schema_version: "1.0"

backup_root: /opt/backup/railiance/infra
recipient_policy: .sops.yaml
recipients:
  - age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4

retention:
  keep_complete_bundles: 7
  max_total_bytes: 268435456
  freshness_hours: 26

offsite:
  required_before_prune: true
  receipt_root: /opt/backup/railiance/infra/offsite-receipts

artifacts:
  os-config:
    format: tar.gz
    paths:
      - path: /etc/ssh/sshd_config
        required: true
        expected_mode: "0644"
      - path: /etc/ssh/sshd_config.d
        required: false
      - path: /etc/ufw/ufw.conf
        required: false
      - path: /etc/ufw/user.rules
        required: false
      - path: /etc/ufw/user6.rules
        required: false
      - path: /etc/fail2ban/jail.local
        required: false
      - path: /etc/fail2ban/jail.d
        required: false
      - path: /etc/hosts
        required: true
        expected_mode: "0644"
      - path: /etc/hostname
        required: true
        expected_mode: "0644"
      - path: /etc/apt/sources.list.d
        required: false
  packages:
    format: dpkg-selections
    command: [dpkg, --get-selections]

excluded_prefixes:
  - /etc/age
  - /etc/kubernetes
  - /etc/rancher
  - /etc/sops
  - /etc/ssl/private
  - /home
  - /root
  - /var/lib/kubelet
  - /var/lib/rancher