# apiscp-borg configuration. Copy to /etc/apiscp-borg/config (root-owned, 0600:
# it holds the repository passphrase). All keys have sane defaults so the engine
# also runs on a stock ApisCP box once BORG_REPO and BORG_PASSPHRASE are set.
#
# This file is sourced by POSIX sh. Quote values; do not add spaces around '='.

# --- repository ---------------------------------------------------------------
# Borg repository location. Either a local path or an ssh URL, e.g.:
#   BORG_REPO="/mnt/backups/apiscp-borg"
#   BORG_REPO="ssh://borg@backup.example.net:22/./apiscp-borg"
BORG_REPO=""

# Repository passphrase. Borg reads BORG_PASSPHRASE from the environment; the
# engine exports whatever is set here. Keep this file 0600 and root-owned.
# For recoverability, back it up off the machine (borg-apiscp-repo backup-key).
BORG_PASSPHRASE=""

# Encryption mode used when CREATING a new repository (repokey keeps the key in
# the repo so only the passphrase is needed to recover). Other modes:
# repokey-blake2 (default), keyfile-blake2 (key stored under ~/.config/borg).
BORG_ENCRYPTION="repokey-blake2"

# Extra SSH options for ssh:// repositories (e.g. a dedicated key). Passed to
# borg via BORG_RSH.
BORG_RSH="ssh -o BatchMode=yes"

# Where the one-time key/passphrase backup is written (store a copy off-machine).
KEY_BACKUP_DIR="/root/apiscp-borg-keys"

# --- what to back up ----------------------------------------------------------
# "all" (default), "none", or a comma-separated list of site ids (site1,site3).
BACKUP_SITES="all"
# Back up the shared system paths (1, default) or skip them (0).
BACKUP_SYSTEM="1"
# Dump and archive per-site databases via ApisCP's site-context export (1) or
# skip (0).
BACKUP_DATABASES="1"
# Extra absolute paths to back up, comma or space separated (default none).
BACKUP_PATHS=""
# Shared system paths and globs (space separated).
SYSTEM_PATHS="/etc /opt"
SYSTEM_GLOBS="/var/log/mailer_table* /var/lib/mysql/mysql-grants* /var/lib/pgsql/*/backups /root/apnscp* /root/license*"
# Comma-separated Borg exclude patterns (globs). The in-site restore staging dir
# /.borg-restore is always excluded.
BACKUP_EXCLUDES=""

# --- retention (borg prune, applied after each run) ---------------------------
# Blank means "no limit" for that bucket. Applied per site archive prefix.
RETENTION_KEEP_WITHIN=""
RETENTION_KEEP_DAILY=""
RETENTION_KEEP_WEEKLY=""
RETENTION_KEEP_MONTHLY=""
RETENTION_KEEP_ANNUAL=""

# --- schedule -----------------------------------------------------------------
# HH:MM for a daily run, or a full systemd OnCalendar expression. Managed via
# the panel or borg-apiscp-repo set-schedule (writes a timer drop-in).
BACKUP_SCHEDULE="03:30"

# --- notifications ------------------------------------------------------------
# Email a report of each run. NOTIFY_EMAIL empty disables it. NOTIFY_ON is
# "failure" (default), "always", or "never". NOTIFY_FROM overrides the sender.
NOTIFY_EMAIL=""
NOTIFY_ON="failure"
NOTIFY_FROM=""

# --- engine internals ---------------------------------------------------------
VIRTBASE="/home/virtual"
STAGE="/var/lib/apiscp-borg"
METRICS_DIR=""
RUN_DB_EXPORT="1"
APNSCP_CMD="/usr/local/apnscp/bin/cmd"
# Optionally also capture ACL/xattr text sidecars (Borg already preserves them
# natively, so this is off by default).
CAPTURE_META_SIDECAR="0"