From c0bc33ab17b4c6195b208fa5d9eaff791ccc9766 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julian-Samuel=20Geb=C3=BChr?= Date: Tue, 2 May 2023 08:18:45 +0200 Subject: [PATCH 1/4] Add docs --- docs/services/backup-borg.md | 81 ++++++++++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) create mode 100644 docs/services/backup-borg.md diff --git a/docs/services/backup-borg.md b/docs/services/backup-borg.md new file mode 100644 index 0000000..4b5f679 --- /dev/null +++ b/docs/services/backup-borg.md @@ -0,0 +1,81 @@ +# Setting up borg backup (optional) + +The playbook can install and configure [borgbackup](https://www.borgbackup.org/) with [borgmatic](https://torsion.org/borgmatic/) for you. +BorgBackup is a deduplicating backup program with optional compression and encryption. +That means your daily incremental backups can be stored in a fraction of the space and is safe whether you store it at home or on a cloud service. + +You will need a remote server where borg will store the backups. There are hosted, borg compatible solutions available, such as [BorgBase](https://www.borgbase.com). + +The backup will run based on `backup_borg_schedule` var (systemd timer calendar), default: 4am every day. + +By default, if you're using the integrated Postgres database server (as opposed to [an external Postgres server](configuring-playbook-external-postgres.md)), Borg backups will also include dumps of your Postgres database. An alternative solution for backing up the Postgres database is [postgres backup](configuring-playbook-postgres-backup.md). If you decide to go with another solution, you can disable Postgres-backup support for Borg using the `backup_borg_postgresql_enabled` variable. + + +## Prerequisites + +1. Create a new SSH key: + +```bash +ssh-keygen -t ed25519 -N '' -f borg-backup -C MASH +``` + +This can be done on any machine and you don't need to place the key in the `.ssh` folder. It will be added to the Ansible config later. + +1. Add the **public** part of this SSH key (the `borg-backup.pub` file) to your borg provider/server: + +If you plan to use a hosted solution, follow their instructions. If you have your own server, copy the key over: + +```bash +# example to append the new PUBKEY contents, where: +# PUBKEY is path to the public key, +# USER is a ssh user on a provider / server +# HOST is a ssh host of a provider / server +cat PUBKEY | ssh USER@HOST 'dd of=.ssh/authorized_keys oflag=append conv=notrunc' +``` + +## Adjusting the playbook configuration + +Minimal working configuration (`inventory/host_vars//vars.yml`) to enable borg backup: + +```yaml +backup_borg_enabled: true +backup_borg_location_repositories: + - ssh://USER@HOST/./REPO +backup_borg_storage_encryption_passphrase: "PASSPHRASE" +backup_borg_ssh_key_private: | + -----BEGIN OPENSSH PRIVATE KEY----- + THISMUSTBEREPLACEDc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2NpbmcgZW + xpdCwgc2VkIGRvIGVpdXNtb2QgdGVtcG9yIGluY2lkaWR1bnQgdXQgbGFib3JlIGV0IGRv + bG9yZSBtYWduYSBhbGlxdWEuIFV0IGVuaW0gYWQgbWluaW0gdmVuaWFtLCBxdWlzIG5vc3 + RydWQgZXhlcmNpdGF0aW9uIHVsbGFtY28gbGFib3JpcyBuaXNpIHV0IGFsaXF1aXAgZXgg + ZWEgY29tbW9kbyBjb25zZXF1YXQuIA== + -----END OPENSSH PRIVATE KEY----- +``` + +where: + +* USER - SSH user of a provider/server +* HOST - SSH host of a provider/server +* REPO - borg repository name, it will be initialized on backup start, eg: `mash`, regarding Syntax see [Remote repositories](https://borgbackup.readthedocs.io/en/stable/usage/general.html#repository-urls) +* PASSPHRASE - passphrase used for encrypting backups, you may generate it with `pwgen -s 64 1` or use any password manager +* PRIVATE KEY - the content of the **private** part of the SSH key you created before. The whole key (all of its belonging lines) under `backup_borg_ssh_key_private` needs to be indented with 2 spaces + +To backup without encryption, add `backup_borg_encryption: 'none'` to your vars. This will also enable the `backup_borg_unknown_unencrypted_repo_access_is_ok` variable. + +`backup_borg_location_source_directories` defines the list of directories to back up: it's set to `{{ mash_playbook_base_path }}` by default, which is the base directory for every service's data, such as Synapse, Postgres and the bridges. You might want to exclude certain directories or file patterns from the backup using the `backup_borg_location_exclude_patterns` variable. + +Check the `roles/custom/nextcloud-backup-borg/defaults/main.yml` file for the full list of available options. + +## Installing + +After configuring the playbook, run the [installation](installing.md) command again: + +``` +just install-all +``` + +## Manually start a backup + +For testing your setup it can be helpful to not wait until 4am. If you want to run the backup immediately, log onto the server +and run `systemctl start mash-backup-borg`. This will not return until the backup is done, so possibly a long time. +Consider using [tmux](https://en.wikipedia.org/wiki/Tmux) if your SSH connection is unstable. From a3dde9d59a8b20a49a8379cc7acf0c997d85a79d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julian-Samuel=20Geb=C3=BChr?