added backup script

README.md

@@ -81,3 +81,87 @@ docker compose -f stacks/media/compose.yaml down
 | **Storage**   |                      |           |
 | Gitea         | 3000, 222            | storage   |
 | Copyparty     | 3923                 | storage   |
+
+## Backup
+
+Backups use [Restic](https://restic.net/). The script backs up `/srv/homelab` (including `data/`), `/etc/caddy/Caddyfile`, and `/etc/unbound/unbound.conf`. It **stops all Docker stacks** before backup for consistent data, then starts them again—run it manually when you can afford a few minutes of downtime.
+
+### One-time setup
+
+1. Install restic (e.g. `pacman -S restic` or from [restic.net](https://restic.net/)).
+
+2. Copy the env example and set repository and password:
+
+   ```bash
+   cp scripts/restic-backup.env.example scripts/restic-backup.env
+   # Edit scripts/restic-backup.env: set RESTIC_REPOSITORY and RESTIC_PASSWORD
+   ```
+
+   Examples for `RESTIC_REPOSITORY`:
+   - Local: `RESTIC_REPOSITORY=/backup/restic`
+   - SFTP: `RESTIC_REPOSITORY=sftp:user@backup-host:/restic`
+   - S3: `RESTIC_REPOSITORY=s3:s3.amazonaws.com/bucket-name`
+
+3. Initialize the repo (once):
+
+   ```bash
+   export RESTIC_PASSWORD='your-password'
+   restic -r /backup/restic init   # use your actual repo path
+   ```
+
+### Create a backup
+
+From the repo root, run:
+
+```bash
+sudo ./scripts/restic-backup.sh
+```
+
+Stacks are stopped, then the backup runs, then they are started again. A failed backup still triggers the start so the homelab comes back up.
+
+### Inspect backups
+
+List snapshots (IDs and timestamps):
+
+```bash
+source scripts/restic-backup.env
+sudo restic snapshots -r $RESTIC_REPOSITORY
+```
+
+List files in a snapshot (e.g. latest or by ID):
+
+```bash
+restic ls latest -r $RESTIC_REPOSITORY
+restic ls -r $RESTIC_REPOSITORY <snapshot-id>
+```
+
+Browse a path inside a snapshot:
+
+```bash
+restic ls latest -r $RESTIC_REPOSITORY /srv/homelab/config 
+```
+
+### See diffs between backups
+
+Compare two snapshots (added, changed, removed files and content diff):
+
+```bash
+restic diff <older-snapshot-id> <newer-snapshot-id> -r $RESTIC_REPOSITORY
+```
+
+### Restore
+
+Restore the latest snapshot into a directory (does not overwrite the repo; use a separate target dir):
+
+```bash
+restic restore latest --target /tmp/restore -r $RESTIC_REPOSITORY
+```
+
+Restore a specific snapshot or path:
+
+```bash
+restic restore <snapshot-id> --target /tmp/restore -r $RESTIC_REPOSITORY
+restic restore latest --path /etc/caddy --target /tmp/restore -r $RESTIC_REPOSITORY
+```
+
+After restore, fix ownership on `data/` if needed (see [Monitoring permissions](#2-monitoring-permissions)).