From 23609395dcbcd626f1653876e0e89b617d16e14c Mon Sep 17 00:00:00 2001 From: Alban Date: Thu, 11 Jul 2019 20:08:09 +0000 Subject: [PATCH] [fix] Management server should have keys and should work --- defaults/main.yml | 37 +++++++++++++++------ tasks/borg-client.yml | 64 ++++++++----------------------------- tasks/main.yml | 6 ++++ tasks/management-keys.yml | 23 +++++++++++++ templates/borg-backup.sh.j2 | 41 +++++++++++++++++++----- templates/prune.sh.j2 | 46 +++++++++++++++----------- 6 files changed, 131 insertions(+), 86 deletions(-) create mode 100644 tasks/management-keys.yml diff --git a/defaults/main.yml b/defaults/main.yml index ac3e6ba..82a8636 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -4,26 +4,40 @@ borgbackup_required: true borgbackup_client_user: root borgbackup_ssh_key: "~{{ borgbackup_client_user }}/.ssh/id_borg_rsa" -borgbackup_version: "1.1.4" -borgbackup_checksum: "sha256:4ecf507f21f0db7c437b2ef34566273d7ba5a7d05e921c6f0e3406c3f96933a7" +borgbackup_version: "1.1.10" +borgbackup_checksum: "sha256:6338d67aad4b5cd327b25ea363e30f0ed4abc425ce2d6a597c75a67a876ef9af" borgbackup_download_url: "https://github.com/borgbackup/borg/releases/download/{{ borgbackup_version }}/borg-linux64" borgbackup_compression: "auto,zlib,6" borgbackup_encryption_mode: keyfile borgbackup_pre_commands: - - '[[ ! -f "/usr/sbin/automysqlbackup" ]] || /usr/sbin/automysqlbackup' + - "[ -d /etc/backup.d/ ] && run-parts --verbose /etc/backup.d/" borgbackup_post_commands: [] borgbackup_include: - - "/etc" - - "/home" - - "/root" - - "/var/www" - - "/var/log" + - "/" -borgbackup_exclude: [] +borgbackup_exclude: + - "*/local/*" + - "*/tmp/*" + - "*CACHE*" + - "/dev" + - "/proc" + - "/run" + - "/sys" + - "/tmp" + - "/var/cache/apt" + - "/var/lib/amavis/tmp" + - "/var/lib/amavis/virusmails" + - "/var/lib/lxc" + - "/var/lib/lxcfs" + - "/var/lib/php/sessions" + - "/var/lib/php5" + - "/var/run" + - "/var/spool/postfix" + - "/var/tmp" borgbackup_retention: hourly: 12 @@ -42,6 +56,11 @@ borgbackup_management_station: '' borgbackup_management_user: '' borgbackup_management_ssh_pubkey: '' +borgbackup_management_copy_keys: true +borgbackup_management_key_name: 'backupserver_example_com__repo_dir_' + + +borgbackup_remote_ratelimit: 6250 # in KiB/s so 6250 <-> 50Mb/s borgbackup_owner: root borgbackup_group: root borgbackup_shell: "/bin/bash" diff --git a/tasks/borg-client.yml b/tasks/borg-client.yml index ee71a62..e6eccbe 100644 --- a/tasks/borg-client.yml +++ b/tasks/borg-client.yml @@ -33,57 +33,23 @@ {% endif %} with_items: "{{ borgbackup_servers }}" -- name: client | put sshpubkey on the normal backupserver +- name: client | put non management sshpubkey on the normal backupserver authorized_key: user: "{{ item.user }}" key: "{{ sshkey.stdout }}" key_options: 'command="cd {{ item.home }}{{ item.pool }}/{{ inventory_hostname }};borg serve {% if borgbackup_appendonly %}--append-only {% endif %}--restrict-to-path {{ item.home }}/{{ item.pool }}/{{ inventory_hostname }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc' delegate_to: "{{ item.fqdn }}" - when: item.type == 'normal' + when: inventory_hostname != borgbackup_management_station with_items: "{{ borgbackup_servers }}" -# rsync.net and hetzner have no python, so we can only use raw to manage ssh keys - workaround with local tmp file -- name: client | get authorized_keys file - raw: scp {{ item.user }}@{{ item.fqdn }}:.ssh/authorized_keys /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys - delegate_to: localhost - become: false - when: item.type in ['rsync.net','hetzner'] - with_items: "{{ borgbackup_servers }}" - changed_when: false - -- name: client | modify local rsync.net/hetzner authorized_keys +- name: client | put management sshpubkey on backupservers, no appendonly nor path restriction authorized_key: - user: "{{ ansible_user_id }}" + user: "{{ item.user }}" key: "{{ sshkey.stdout }}" - key_options: 'command="cd {{ item.pool }}/{{ inventory_hostname }};/usr/local/bin/borg1 serve {% if borgbackup_appendonly %}--append-only {% endif %} --restrict-to-path {{ item.pool }}/{{ inventory_hostname }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc' - path: "/tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys" - manage_dir: false - delegate_to: localhost - become: false - when: item.type in ['rsync.net','hetzner'] + key_options: 'command="cd {{ item.home }}{{ item.pool }}/{{ inventory_hostname }};borg serve ",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc' + delegate_to: "{{ item.fqdn }}" + when: inventory_hostname == borgbackup_management_station with_items: "{{ borgbackup_servers }}" - register: authkeys - -- name: client | upload local authorized_keys to rsync.net / hetzner - raw: scp /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys {{ item.user }}@{{ item.fqdn }}:.ssh/authorized_keys - delegate_to: localhost - become: false - when: item.type in ['rsync.net','hetzner'] and authkeys.changed - with_items: "{{ borgbackup_servers }}" - -- name: client | remove tmp authorized_keys files - file: - path: /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys - state: absent - delegate_to: localhost - become: false - with_items: "{{ borgbackup_servers }}" - when: authkeys.changed - changed_when: false - -- name: client | check for mysql - stat: path=/var/lib/automysqlbackup - register: automysql - name: client | put wrapper script template: @@ -109,12 +75,10 @@ day: "{{ borgbackup_cron_day }}" job: "/usr/local/bin/borg-backup backup" -- name: client | disable automysqlbackup cronjob, it's in our pre-backup-tasks - lineinfile: - dest: "/etc/cron.daily/automysqlbackup" - regexp: "^/usr/sbin/automysqlbackup$" - line: "#/usr/sbin/automysqlbackup" - state: "present" - backrefs: true - create: false - when: automysql.stat.isdir is defined and automysql.stat.isdir == True +- name: client | create log directory + file: + path: "/var/log/borgbackup" + state: "directory" + owner: "root" + group: "root" + mode: "0755" diff --git a/tasks/main.yml b/tasks/main.yml index a09c8a4..476bcab 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -22,3 +22,9 @@ when: > inventory_hostname in borgbackup_management_group and inventory_hostname not in borgbackup_servers_group + +- include_tasks: management-keys.yml + when: > + inventory_hostname not in borgbackup_management_group and + inventory_hostname not in borgbackup_servers_group and + borgbackup_management_copy_keys diff --git a/tasks/management-keys.yml b/tasks/management-keys.yml new file mode 100644 index 0000000..e06d884 --- /dev/null +++ b/tasks/management-keys.yml @@ -0,0 +1,23 @@ +--- + +- name: management | get key file + fetch: + src: "~{{ borgbackup_client_user}}/.config/borg/keys/{{ borgbackup_management_key_name }}{{ inventory_hostname }}" + dest: /tmp/.borgbackup_key_{{ inventory_hostname }} + flat: yes + changed_when: false + +- name: management | upload key to management + raw: scp /tmp/.borgbackup_key_{{ inventory_hostname }} {{ borgbackup_management_user }}@{{ borgbackup_management_station }}:~/.config/borg/keys/{{ borgbackup_management_key_name }}{{ inventory_hostname }} + delegate_to: localhost + become: false + changed_when: false + +- name: management | clean local copy + raw: rm -f /tmp/.borgbackup_key_{{ inventory_hostname }} + delegate_to: localhost + become: false + changed_when: false + + + diff --git a/templates/borg-backup.sh.j2 b/templates/borg-backup.sh.j2 index dd3cdfe..d2f19bb 100644 --- a/templates/borg-backup.sh.j2 +++ b/templates/borg-backup.sh.j2 @@ -73,33 +73,58 @@ if [ "$1" = "backup" ] then date=`date +%Y%m%d-%H%M` - # Running some commands pre-backup + LOG_DEST="/var/log/borgbackup/${date}" + LOG_FILE="${LOG_DEST}.log" + log(){ echo -e "\n$(date '+%Y-%m-%d %H:%M:%S') $@" | tee -a "$LOG_FILE"; } + _term(){ echo -e "\n## END ##" | tee -a "$LOG_FILE"; exit 1; } + trap _term SIGINT SIGTERM + +# Running some commands pre-backup +( {% for precommand in borgbackup_pre_commands %} - {{ precommand }} +{{ precommand }} {% endfor %} +) &>> "$LOG_FILE" + +{% if borgbackup_remote_ratelimit %} + {% set rate_limit %} --remote-ratelimit={{borgbackup_remote_ratelimit}} {% endset %} +{% else %} + {% set rate_limit = " " %} +{% endif %} {% for b in borgbackup_servers %} - printf "Backing up to {{ b.fqdn }} :\n" {% if b.type == 