# Copy this file outside source control, then replace values with local policy.
# Do not put passwords, cloud access keys, or signed URLs here.

# Repository location is non-secret only when it contains no embedded credentials.
RESTIC_REPOSITORY=/path/to/restic-repository
# Store password source separately with restrictive permissions.
RESTIC_PASSWORD_FILE=/secure/path/restic-password

# Stable identity and recovery classes.
RESTIC_HOST=example-host
RESTIC_TAGS="--tag files --tag production"
RESTIC_SOURCES="/path/to/source"
RESTIC_EXCLUDE_FILE=/secure/path/restic.exclude

# Snapshot retention. Review with --dry-run before enabling.
RESTIC_FORGET_ARGS="--keep-last 7 --keep-daily 14 --keep-weekly 8 --keep-monthly 12 --group-by host,paths,tags"

# Maintenance windows must not overlap the primary backup job by default.
# CHECK_CADENCE=weekly-metadata; monthly-sampled-data; quarterly-full-data
# RESTORE_DRILL_CADENCE=quarterly