cloudflare-r2-restic-backuplisted

This skill should be used when setting up a nightly/periodic encrypted backup of a directory (an app's state/data dir, a database dump, an agent's working directory) to a Cloudflare R2 bucket via restic, or when debugging an existing restic-to-R2 systemd timer job. Distinct from the `cloudflare-r2-rclone-backup` skill — that one covers plain `rclone sync` (mirrors a tree as-is, no encryption/dedup/snapshots); this one covers `restic` (client-side encrypted, deduplicated, snapshotted, with retention/pruning) — pick restic whenever the source is app state you'd want point-in-time recovery of, not just an already-static archive worth mirroring. Trigger phrases include "restic backup to R2", "restic R2 repository", "nightly restic backup", "restic systemd timer", "restic keep-daily keep-weekly prune", "restic init repository", "restic check integrity", "restic restore verify", "restic unable to open cache", "R2 access key for restic", "AWS_ACCESS_KEY_ID restic env", "credential assert guard rail ansible", "restic
jackson2w/claude-code-skills · ★ 1 · DevOps & Infrastructure · score 64

Install: claude install-skill jackson2w/claude-code-skills

# Restic backups to Cloudflare R2 Built and verified twice with an identical shape: `dfw` (Vultr VPS, OpenClaw workspace + Vaultwarden + WordPress, 2026-08-16) and `hermes-agent` (Vultr VPS, Hermes gateway state, 2026-09-01). Second build took under an hour end-to-end including a real restore verification — this skill exists so a third doesn't have to re-derive any of it. ## When restic, not rclone `cloudflare-r2-rclone-backup` (sibling skill) mirrors a directory tree as-is — right for content that's already static and just needs an offsite copy (a media library, exported archives). This skill is for **application state you want point-in-time recovery of** — config, databases, session/history stores, anything that changes daily and where "last night's version" matters, not just "a copy exists somewhere." Restic adds client-side encryption, deduplication across snapshots, and a real retention policy (`forget --prune`) that rclone sync doesn't have. ## The reusable shape One `systemd` oneshot service + timer pair, one wrapper script, one Ansible playbook. Deploy per-host under `/opt/<name>-backup/backup.sh` (root:root, mode 0700). ### Wrapper script skeleton ```bash #!/bin/bash set -uo pipefail LOG_FILE=/var/log/<name>-backup.log BACKUP_PATH=/path/to/state/dir set -a source /root/.config/telegram-bot.env # shared fleet alert bot, not the app's own bot source /root/.config/<name>-restic-r2.env # RESTIC_PASSWORD, RESTIC_REPOSITORY, AWS_* set +a exec >>"$LOG_FIL