From 8cd5ec9e16fb9ee684f06c3a4edfd4cd9b6221b8 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sun, 16 Aug 2026 00:57:39 +0800
Subject: [PATCH] iso: ship restic for Settings home backup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Snapper remains root (@) only. Home backup is Settings → Backup
(restic). Restore goes to ~/bos-restore-<id>, not $HOME.
---
 README.md           | 15 ++++++++++-----
 iso/packages.x86_64 |  2 ++
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index d50f3d0..f0987b8 100644
--- a/README.md
+++ b/README.md
@@ -46,9 +46,11 @@ wiring up dotfiles, no per-tool bakery installs.
   Mesa only — **NVIDIA proprietary drivers are not included** and NVIDIA is
   unsupported out of the box (see [docs/hardware.md](docs/hardware.md)).
 - **Resilience**: btrfs + snapper + snap-pac + grub-btrfs snapshots on every
-  pacman transaction; zram swap; ufw firewall (deny-incoming, mDNS allowed).
-  A/B root swapping is **not** implemented. Recovery is a grub-btrfs reboot,
-  not `snapper rollback` (GRUB pins `rootflags=subvol=@`). See
+  pacman transaction (**root `@` only** — snapper does not cover `@home`);
+  home backup is **Settings → Backup** (restic, local path or SFTP); zram
+  swap; ufw firewall (deny-incoming, mDNS allowed). A/B root swapping is
+  **not** implemented. Recovery is a grub-btrfs reboot, not
+  `snapper rollback` (GRUB pins `rootflags=subvol=@`). See
   [docs/hardware.md](docs/hardware.md).
 - **Security**: optional full-disk encryption is **LUKS1** (GRUB cannot unlock
   LUKS2 + Argon2id). Secure Boot is **self-signed Setup Mode only** via
@@ -264,7 +266,8 @@ also get live systemd status + Start/Stop/Restart/Logs.
 | Packages | `bakery` installed list + updates, pacman system update |
 | AUR | Search via `yay`; installing opens a terminal (AUR build scripts need review) |
 | Firmware | `fwupd` device list + updates |
-| Snapshots | `snapper` list (number / date / description); reboot to pick in GRUB (grub-btrfs); delete |
+| Snapshots | `snapper` list (number / date / description); reboot to pick in GRUB (grub-btrfs); delete — **root (`@`) only** |
+| Backup | restic of `$HOME` (`@home`) via Settings → Backup; snapper does not cover home |
 
 Source and build live in the [bos-settings](https://git.breadway.dev/Breadway/bos-settings)
 repo, not here.
@@ -387,7 +390,9 @@ until `dl.breadway.dev/arch` exists).
 
 BOS Settings → Snapshots lists each snapshot’s number, date, and
 description so you know which GRUB entry to pick. It does not roll the
-running root back in place.
+running root back in place. Snapper is root only. Home files are
+**Settings → Backup** (restic restore into `~/bos-restore-<id>`, not
+over `$HOME`).
 
 Do **not** run `snapper rollback`. BOS GRUB pins `rootflags=subvol=@`, so
 a snapper-swapped default subvolume is not what the installed grub.cfg
diff --git a/iso/packages.x86_64 b/iso/packages.x86_64
index 498ed39..ff90edf 100644
--- a/iso/packages.x86_64
+++ b/iso/packages.x86_64
@@ -78,6 +78,8 @@ snapper
 snap-pac
 grub-btrfs
 inotify-tools
+# Home backup (Settings → Backup). Snapper is root (`@`) only; restic covers $HOME.
+restic
 
 # Wayland / Hyprland
 hyprland