Seagate Primary SSD

/dev/mapper/seagate-crypt (LUKS2 container)
└── btrfs filesystem
    ├── @secrets   → /mnt/seagate/secrets/   (critical)
    ├── @configs   → /mnt/seagate/configs/   (important)
    ├── @backups   → /mnt/seagate/backups/   (convenience)
    ├── @storage   → /mnt/seagate/storage/   (bulk)
    └── @snapshots → (internal, read-only snapshots)

#!/bin/bash
set -euo pipefail  # Exit on error, undefined var, pipe fail

DEVICE="${1:-/dev/sdb1}"        # Default device, overridable
MAPPER_NAME="seagate-crypt"     # dm-crypt mapper name
MOUNT_BASE="/mnt/seagate"       # Mount point base

# Check if already mounted (idempotent)
if mountpoint -q "$MOUNT_BASE/secrets" 2>/dev/null; then
    echo "Already mounted at $MOUNT_BASE/"
    exit 0
fi

# Verify device exists before attempting LUKS open
if [[ ! -b "$DEVICE" ]]; then
    echo "Device $DEVICE not found. Check lsblk for correct device."
    exit 1
fi

# Open LUKS container - prompts for passphrase
# Creates /dev/mapper/seagate-crypt
sudo cryptsetup open "$DEVICE" "$MAPPER_NAME"

# Create mount points
sudo mkdir -p "$MOUNT_BASE"/{secrets,configs,backups,storage}

# Mount each subvolume with compression
# -o compress=zstd:3 - level 3 zstd (good balance)
# -o subvol=@name - mount specific subvolume
sudo mount -o compress=zstd:3,subvol=@secrets /dev/mapper/$MAPPER_NAME $MOUNT_BASE/secrets
sudo mount -o compress=zstd:3,subvol=@configs /dev/mapper/$MAPPER_NAME $MOUNT_BASE/configs
sudo mount -o compress=zstd:3,subvol=@backups /dev/mapper/$MAPPER_NAME $MOUNT_BASE/backups
sudo mount -o compress=zstd:3,subvol=@storage /dev/mapper/$MAPPER_NAME $MOUNT_BASE/storage

# Set ownership so rsync works without sudo
sudo chown -R $USER:$USER $MOUNT_BASE/*

#!/bin/bash
set -euo pipefail

MOUNT_BASE="/mnt/seagate"

# Verify mounted before attempting backup
if ! mountpoint -q "$MOUNT_BASE/secrets" 2>/dev/null; then
    echo "Seagate not mounted. Run seagate-primary-mount first."
    exit 1
fi

# === SECRETS (@secrets subvolume) ===
# These are the critical credentials - age keys, GPG, SSH, gopass
rsync -av --delete ~/.secrets/ $MOUNT_BASE/secrets/
rsync -av --delete ~/.gnupg/ $MOUNT_BASE/secrets/gnupg/
rsync -av --delete ~/.password-store/ $MOUNT_BASE/secrets/password-store/
rsync -av --delete ~/.ssh/ $MOUNT_BASE/secrets/ssh/
rsync -av --delete ~/.pki/ $MOUNT_BASE/secrets/pki/

# === CONFIGS (@configs subvolume) ===
# Application configs, local data, shell history
rsync -av --delete --exclude='borg' ~/.config/ $MOUNT_BASE/configs/dotconfig/
rsync -av --delete ~/.local/ $MOUNT_BASE/configs/dotlocal/
rsync -av --delete ~/.ansible/ $MOUNT_BASE/configs/ansible/
rsync -av --delete ~/.claude/ $MOUNT_BASE/configs/claude/
rsync -av --delete ~/.terraform.d/ $MOUNT_BASE/configs/terraform.d/ 2>/dev/null || true
rsync -av --delete ~/bin/ $MOUNT_BASE/configs/bin/
rsync -av ~/.zsh_history ~/.bash_history $MOUNT_BASE/configs/

# === BACKUPS (@backups subvolume) ===
rsync -av --delete ~/.mozilla/ $MOUNT_BASE/backups/mozilla/

# === STORAGE (@storage subvolume) ===
# Excludes: oil.nvim temp dirs, FUSE trash
rsync -av --delete --exclude='oil' --exclude='.Trash-*' ~/atelier/ $MOUNT_BASE/storage/atelier/
rsync -av --delete ~/Documents/ $MOUNT_BASE/storage/Documents/
rsync -av --delete ~/Pictures/ $MOUNT_BASE/storage/Pictures/ 2>/dev/null || true

#!/bin/bash
set -euo pipefail

MOUNT_BASE="/mnt/seagate"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
MAPPER_NAME="seagate-crypt"
SNAPSHOT_MNT="/tmp/seagate-snapshot-$$"

# Must temporarily mount btrfs root to access all subvolumes
sudo mkdir -p "$SNAPSHOT_MNT"
sudo mount -o compress=zstd:3 /dev/mapper/$MAPPER_NAME "$SNAPSHOT_MNT"

# Ensure snapshot directory exists
sudo mkdir -p "$SNAPSHOT_MNT/@snapshots"

# Create read-only snapshot of each subvolume
# -r = read-only (immutable)
for subvol in secrets configs backups storage; do
    sudo btrfs subvolume snapshot -r \
        "$SNAPSHOT_MNT/@$subvol" \
        "$SNAPSHOT_MNT/@snapshots/${subvol}_$TIMESTAMP"
done

# Cleanup temp mount
sudo umount "$SNAPSHOT_MNT"
rmdir "$SNAPSHOT_MNT"

#!/bin/bash
set -euo pipefail

MOUNT_BASE="/mnt/seagate"
MAPPER_NAME="seagate-crypt"

echo "Syncing filesystems..."
sync  # Flush all pending writes to disk

echo "Unmounting subvolumes..."
sudo umount $MOUNT_BASE/secrets
sudo umount $MOUNT_BASE/configs
sudo umount $MOUNT_BASE/backups
sudo umount $MOUNT_BASE/storage

echo "Closing LUKS volume..."
sudo cryptsetup close $MAPPER_NAME

echo "Done. Safe to remove drive."

seagate-primary-mount
cp /mnt/seagate/secrets/ssh/id_ed25519 ~/.ssh/
seagate-primary-umount

# Mount btrfs root
sudo mount /dev/mapper/seagate-crypt /mnt

# List snapshots
ls /mnt/@snapshots/

# Copy file from snapshot
cp /mnt/@snapshots/configs_20260217_201500/dotconfig/nvim/init.lua ~/.config/nvim/

sudo umount /mnt

seagate-primary-mount

rsync -av /mnt/seagate/secrets/ ~/.secrets/
rsync -av /mnt/seagate/secrets/gnupg/ ~/.gnupg/
rsync -av /mnt/seagate/secrets/password-store/ ~/.password-store/
rsync -av /mnt/seagate/secrets/ssh/ ~/.ssh/
chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_*

seagate-primary-umount