feat(deploy): hourly off-site backups with restic

learn.halkyon.eu dumps its database every hour (people's files are in it
too) and restic stores the dump encrypted in a Hetzner Storage Box,
keeping 24 hourly, 7 daily, 4 weekly and 3 monthly snapshots. The box's
own snapshots, removable only in Hetzner's Console, protect the backups
from a taken-over server. A systemd timer runs it as deploy; once a day
it also prunes and checks the repository. Failures go to the journal.

Hourly, because a restore costs people who started after the backup
what their device held: the app no longer finds its session and starts
anew. deploy/backups.md describes the setup, the restore and what a
restore loses; both were rehearsed on the local Compose stack.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/backup/halkyon-backup.service

@@ -0,0 +1,24 @@
+# The hourly off-site backup of learn.halkyon.eu, on sahaquiel: deploy/backup.sh, as
+# deploy, started by halkyon-backup.timer. Installed with the timer as
+# /etc/systemd/system/halkyon-backup.service; deploy/backups.md has the steps.
+#
+# deploy is in the docker group, which is as good as root, so sandboxing this unit
+# would protect little: it keeps to the basics.
+[Unit]
+Description=Off-site backup of learn.halkyon.eu's database
+Documentation=file:///home/deploy/halkyon-learn/deploy/backups.md
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=deploy
+Group=deploy
+ExecStart=/home/deploy/halkyon-learn/deploy/backup.sh
+PrivateTmp=yes
+NoNewPrivileges=yes
+ProtectSystem=full
+# Behind the instance for CPU and disk.
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7

deploy/backup/halkyon-backup.timer

@@ -0,0 +1,13 @@
+# Starts halkyon-backup.service at the start of every hour; the run at 03:00,
+# sahaquiel's time (Europe/Berlin), also prunes and checks, done before the security
+# updates may reboot at 04:00. A run missed while sahaquiel was off happens as soon as
+# it is back. Installed as /etc/systemd/system/halkyon-backup.timer.
+[Unit]
+Description=Hourly off-site backup of learn.halkyon.eu
+
+[Timer]
+OnCalendar=hourly
+Persistent=true
+
+[Install]
+WantedBy=timers.target