feat(conf): the panel's backups are copied off site every day

The daily backups stayed on the panel's host, so losing the host lost
them too. webvirt-offsite.timer now copies them at 03:45 with restic
over SFTP to another server, encrypted with a password only the
administrator and the host hold, and keeps 7 daily, 4 weekly and 6
monthly copies. It runs on the host as root, with Docker too, outside
the panel and its image. It fails when the newest backup is older
than 26 hours, so a stopped panel backup shows; an optional heartbeat
URL is called after each good copy.

The README has the setup, how to get a backup back from the copies,
and a fix found by the drill: moving to a new machine stopped when
the backup had no SSH keys (a panel without SSH computes).

conf/systemd/webvirt-offsite.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Copy the WebVirtCloud panel backups off site
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+UMask=0077
+EnvironmentFile=/etc/webvirtcloud-offsite.env
+ExecStart=/usr/local/sbin/webvirt-offsite

conf/systemd/webvirt-offsite.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily off-site copy of the WebVirtCloud panel backups
+
+[Timer]
+# after the panel's backup at 03:15
+OnCalendar=*-*-* 03:45
+Persistent=true
+
+[Install]
+WantedBy=timers.target

conf/webvirt-offsite.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+# Copies the panel's backups to an off-site restic repository; run as root by
+# webvirt-offsite.service with the settings of /etc/webvirtcloud-offsite.env.
+set -eu
+newest=$(find "$WVC_BACKUPS" -maxdepth 1 -name 'webvirtcloud-backup-*' -mmin -1560)
+if [ -z "$newest" ]; then
+    echo "No backup from the last 26 hours in $WVC_BACKUPS: is the panel's backup running?" >&2
+    exit 1
+fi
+# dot files are the lock and the backup being written
+restic backup --tag webvirtcloud --exclude '.*' "$WVC_BACKUPS"
+restic forget --tag webvirtcloud --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
+if [ -n "${WVC_HEARTBEAT:-}" ]; then
+    curl -fsS -m 10 --retry 3 -o /dev/null "$WVC_HEARTBEAT"
+fi