "Set Up Automated Backups with Restic"
+description: "Automate encrypted off-site backups on your Arcline VPS using restic."
+section: vps
+order: 6
+---
+
+# Set Up Automated Backups with Restic
+
+Restic is a fast, encrypted backup tool that supports local and remote storage backends (SFTP, S3, B2, rsync.net). This guide covers backing up your VPS to a remote repository.
+
+---
+
+## Prerequisites
+
+- A VPS with sudo access
+- A backup destination (SFTP server, Backblaze B2, or local storage)
+
+---
+
+## Step 1 — Install restic
+
+```bash
+sudo apt update
+sudo apt install restic -y
+```
+
+Verify:
+
+```bash
+restic version
+```
+
+---
+
+## Step 2 — Initialize a repository
+
+### Option A: SFTP/SSH (recommended for Arcline customers)
+
+If you have SSH access to a backup server:
+
+```bash
+restic init --repo sftp:backup@backup-server:/var/backups/example-vps/
+```
+
+You'll be prompted for a repository password — this encrypts your backups. Store it in a password manager — if you lose it, you cannot recover your data.
+
+### Option B: Backblaze B2
+
+```bash
+export B2_ACCOUNT_ID="your-application-key-id"
+export B2_ACCOUNT_KEY="your-application-key"
+restic init --repo b2:bucket-name:/example-vps
+```
+
+### Option C: Local directory
+
+```bash
+sudo mkdir -p /backups/example-vps-repo
+restic init --repo /backups/example-vps-repo
+```
+
+---
+
+## Step 3 — Create a backup script
+
+```bash
+sudo nano /usr/local/bin/backup.sh
+```
+
+```bash
+#!/bin/bash
+set -e
+
+# Repository location and password
+export RESTIC_REPOSITORY="sftp:backup@backup-server:/var/backups/example-vps/"
+export RESTIC_PASSWORD="your-repo-password"
+
+# Files and directories to back up
+BACKUP_PATHS=(
+    /var/www
+    /etc/nginx
+    /etc/letsencrypt
+    /opt
+    /home
+)
+
+# Directories to exclude
+EXCLUDE_PATTERNS=(
+    --exclude "/var/www/example.com/cache"
+    --exclude "*.log"
+)
+
+echo "Starting backup at $(date)"
+
+# Create the backup
+restic backup "${EXCLUDE_PATTERNS[@]}" "${BACKUP_PATHS[@]}"
+
+# Keep last 7 daily, 4 weekly, 6 monthly snapshots
+restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
+
+echo "Backup completed at $(date)"
+```
+
+Make it executable:
+
+```bash
+sudo chmod +x /usr/local/bin/backup.sh
+```
+
+---
+
+## Step 4 — Test the backup
+
+Run the backup manually:
+
+```bash
+sudo /usr/local/bin/backup.sh
+```
+
+List snapshots:
+
+```bash
+restic -r sftp:backup@backup-server:/var/backups/example-vps/ snapshots
+```
+
+> You'll need `RESTIC_PASSWORD` exported or passed via `--password-file` for any restic command.
+
+---
+
+## Step 5 — Schedule daily backups with systemd
+
+Create a service file:
+
+```bash
+sudo nano /etc/systemd/system/restic-backup.service
+```
+
+```ini
+[Unit]
+Description=Restic backup
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/backup.sh
+```
+
+Create a timer:
+
+```bash
+sudo nano /etc/systemd/system/restic-backup.timer
+```
+
+```ini
+[Unit]
+Description=Daily restic backup
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=3600
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+```
+
+Enable and start the timer:
+
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable restic-backup.timer
+sudo systemctl start restic-backup.timer
+```
+
+Verify:
+
+```bash
+sudo systemctl status restic-backup.timer
+sudo systemctl list-timers | grep restic
+```
+
+---
+
+## Step 6 — Restoring from a backup
+
+List available snapshots:
+
+```bash
+restic -r sftp:backup@backup-server:/var/backups/example-vps/ snapshots
+```
+
+Restore the latest snapshot:
+
+```bash
+restic -r sftp:backup@backup-server:/var/backups/example-vps/ restore latest --target /tmp/restore
+```
+
+Or restore a specific snapshot by ID:
+
+```bash
+restic -r ... restore <snapshot-id> --target /tmp/restore
+```
+
+To restore only specific paths:
+
+```bash
+restic -r ... restore <snapshot-id> --target /tmp/restore --path /var/www
+```
+
+---
+
+## Step 7 — Database backups
+
+For MySQL databases, add a pre-backup dump step:
+
+```bash
+#!/bin/bash
+set -e
+
+# Dump all databases
+mysqldump --all-databases --single-transaction --quick | gzip > /tmp/mysql-all.sql.gz
+
+# Include the dump in the backup
+restic backup --hostname example-vps /tmp/mysql-all.sql.gz "${BACKUP_PATHS[@]}"
+
+rm /tmp/mysql-all.sql.gz
+```
+
+---
+
+## Monitoring backups
+
+Add a health check notification:
+
+```bash
+# After successful backup
+curl -fsS -m 10 --retry 5 https://hc-ping.com/your-uuid
+
+# Or on failure, notify via Discord/Slack webhook
+curl -fsS -m 10 -X POST -H "Content-Type: application/json" \
+  -d '{"content":"Backup failed on example-vps"}' \
+  https://discord.com/api/webhooks/your-webhook-url
+```
+
+---
+
+## What's next
+
+- [Install fail2ban](/vps/fail2ban/) for SSH brute-force protection
+- [Set up a Go service](/vps/go-systemd/) with systemd
+