Backup: switch NAS transport to SMB/CIFS, fix crond/OOM/live-tar defects

Wire the backup service against the Synology share over SMB/CIFS (the NAS
authenticates with a user/password; NFS is IP-allowlist only). Also fixes
three defects found bringing the service up live:

- entrypoint crash-loop: dcron's crond fails "setpgid: Operation not
  permitted" in this runtime -> use busybox crond; make repo-init idempotent
  (check via `restic cat config`, tolerate init-on-existing) so a transient
  CIFS/lock hiccup can't kill PID 1.
- OOM: pg_dump of a ~276MB DB + tar + restic exceeded the 256M cap -> 1G.
- live tar abort: GNU tar exits 1 when TDLib files change mid-read (worker is
  live); per design this is best-effort, so tolerate exit 1, fatal only >=2.

Kuma push is now optional (empty URL disables alerting) since it's deferred.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
2026-07-24 11:36:19 +02:00
co-authored by Claude Opus 4.8
parent ceae4f384b
commit 2e7e6cca9b
5 changed files with 30 additions and 16 deletions
+5 -3
View File
@@ -37,9 +37,11 @@ WORKER_MAX_ZIP_SIZE_MB=4096
MULTIPART_TIMEOUT_HOURS=0
LOG_LEVEL="info"
# Backup (NAS via NFS + restic)
# Backup (NAS via SMB/CIFS + restic)
NAS_HOST="" # Synology NAS IP or hostname reachable from this host
NAS_EXPORT_PATH="" # NFS export path, e.g. /volume1/dragonsstash-backups
NAS_SHARE="" # SMB share name, e.g. dragonsstash_backups
NAS_USERNAME="" # SMB user with read/write on the share
NAS_PASSWORD="" # SMB user password (avoid commas — they delimit cifs mount opts)
RESTIC_PASSWORD="" # generate with: openssl rand -base64 32
KUMA_PUSH_URL="" # Uptime Kuma Push monitor URL (create the monitor first)
KUMA_PUSH_URL="" # optional: Uptime Kuma Push monitor URL; leave empty to disable alerting
TZ="Etc/UTC"