'hetzner' %} REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ inventory_hostname }} {% else %} REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ inventory_hostname }} {% endif %} - /usr/local/bin/borg create -x --progress --compression {{ borgbackup_compression }} --stats {{ b.options }} $REPOSITORY::$date {% for dir in borgbackup_include %}{{ dir }} {% endfor %}{% if automysql.stat.isdir is defined and automysql.stat.isdir == True %}/var/lib/automysqlbackup{% endif %} {% for dir in borgbackup_exclude %} --exclude '{{ dir }}'{% endfor %} + log "## Backing up to {{ b.fqdn }} " + /usr/local/bin/borg create {{ rate_limit }} -x --compression {{ borgbackup_compression }} --stats {{ b.options }} $REPOSITORY::$date {% for dir in borgbackup_include %}{{ dir }} {% endfor %} {% for dir in borgbackup_exclude %} --exclude '{{ dir }}'{% endfor %} &>> $LOG_FILE if [ "$?" -eq "0" ]; then printf "Backup succeeded on $date to {{ b.fqdn }}\n" >> /var/log/borg-backup.log; fi + log "## Checking the archive integrity " + /usr/local/bin/borg check $REPOSITORY::$date -v &>> "$LOG_FILE" + + log "## Retrieving archive json file" + /usr/local/bin/borg info $REPOSITORY::$date --json > "${LOG_DEST}.json" + {% if not borgbackup_appendonly %} - # prune old backups - /usr/local/bin/borg prune {{ b.options }} -v $REPOSITORY -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }} + log "## Pruning the repository" + /usr/local/bin/borg prune {{ b.options }} -v $REPOSITORY -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }} &>> "$LOG_FILE" {% endif %} {% endfor %} # Running some commands post-backup -{% for postcommand in borgbackup_post_commands %} +{% if borgbackup_post_commands |length > 1 %} + ( + {% for postcommand in borgbackup_post_commands %} {{ postcommand }} -{% endfor %} + {% endfor %} + ) &>> "$LOG_FILE" +{% endif %} + _term fi diff --git a/templates/prune.sh.j2 b/templates/prune.sh.j2 index 64d0a2d..2dcc629 100644 --- a/templates/prune.sh.j2 +++ b/templates/prune.sh.j2 @@ -1,27 +1,35 @@ #jinja2:lstrip_blocks: True #!/bin/bash +usage(){ +cat << EOL -# This script is intended to run on a trusted management station to purge borg repo's in -# append-only mode. -# Don't put it on the backup server, it contains all borg secrets! + This script is intended to run on a trusted management station to purge borg repo's in + append-only mode. + Don't put it on the backup server, it contains all borg secrets! + +EOL +} + +DATE=$(date +%y%m%d) +LOG_DIR=/var/log/borgbackup +[ ! -d $LOG_DIR ] && mkdir $LOG_DIR +LOG_FILE=/var/log/borgbackup-prune/${DATE}.log +exec &> >(tee "$LOG_FILE") {% for h in groups['all'] %} - {% if hostvars[h].borgbackup_required | default(True) -%} - # Host: {{ h }} + {% if h != borgbackup_management_station and h not in groups['borgbackup_servers'] -%} +echo "Host: {{ h }}" +export BORG_PASSPHRASE={{ hostvars[h].borgbackup_passphrase }} + {% if borgbackup_management_station is defined and inventory_hostname == borgbackup_management_station %} + {% for b in borgbackup_servers %} + {% if b.type == 'hetzner' %} +REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ h }} + {% else %} +REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ h }} + {% endif %} +/usr/local/bin/borg prune -v $REPOSITORY {{ b.options }} -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }} - export BORG_PASSPHRASE={{ hostvars[h].borgbackup_passphrase }} - - {% if hostvars[h].borgbackup_management_station is defined and inventory_hostname == hostvars[h].borgbackup_management_station %} - {% for b in hostvars[h].borgbackup_servers %} - # {{ b.fqdn }} -{% if b.type == 'hetzner' %} - REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ h }} -{% else %} - REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ h }} -{% endif %} - /usr/local/bin/borg prune -v $REPOSITORY {{ b.options }} -H {{ hostvars[h].borgbackup_retention.hourly }} -d {{ hostvars[h].borgbackup_retention.daily }} -w {{ hostvars[h].borgbackup_retention.weekly }} -m {{ hostvars[h].borgbackup_retention.monthly }} -y {{ hostvars[h].borgbackup_retention.yearly }} - - {% endfor %} - {% endif %} + {% endfor %} + {% endif %} {% endif %} {% endfor %}