generic

# data
/opt
/srv
/home

/root
-/root/.cache # duplicity caches by default here

# system minus instance-specific stuff
/usr/local

/etc
-/etc/os-release
-/etc/lsb-release
-/etc/turnkey_version
-/etc/debian_version
-/etc/ld.so.cache
-/etc/apt
-/etc/resolv.conf
-/etc/resolvconf
-/etc/network/interfaces
-/etc/passwd*
-/etc/group*
-/etc/hostname
-/etc/fstab
-/etc/mtab
-/etc/udev/rules.d
-/etc/ssh/ssh_host_*
-/etc/mysql/debian.cnf

# ec2 blacklist
-/etc/event.d/console

# /var whitelist
/var/run
-/var/run/*.pid
-/var/run/*/*.pid

/var/www
/var/lib/shellinabox # in case you reconfigure the certificate
/var/spool
-/var/spool/postfix/lib
-/var/spool/postfix/private
-/var/spool/postfix/public
-/var/spool/postfix/pid
-/var/spool/postfix/dev

-/var/spool/tklbam-squid