[fix] Management server should have keys and should work

defaults/main.yml

@@ -4,26 +4,40 @@ borgbackup_required: true
 borgbackup_client_user: root
 borgbackup_ssh_key: "~{{ borgbackup_client_user }}/.ssh/id_borg_rsa"
 
-borgbackup_version: "1.1.4"
+borgbackup_version: "1.1.10"
-borgbackup_checksum: "sha256:4ecf507f21f0db7c437b2ef34566273d7ba5a7d05e921c6f0e3406c3f96933a7"
+borgbackup_checksum: "sha256:6338d67aad4b5cd327b25ea363e30f0ed4abc425ce2d6a597c75a67a876ef9af"
 borgbackup_download_url: "https://github.com/borgbackup/borg/releases/download/{{ borgbackup_version }}/borg-linux64"
 
 borgbackup_compression: "auto,zlib,6"
 borgbackup_encryption_mode: keyfile
 
 borgbackup_pre_commands:
-  - '[[ ! -f "/usr/sbin/automysqlbackup" ]] || /usr/sbin/automysqlbackup'
+  - "[ -d /etc/backup.d/ ] && run-parts --verbose /etc/backup.d/"
 
 borgbackup_post_commands: []
 
 borgbackup_include:
-  - "/etc"
+  - "/"
-  - "/home"
-  - "/root"
-  - "/var/www"
-  - "/var/log"
 
-borgbackup_exclude: []
+borgbackup_exclude:
+  - "*/local/*"
+  - "*/tmp/*"
+  - "*CACHE*"
+  - "/dev"
+  - "/proc"
+  - "/run"
+  - "/sys"
+  - "/tmp"
+  - "/var/cache/apt"
+  - "/var/lib/amavis/tmp"
+  - "/var/lib/amavis/virusmails"
+  - "/var/lib/lxc"
+  - "/var/lib/lxcfs"
+  - "/var/lib/php/sessions"
+  - "/var/lib/php5"
+  - "/var/run"
+  - "/var/spool/postfix"
+  - "/var/tmp"
 
 borgbackup_retention:
   hourly: 12
@@ -42,6 +56,11 @@ borgbackup_management_station: ''
 borgbackup_management_user: ''
 borgbackup_management_ssh_pubkey: ''
 
+borgbackup_management_copy_keys: true
+borgbackup_management_key_name: 'backupserver_example_com__repo_dir_'
+
+
+borgbackup_remote_ratelimit: 6250 # in KiB/s so 6250 <-> 50Mb/s 
 borgbackup_owner: root
 borgbackup_group: root
 borgbackup_shell: "/bin/bash"

tasks/borg-client.yml

@@ -33,57 +33,23 @@
         {% endif %}
   with_items: "{{ borgbackup_servers }}"
 
-- name: client | put sshpubkey on the normal backupserver
+- name: client | put non management sshpubkey on the normal backupserver
   authorized_key:
     user: "{{ item.user }}"
     key: "{{ sshkey.stdout }}"
     key_options: 'command="cd {{ item.home }}{{ item.pool }}/{{ inventory_hostname }};borg serve {% if borgbackup_appendonly %}--append-only {% endif %}--restrict-to-path {{ item.home }}/{{ item.pool }}/{{ inventory_hostname }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
   delegate_to: "{{ item.fqdn }}"
-  when: item.type == 'normal'
+  when: inventory_hostname != borgbackup_management_station
   with_items: "{{ borgbackup_servers }}"
 
-# rsync.net and hetzner have no python, so we can only use raw to manage ssh keys - workaround with local tmp file
+- name: client | put management sshpubkey on backupservers, no appendonly nor path restriction
-- name: client | get authorized_keys file
-  raw: scp {{ item.user }}@{{ item.fqdn }}:.ssh/authorized_keys /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys
-  delegate_to: localhost
-  become: false
-  when: item.type in ['rsync.net','hetzner']
-  with_items: "{{ borgbackup_servers }}"
-  changed_when: false
-
-- name: client | modify local rsync.net/hetzner authorized_keys
   authorized_key:
-    user: "{{ ansible_user_id }}"
+    user: "{{ item.user }}"
     key: "{{ sshkey.stdout }}"
-    key_options: 'command="cd {{ item.pool }}/{{ inventory_hostname }};/usr/local/bin/borg1 serve {% if borgbackup_appendonly %}--append-only {% endif %} --restrict-to-path {{ item.pool }}/{{ inventory_hostname }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
+    key_options: 'command="cd {{ item.home }}{{ item.pool }}/{{ inventory_hostname }};borg serve ",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
-    path: "/tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys"
+  delegate_to: "{{ item.fqdn }}"
-    manage_dir: false
+  when: inventory_hostname == borgbackup_management_station
-  delegate_to: localhost
-  become: false
-  when: item.type in ['rsync.net','hetzner']
   with_items: "{{ borgbackup_servers }}"
-  register: authkeys
-
-- name: client | upload local authorized_keys to rsync.net / hetzner
-  raw: scp /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys {{ item.user }}@{{ item.fqdn }}:.ssh/authorized_keys
-  delegate_to: localhost
-  become: false
-  when: item.type in ['rsync.net','hetzner'] and authkeys.changed
-  with_items: "{{ borgbackup_servers }}"
-
-- name: client | remove tmp authorized_keys files
-  file:
-    path: /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys
-    state: absent
-  delegate_to: localhost
-  become: false
-  with_items: "{{ borgbackup_servers }}"
-  when: authkeys.changed
-  changed_when: false
-
-- name: client | check for mysql
-  stat: path=/var/lib/automysqlbackup
-  register: automysql
 
