Ronni Baslund
3831c85285
Host provisioning for the single-server production target: SSH + firewall hardening (nftables allowlist), k3s node registration, bare-metal Stalwart install with systemd units and TLS cert-sync from the cluster secret, and Restic encrypted backup/restore (primary + DR) with timer units. Host-specific secrets live in config.env (gitignored); config.env.example is the template. Also gitignores MemPalace per-project files.
13 lines
313 B
SYSTEMD
13 lines
313 B
SYSTEMD
# Nightly at 03:20 UTC, with a randomized delay so it doesn't hammer the
|
|
# Storage Box at the same second every night. Catches up if the box was off.
|
|
[Unit]
|
|
Description=Run the Dezky host backup nightly
|
|
|
|
[Timer]
|
|
OnCalendar=*-*-* 03:20:00
|
|
RandomizedDelaySec=20min
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|