infra/scripts/nfs-mirror.timer

[Unit]
Description=Weekly local NFS mirror to /mnt/backup

[Timer]
OnCalendar=Mon *-*-* 04:00:00
Persistent=true
RandomizedDelaySec=15min

[Install]
WantedBy=timers.target
backup: consolidate to one local-mirror script + invert offsite filter Before this commit, the in-flight design split anca-elements (its own mirror script + timer) from the rest of /srv/nfs (still going to Synology via inotify-tracked offsite-sync). It also meant Synology received some bytes via both paths (sda → Synology AND direct NFS → Synology), which doubled consumption. This commit collapses both into a clean 3-2-1: Copy 1 (sdc): live /srv/nfs/* + cluster block PVCs Copy 2 (sda): /mnt/backup/{pvc-data,sqlite-backup,pfsense, pve-config,<critical-nfs>/} ← daily-backup + nfs-mirror (one script each) Copy 3 (Synology): /Backup/Viki/{pve-backup,nfs,nfs-ssd} ← offsite-sync-backup Step 1 (sda → Synology) + Step 2 (sda-BYPASS paths only → Synology direct) scripts/nfs-mirror.{sh,service,timer}: New consolidated weekly mirror. Replaces anca-elements-mirror (to be removed in a follow-up after the current in-flight rsync completes, parity-verified, and Synology source-of-truth is deleted). Single rsync /srv/nfs/ → /mnt/backup/ with an explicit EXCLUDES list that drops paths not worth a local 2nd copy: immich (1.2T — too big), frigate (14d ring), prometheus/loki (rebuildable), ollama/llamacpp/ audiblez/ebook2audiobook (re-fetchable), -backup (already backups), temp/alertmanager (transient). Nice=10, IOSchedulingClass=idle. scripts/offsite-sync-backup.sh: Step 2 (NFS → Synology) filter inverted: instead of `--exclude= anca-elements/`, it now `--include`s only the sda-BYPASS paths (immich, frigate, prometheus, -backup, …). The bypass-include regex MUST stay in lockstep with nfs-mirror's EXCLUDES — they are complementary and any drift creates either gaps or duplication on Synology. Comment in the script flags this. monitoring alerts: renamed AncaElementsMirror{Stale,Failing} to NfsMirror{Stale,Failing} matching the new metric job name `nfs-mirror`. Thresholds unchanged. docs/architecture/backup-dr.md: rewritten Step 1/Step 2 sections and added the bypass-list rationale + cross-reference between scripts. NOT YET DEPLOYED — gated on the in-flight anca-elements-mirror rsync finishing + parity verification + Synology /volume1/Backup/Anca/ Elements deletion. The old scripts (anca-elements-{mirror,sync.sh}) remain on the PVE host until then, and will be removed in a cleanup commit. 2026-05-24 12:49:20 +00:00			`[Unit]`
			`Description=Weekly local NFS mirror to /mnt/backup`

			`[Timer]`
			`OnCalendar=Mon --* 04:00:00`
			`Persistent=true`
			`RandomizedDelaySec=15min`

			`[Install]`
			`WantedBy=timers.target`