Make Nextcloud NAS backups independent, verified and retryable

etc/config.example

@@ -1,44 +1,27 @@
-# nextcloud-borg-backup configuration
-#
-# Copy to:
-#   ~/.config/nextcloud-borg-backup/config
-
-SOURCE_DIR="${HOME}/Nextcloud"
+# Trusted Bash configuration; never commit credentials or passphrases.
+REMOTE="Nextcloud:"
+STAGING_DIR="${HOME}/.local/share/nextcloud-borg-backup/staging"
 REPO_DIR="/net/thor/volume1/NetBackup/Nextcloud/borg-repo"
+EXPECTED_NAS_SOURCE="thor:/volume1/NetBackup"
+EXPECTED_NAS_FSTYPE="nfs4"
 ARCHIVE_PREFIX="nextcloud"
-
-# Borg repository encryption. repokey-blake2 needs a passphrase file for
-# unattended systemd timer runs. The installer creates this file if missing.
 BORG_ENCRYPTION="repokey-blake2"
 BORG_PASSPHRASE_FILE="${HOME}/.config/nextcloud-borg-backup/passphrase"
 BORG_COMPRESSION="zstd,6"
-
-# Four weeks of restorable history. With the daily timer this keeps at least
-# one month of archives; manual extra runs inside the window are also retained.
 RETENTION_WITHIN="4w"
-
-# Safety checks.
-ALLOW_EMPTY_SOURCE="false"
+PRUNE_AFTER_BACKUP="true"
+COMPACT_AFTER_PRUNE="true"
+BACKUP_INTERVAL_HOURS="24"
+MAX_BACKUP_AGE_HOURS="36"
+MIN_SOURCE_FILES="1"
+MAX_SOURCE_DROP_PERCENT="20"
+MAX_STAGE_DELETES="1000"
+MIN_FREE_STAGE_GB="5"
 MIN_FREE_REPO_GB="5"
-PRECHECK_TIMEOUT_SECONDS="60"
-
-# Runtime paths.
+COMMAND_TIMEOUT_SECONDS="21600"
 LOG_DIR="${HOME}/.local/state/nextcloud-borg-backup/logs"
 STATE_DIR="${HOME}/.local/state/nextcloud-borg-backup"
+LOCK_FILE="${STATE_DIR}/nextcloud-borg-backup.lock"
 RESTORE_DIR="${HOME}/Nextcloud-Restore"
 MOUNT_DIR="${XDG_RUNTIME_DIR:-/tmp}/nextcloud-borg-backup-mount"
 EXCLUDE_FILE="${HOME}/.config/nextcloud-borg-backup/excludes"
-LOCK_FILE="${HOME}/.local/state/nextcloud-borg-backup/nextcloud-borg-backup.lock"
-
-# Borg behavior.
-PRUNE_AFTER_BACKUP="true"
-COMPACT_AFTER_PRUNE="true"
-REPOSITORY_CHECK_AFTER_BACKUP="true"
-FULL_CHECK_INTERVAL_DAYS="7"
-FULL_CHECK_VERIFY_DATA="false"
-EXCLUDE_CACHES="true"
-ONE_FILE_SYSTEM="true"
-
-# Leave empty unless the rclone mount exposes unstable metadata and Borg rereads
-# too much. Conservative alternative: BORG_FILES_CACHE="mtime,size"
-BORG_FILES_CACHE=""