 - name: client | put wrapper script
   template:
@@ -109,12 +75,10 @@
     day: "{{ borgbackup_cron_day }}"
     job: "/usr/local/bin/borg-backup backup"
 
-- name: client | disable automysqlbackup cronjob, it's in our pre-backup-tasks
+- name: client | create log directory
-  lineinfile:
+  file:
-    dest: "/etc/cron.daily/automysqlbackup"
+    path: "/var/log/borgbackup"
-    regexp: "^/usr/sbin/automysqlbackup$"
+    state: "directory"
-    line: "#/usr/sbin/automysqlbackup"
+    owner: "root"
-    state: "present"
+    group: "root"
-    backrefs: true
+    mode: "0755"
-    create: false
-  when: automysql.stat.isdir is defined and automysql.stat.isdir == True

tasks/main.yml

@@ -22,3 +22,9 @@
   when: >
     inventory_hostname in borgbackup_management_group and
     inventory_hostname not in borgbackup_servers_group
+
+- include_tasks: management-keys.yml
+  when: >
+    inventory_hostname not in borgbackup_management_group and
+    inventory_hostname not in borgbackup_servers_group and
+    borgbackup_management_copy_keys

tasks/management-keys.yml

@@ -0,0 +1,23 @@
+---
+
+- name: management | get key file
+  fetch: 
+       src: "~{{ borgbackup_client_user}}/.config/borg/keys/{{ borgbackup_management_key_name }}{{ inventory_hostname }}" 
+       dest: /tmp/.borgbackup_key_{{ inventory_hostname }}
+       flat: yes
+  changed_when: false
+
+- name: management | upload key to management
+  raw: scp /tmp/.borgbackup_key_{{ inventory_hostname }} {{ borgbackup_management_user }}@{{ borgbackup_management_station }}:~/.config/borg/keys/{{ borgbackup_management_key_name }}{{ inventory_hostname }}
+  delegate_to: localhost
+  become: false
+  changed_when: false
+
+- name: management | clean local copy 
+  raw: rm -f /tmp/.borgbackup_key_{{ inventory_hostname }}
+  delegate_to: localhost
+  become: false
+  changed_when: false
+
+
+ 

templates/borg-backup.sh.j2

@@ -73,33 +73,58 @@ if [ "$1" = "backup" ]
   then
     date=`date +%Y%m%d-%H%M`
 
-    # Running some commands pre-backup
+    LOG_DEST="/var/log/borgbackup/${date}"
+    LOG_FILE="${LOG_DEST}.log"
+    log(){ echo -e "\n$(date '+%Y-%m-%d %H:%M:%S') $@" | tee -a "$LOG_FILE"; }
+    _term(){ echo -e "\n## END ##" | tee -a "$LOG_FILE"; exit 1; }
+    trap _term SIGINT SIGTERM
+
+# Running some commands pre-backup
+(
 {% for precommand in borgbackup_pre_commands %}
-    {{ precommand }}
+{{ precommand }}
 {% endfor %}
+) &>> "$LOG_FILE"
+
+{% if borgbackup_remote_ratelimit %}
+    	{% set rate_limit %} --remote-ratelimit={{borgbackup_remote_ratelimit}} {% endset %}
+{% else %}
+    	{% set rate_limit = " " %}
+{% endif %}
 
 {% for b in borgbackup_servers %}
-    printf "Backing up to {{ b.fqdn }} :\n"
 {% if b.type == 'hetzner' %}
     REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ inventory_hostname }}
 {% else %}
     REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ inventory_hostname }}
 {% endif %}
     
