feat: add PDS backup service with rclone + S3

Three backup types: pre-update (Watchtower lifecycle hook),
pre-deploy (Ansible task), and periodic (systemd timer).
All uploads go to OVH S3 via rclone. Backs up SQLite DBs,
pds.env, and Caddy config.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

README.md

@@ -7,6 +7,7 @@ Ansible playbook for deploying a self-hosted [Bluesky PDS](https://github.com/bl
 - **PDS** — Bluesky Personal Data Server (`ghcr.io/bluesky-social/pds:0.4`)
 - **Caddy** — Reverse proxy with automatic TLS via Let's Encrypt
 - **Watchtower** — Pulls new PDS image versions hourly and recreates containers
+- **PDS Backup Service** — rclone + systemd timer for periodic PDS backups to S3, plus Watchtower pre-update hook
 
 ## Requirements
 
@@ -55,6 +56,8 @@ ansible-playbook playbook.yml
 
 ## Variables
 
+### PDS
+
 | Variable | Required | Default | Description |
 |---|---|---|---|
 | `pds_hostname` | yes | — | Public DNS name for the PDS |
@@ -65,14 +68,39 @@ ansible-playbook playbook.yml
 | `pds_rate_limits_enabled` | no | `true` | Enable rate limiting |
 | `pds_invite_required` | no | `true` | Require invite codes to create accounts |
 | `pds_blobstore_type` | no | `disk` | Blob storage backend (`disk` or `s3`) |
-| `pds_email_from_address` | no | — | From address for outgoing emails |
+| `pds_blobstore_s3_bucket` | yes (if S3) | — | S3 bucket for blob storage |
+| `pds_blobstore_s3_region` | yes (if S3) | — | S3 region for blob storage |
+| `pds_blobstore_s3_endpoint` | yes (if S3) | — | S3 endpoint for blob storage |
+| `pds_blobstore_s3_force_path_style` | no | — | Use path-style S3 addressing |
 | `pds_blobstore_s3_access_key` | yes (if S3) | — | S3 access key for blob storage |
 | `pds_blobstore_s3_secret_key` | yes (if S3) | — | S3 secret key for blob storage |
 | `pds_email_smtp_url` | no | — | SMTP URL (with credentials) for email verification |
+| `pds_email_from_address` | no | — | From address for outgoing emails |
+
+### Backup service
+
+| Variable | Required | Default | Description |
+|---|---|---|---|
+| `pds_backup_period` | no | `24h` | Periodic backup interval (systemd timer) |
+| `pds_backup_s3_bucket` | no | `atprotopds-backup` | S3 bucket for backups |
+| `pds_backup_s3_region` | no | `bhs` | S3 region for backup bucket |
+| `pds_backup_s3_endpoint` | no | `https://s3.bhs.io.cloud.ovh.net` | S3 endpoint for backup bucket |
+| `pds_backup_s3_access_key` | no | — | S3 access key for backups (defaults to blobstore key) |
+| `pds_backup_s3_secret_key` | no | — | S3 secret key for backups (defaults to blobstore key) |
 
 ## Auto-updates
 
-Watchtower checks every hour (`WATCHTOWER_POLL_INTERVAL=3600`) for new `0.4.x` images on `ghcr.io/bluesky-social/pds:0.4`. When a new image is found, it pulls it and recreates the container. Old images are cleaned up automatically.
+Watchtower checks every hour (`WATCHTOWER_POLL_INTERVAL=3600`) for new `0.4.x` images on `ghcr.io/bluesky-social/pds:0.4`. When a new image is found, it runs the pre-update backup hook (tarballs `/pds` excluding blocks, uploads to S3), then pulls the new image and recreates the container. Old images are cleaned up automatically.
+
+## Backups
+
+Three backup types, all uploaded to `s3://atprotopds-backup`:
+
+- **Pre-update** — Watchtower lifecycle hook fires before pulling a new PDS image. Runs inside the PDS container using a mounted rclone binary.
+- **Pre-deploy** — Ansible task runs before applying config changes. Runs on the host.
+- **Periodic** — systemd timer (`pds-backup.timer`), default every 24h. Runs on the host.
+
+Backups exclude `/pds/blocks` (blobs are already in S3). Each backup is a tarball named `{type}-YYYYMMDD-HHMMSS.tar.gz`.
 
 ## Post-deploy