The tierN bind mounts are absolute symlinks into /srv (compositions/<p>/tierN ->
/srv/com-*-tierN/<p>). Under /:/hostfs those targets are dangling inside the
container (restic reported "does not exist, skipping" for every path). Mount
/srv:/srv:ro at the same path with RESTIC_HOSTFS=/ so restic follows the
symlinks and records the real host paths.
Swap the restic core service for resticontainer
(ghcr.io/deytenit/resticontainer:0.19.1): per-service backup intent via
restic.* compose labels (paths / stop / pre+post hooks), docker socket +
/:/hostfs:ro to resolve container mounts to host paths and snapshot the
union in one restic run. backup/run drops explicit /data/tier1,2 args
(paths now come from labels), keeps init/forget/notify, and guards on a
fresh snapshot. Snapshots are stamped --host <node>.apex.ermnvldmr.com
--tag biweekly and written with --compression max.
- xray gets profiles: [xray] — daedalus/icarus opt in via COMPOSE_PROFILES,
morpheus never runs it.
- loki is routed at /loki on the node FQDN behind basicauth
(APEX_LOKI_BASIC_AUTH from node .env); /loki is loki's native API prefix
so no strip-prefix needed.
- utils/generate-happ-subscriptions + source/ move to daedalus proprietaries;
commons keeps only what every node shares (16 actions now).
deytenit