Initial commit: restic backup configuration

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backup.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+#export RESTIC_REPOSITORY="sftp:glen@thalassa.local:/Users/glen/backups/restic-starbak"
+export RESTIC_REPOSITORY="sftp:glen@192.168.0.247:/Users/glen/backups/restic-starbak"
+export RESTIC_PASSWORD_FILE="${SCRIPT_DIR}/.password"
+
+EXCLUDE_FILE="${SCRIPT_DIR}/excludes.txt"
+
+# Force macOS system ssh — the nix restic wrapper prepends nix openssh to PATH,
+# which lacks macOS network entitlements and fails inside tmux
+SFTP_OPTS=(-o "sftp.command=/usr/bin/ssh glen@192.168.0.247 -s sftp")
+
+if [ ! -f "$RESTIC_PASSWORD_FILE" ]; then
+  echo "Error: Password file not found at $RESTIC_PASSWORD_FILE"
+  echo "Create it with: head -c 32 /dev/urandom | base64 > ${RESTIC_PASSWORD_FILE}"
+  echo "Then: chmod 600 ${RESTIC_PASSWORD_FILE}"
+  exit 1
+fi
+
+case "${1:-backup}" in
+  init)
+    restic "${SFTP_OPTS[@]}" init
+    ;;
+  backup)
+    restic "${SFTP_OPTS[@]}" backup \
+      /Users/glen \
+      --exclude-file="$EXCLUDE_FILE" \
+      --exclude-caches \
+      --one-file-system \
+      --verbose
+    ;;
+  snapshots)
+    restic "${SFTP_OPTS[@]}" snapshots
+    ;;
+  prune)
+    restic "${SFTP_OPTS[@]}" forget \
+      --keep-hourly 24 \
+      --keep-daily 7 \
+      --keep-weekly 4 \
+      --keep-monthly 12 \
+      --keep-yearly 3 \
+      --prune
+    ;;
+  check)
+    restic "${SFTP_OPTS[@]}" check
+    ;;
+  stats)
+    # per-snapshot sizes; pass snapshot ID for a specific one
+    restic "${SFTP_OPTS[@]}" stats "${2:-latest}"
+    ;;
+  diff)
+    # diff two snapshots: ./backup.sh diff <id1> <id2>
+    restic "${SFTP_OPTS[@]}" diff "${2:?snapshot1 ID required}" "${3:?snapshot2 ID required}"
+    ;;
+  mount)
+    MOUNT_POINT="${2:-/tmp/restic-mount}"
+    mkdir -p "$MOUNT_POINT"
+    restic "${SFTP_OPTS[@]}" mount "$MOUNT_POINT"
+    ;;
+  *)
+    echo "Usage: $0 {init|backup|snapshots|prune|check|stats [id]|diff <id1> <id2>|mount [path]}"
+    exit 1
+    ;;
+esac