Criar bucket R2

Cloudflare Dashboard → R2 → Create bucket:

• Name: master7-backup
• Location hint: EU (menor latência pro Brasil) ou Automatic
• Create

Pega credenciais: R2 → Manage R2 API Tokens → Create API Token. Escopo: Object Read & Write. Salva Access Key ID + Secret Access Key.

Instalar rclone na VPS

curl https://rclone.org/install.sh | sudo bash

rclone config
# Selecione: n (new remote)
# name: r2
# Storage: 5 (Amazon S3)
# provider: Cloudflare
# env_auth: 1 (no)
# access_key_id: (cola o do R2)
# secret_access_key: (cola)
# region: auto
# endpoint: https://SEU_ACCOUNT_ID.r2.cloudflarestorage.com
# location_constraint: (deixa vazio)
# acl: private
# y (yes this is OK)
# q (quit)

# Teste:
rclone lsd r2:
# Deve listar o bucket master7-backup

Script de backup diário

sudo mkdir -p /opt/master7-backup
sudo nano /opt/master7-backup/backup.sh

Cola o script:

#!/usr/bin/env bash
set -e
DATE=$(date +%Y-%m-%d_%H%M)
TMP=/tmp/master7-backup-$DATE
mkdir -p $TMP

# 1. Dump databases via Docker
docker exec master7-ops_postgres-master pg_dumpall -U postgres > $TMP/postgres-all.sql

# 2. Tar volumes EasyPanel
tar czf $TMP/easypanel-data.tar.gz /etc/easypanel /var/lib/docker/volumes 2>/dev/null || true

# 3. Tar Caddyfile + sites estáticos
tar czf $TMP/caddy-sites.tar.gz /etc/caddy /home/ghost/sites 2>/dev/null || true

# 4. Upload pra R2
rclone copy $TMP r2:master7-backup/$DATE/ --progress

# 5. Retenção 14 dias (R2 side)
rclone delete r2:master7-backup/ --min-age 14d

# 6. Cleanup local
rm -rf $TMP

echo "Backup $DATE OK"

sudo chmod +x /opt/master7-backup/backup.sh

Cron diário 03:00 AM

sudo crontab -e
# Adiciona:
0 3 * * * /opt/master7-backup/backup.sh >> /var/log/master7-backup.log 2>&1

# Testa uma vez manual:
sudo /opt/master7-backup/backup.sh
tail /var/log/master7-backup.log

Restore drill — CRÍTICO

Vamos simular um restore completo (em pasta de teste, sem destruir produção):

# 1. Baixa último backup
mkdir -p /tmp/restore-drill
cd /tmp/restore-drill
LATEST=$(rclone lsd r2:master7-backup/ | sort -k2 | tail -1 | awk '{print $NF}')
rclone copy r2:master7-backup/$LATEST/ . --progress

# 2. Extrai
ls -lh  # confere tamanhos
tar tzf easypanel-data.tar.gz | head -20
head -20 postgres-all.sql

# 3. Se tudo parece OK, restore real só faria em VPS nova:
# - postgres: psql -U postgres < postgres-all.sql
# - volumes: tar xzf easypanel-data.tar.gz -C /

# 4. Cleanup do drill
rm -rf /tmp/restore-drill

Monitoring básico do backup

# Healthcheck via cronitor.io ou healthchecks.io (grátis 20 checks)
# No final do backup.sh, adiciona:
curl -fsS https://hc-ping.com/SEU-UUID

# Se backup falhar, você recebe email em 1 dia
# (configurado no healthchecks.io)