Working restic restore from snapshot id on boot.

cl.yaml

@@ -19,6 +19,21 @@ systemd:
 
         [Install]
         RequiredBy=local-fs.target
+    - name: restic-restore.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Run once on first boot, if needed, to restore a backup
+        After=docker.service
+        Requires=docker.service
+
+        [Service]
+        Type=oneshot
+        EnvironmentFile=/restic-env
+        ExecStart=/restic-restore.sh
+
+        [Install]
+        WantedBy=multi-user.target
     - name: app.service
       enabled: true
       contents_local: app/app.service
@@ -31,7 +46,7 @@ systemd:
         [Service]
         Type=oneshot
         EnvironmentFile=/restic-env
-        ExecStart=/usr/bin/bash -c "docker run --rm --volume /nassella:/nassella --volume /restic-password:/restic-password -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} -i restic/restic:0.18.0 backup --verbose --repo s3:${BACKBLAZE_BUCKET_URL} --password-file /restic-password /nassella"
+        ExecStart=/usr/bin/bash -c "docker run --rm --volume /nassella:/nassella --volume /restic-password:/restic-password -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} -i restic/restic:0.18.0 backup --verbose --repo s3:${BACKBLAZE_BUCKET_URL} --password-file /restic-password --tag daily_automatic /nassella"
         ExecStopPost=systemctl start app.service
 
     - name: restic-backup.timer
@@ -91,8 +106,20 @@ storage:
       contents:
         local: restic-password
     - path: /restic-env
+      overwrite: true
       contents:
         local: restic-env
+    - path: /restic-restore.sh
+      mode: 0755
+      contents:
+        local: restic-restore.sh
+    - path: /etc/ssh/sshd_config.d/custom.conf
+      overwrite: true
+      mode: 0600
+      contents:
+        inline: |
+          PermitRootLogin no
+          AllowUsers core
     ### docker-compose sysext
     ### https://flatcar.github.io/sysext-bakery/docker_compose/
     - path: /opt/extensions/docker-compose/docker-compose-2.34.0-x86-64.raw