-    /usr/local/bin/borg create -x --progress --compression {{ borgbackup_compression }} --stats {{ b.options }} $REPOSITORY::$date {% for dir in borgbackup_include %}{{ dir }} {% endfor %}{% if automysql.stat.isdir is defined and automysql.stat.isdir == True %}/var/lib/automysqlbackup{% endif %} {% for dir in borgbackup_exclude %} --exclude '{{ dir }}'{% endfor %}
+    log "## Backing up to {{ b.fqdn }} "
+    /usr/local/bin/borg create {{ rate_limit }} -x --compression {{ borgbackup_compression }} --stats {{ b.options }} $REPOSITORY::$date {% for dir in borgbackup_include %}{{ dir }} {% endfor %} {% for dir in borgbackup_exclude %} --exclude '{{ dir }}'{% endfor %} &>> $LOG_FILE
 
     if [ "$?" -eq "0" ]; then printf "Backup succeeded on $date to {{ b.fqdn }}\n" >> /var/log/borg-backup.log; fi
 
+    log "## Checking the archive integrity "
+    /usr/local/bin/borg check $REPOSITORY::$date -v &>> "$LOG_FILE"
+
+    log "## Retrieving archive json file"
+    /usr/local/bin/borg info $REPOSITORY::$date --json > "${LOG_DEST}.json"
+
   {% if not borgbackup_appendonly %}
-    # prune old backups
+    log "## Pruning the repository"
-    /usr/local/bin/borg prune {{ b.options }} -v $REPOSITORY -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }}
+    /usr/local/bin/borg prune {{ b.options }} -v $REPOSITORY -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }} &>> "$LOG_FILE"
   {% endif %}
 {% endfor %}
 
     # Running some commands post-backup
-{% for postcommand in borgbackup_post_commands %}
+{% if borgbackup_post_commands |length > 1  %} 
+    (
+    {% for postcommand in borgbackup_post_commands %}
     {{ postcommand }}
-{% endfor %}
+    {% endfor %}
+    ) &>> "$LOG_FILE"
+{% endif %}
 
+    _term
 fi
 

templates/prune.sh.j2

@@ -1,25 +1,33 @@
 #jinja2:lstrip_blocks: True
 #!/bin/bash
+usage(){
+cat << EOL
 
-# This script is intended to run on a trusted management station to purge borg repo's in
+  This script is intended to run on a trusted management station to purge borg repo's in
-# append-only mode.
+  append-only mode.
-# Don't put it on the backup server, it contains all borg secrets!
+  Don't put it on the backup server, it contains all borg secrets!
+
+EOL
+}
+
+DATE=$(date +%y%m%d)
+LOG_DIR=/var/log/borgbackup
+[ ! -d $LOG_DIR ] && mkdir $LOG_DIR
+LOG_FILE=/var/log/borgbackup-prune/${DATE}.log
+exec &> >(tee "$LOG_FILE")
 
 {% for h in groups['all'] %}
-  {% if hostvars[h].borgbackup_required | default(True) -%}
+  {% if h != borgbackup_management_station and h not in groups['borgbackup_servers'] -%} 
-  # Host: {{ h }}
+echo "Host: {{ h }}"
-
+export BORG_PASSPHRASE={{ hostvars[h].borgbackup_passphrase }}
-    export BORG_PASSPHRASE={{ hostvars[h].borgbackup_passphrase }}
+    {% if borgbackup_management_station is defined and inventory_hostname == borgbackup_management_station %}
-
+      {% for b in borgbackup_servers %}
-    {% if hostvars[h].borgbackup_management_station is defined and inventory_hostname == hostvars[h].borgbackup_management_station %}
+        {% if b.type == 'hetzner' %}
-    {% for b in hostvars[h].borgbackup_servers %}
+REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ h }}
-    # {{ b.fqdn }}
+        {% else %}
-{% if b.type == 'hetzner' %}
+REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ h }}
-      REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ h }}
+        {% endif %}
-{% else %}
+/usr/local/bin/borg prune -v $REPOSITORY {{ b.options }} -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }}
-      REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ h }}
-{% endif %}
-      /usr/local/bin/borg prune -v $REPOSITORY {{ b.options }} -H {{ hostvars[h].borgbackup_retention.hourly }} -d {{ hostvars[h].borgbackup_retention.daily }} -w {{ hostvars[h].borgbackup_retention.weekly }} -m {{ hostvars[h].borgbackup_retention.monthly }} -y {{ hostvars[h].borgbackup_retention.yearly }}
 
       {% endfor %}
     {% endif %}