Skip to content

name: reference-forge-backup description: Nightly encrypted offsite backup, restic to Google Drive + GitHub push; covers forge, secrets, Claude memory, ERPNext/n8n/HA dumps; restore guide type: reference

Forge nightly offsite backup

Built 2026-06-10. Script: scripts/forge_backup_nightly.sh, scheduled by user-level systemd timer forge-backup.timer on Console at 03:30 daily (after Finn's 02:00 workspace rsync).

What it protects

Item How
Forge committed work git push origin main to github.com/JustinWieb/forge
Forge full tree (incl. untracked data/, finance.db) restic snapshot
~/.forge-secrets/ restic snapshot (restic encrypts client-side, safe in cloud)
Claude project memory (~/.claude/projects/-home-justinwieb-forge/memory/) restic snapshot
ERPNext (all 5 companies, accounting) nightly mariadb-dump --all-databases from biz-apps CT 104, gzipped
n8n workflows + credentials sqlite .backup of n8n_n8n_data volume DB + config file (holds the encryption key)
Home Assistant config ha backups new --folders homeassistant, copied off VM 100, then removed there

Staging for dumps: /home/justinwieb/forge-backup-staging/ (overwritten nightly, idempotent). Excluded from restic: forge/logs, node_modules, __pycache__, venvs.

Destination and crypto

  • Repo: rclone:gdrive:forge-backup (folder forge-backup/ on the Google Drive account behind Finn's rclone remote gdrive; ~5.9TB free as of 2026-06-10).
  • restic runs on Console but drives Finn's rclone over SSH: -o rclone.program="ssh finn rclone". No Drive credentials exist on Console.
  • Secrets: ~/.forge-secrets/restic.env (RESTIC_REPOSITORY, RESTIC_PASSWORD). The password is the only way to read backups; copy lives in NordPass under "Forge restic backup".
  • Retention: 7 daily, 4 weekly, 6 monthly. restic prune + restic check run Sundays.
  • Failure notifies critical via scripts/forge_notify.sh; success is silent. Log: forge/logs/backup-nightly.log.

Restore (disaster scenario: Console or Finn is gone)

  1. Any Linux box: install restic + rclone, rclone config a Drive remote named gdrive (login as the Drive account), get password from NordPass.
  2. export RESTIC_REPOSITORY=rclone:gdrive:forge-backup RESTIC_PASSWORD=<from NordPass>
  3. restic snapshots to list; restic restore latest --target /restore
  4. Code/history alternative: git clone https://github.com/JustinWieb/forge
  5. ERPNext: load erpnext_all_databases.sql.gz into a fresh frappe_docker MariaDB. n8n: drop n8n_database.sqlite + n8n_config.json into a fresh n8n data volume. HA: restore ha_config_backup.tar via HA onboarding "restore from backup".

Gotchas

  • If the Google account behind gdrive: changes during the Workspace consolidation, re-point Finn's rclone remote and move the forge-backup/ folder, or backups silently land nowhere (restic will fail loud, notify fires).
  • Workspace/media drives are intentionally NOT in scope: covered by Finn's nightly rsync + offline drive at friend's house (rotated ~5 months).

[Claude Code]