= Date: Tue, 2 May 2023 08:21:47 +0200 Subject: [PATCH 2/4] Add mariadb --- docs/services/backup-borg.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/services/backup-borg.md b/docs/services/backup-borg.md index 4b5f679..c9b6e32 100644 --- a/docs/services/backup-borg.md +++ b/docs/services/backup-borg.md @@ -8,7 +8,7 @@ You will need a remote server where borg will store the backups. There are hoste The backup will run based on `backup_borg_schedule` var (systemd timer calendar), default: 4am every day. -By default, if you're using the integrated Postgres database server (as opposed to [an external Postgres server](configuring-playbook-external-postgres.md)), Borg backups will also include dumps of your Postgres database. An alternative solution for backing up the Postgres database is [postgres backup](configuring-playbook-postgres-backup.md). If you decide to go with another solution, you can disable Postgres-backup support for Borg using the `backup_borg_postgresql_enabled` variable. +By default, if you're using the integrated Postgres database server (as opposed to [an external Postgres server](configuring-playbook-external-postgres.md)) or MariaDB as MySQL server, Borg backups will also include dumps of your databases. An alternative solution for backing up the Postgres database is [postgres backup](configuring-playbook-postgres-backup.md). If you decide to go with another solution, you can disable Postgres-backup support for Borg using the `backup_borg_postgresql_enabled` variable. ## Prerequisites From 6896230e298d6b043c0861fa9cfb12ab508e6277 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julian-Samuel=20Geb=C3=BChr?= Date: Tue, 2 May 2023 08:25:32 +0200 Subject: [PATCH 3/4] Replace old references --- docs/services/backup-borg.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/services/backup-borg.md b/docs/services/backup-borg.md index c9b6e32..3b8b703 100644 --- a/docs/services/backup-borg.md +++ b/docs/services/backup-borg.md @@ -62,9 +62,9 @@ where: To backup without encryption, add `backup_borg_encryption: 'none'` to your vars. This will also enable the `backup_borg_unknown_unencrypted_repo_access_is_ok` variable. -`backup_borg_location_source_directories` defines the list of directories to back up: it's set to `{{ mash_playbook_base_path }}` by default, which is the base directory for every service's data, such as Synapse, Postgres and the bridges. You might want to exclude certain directories or file patterns from the backup using the `backup_borg_location_exclude_patterns` variable. +`backup_borg_location_source_directories` defines the list of directories to back up: it's set to `{{ mash_playbook_base_path }}` by default, which is the base directory for every service's data, such as Nextcloud, Postgres and all others. You might want to exclude certain directories or file patterns from the backup using the `backup_borg_location_exclude_patterns` variable. -Check the `roles/custom/nextcloud-backup-borg/defaults/main.yml` file for the full list of available options. +Check the `roles/galaxy/backup-borg/defaults/main.yml` file for the full list of available options. ## Installing From 7338b0b8ca6d53026c53dcbd10fd10a5e00c161e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julian-Samuel=20Geb=C3=BChr?= Date: Tue, 2 May 2023 08:26:29 +0200 Subject: [PATCH 4/4] Follow usual layout --- docs/services/backup-borg.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/docs/services/backup-borg.md b/docs/services/backup-borg.md index 3b8b703..9e67da4 100644 --- a/docs/services/backup-borg.md +++ b/docs/services/backup-borg.md @@ -38,6 +38,13 @@ cat PUBKEY | ssh USER@HOST 'dd of=.ssh/authorized_keys oflag=append conv=notrunc Minimal working configuration (`inventory/host_vars//vars.yml`) to enable borg backup: ```yaml + +######################################################################## +# # +# backup-borg # +# # +######################################################################## + backup_borg_enabled: true backup_borg_location_repositories: - ssh://USER@HOST/./REPO @@ -50,6 +57,12 @@ backup_borg_ssh_key_private: | RydWQgZXhlcmNpdGF0aW9uIHVsbGFtY28gbGFib3JpcyBuaXNpIHV0IGFsaXF1aXAgZXgg ZWEgY29tbW9kbyBjb25zZXF1YXQuIA== -----END OPENSSH PRIVATE KEY----- + +######################################################################## +# # +# /backup-borg # +# # +######################################################################## ``` where: