[fix] Management server should have keys and should work
This commit is contained in:
root
parent
4d6773c234
commit
23609395dc
@ -4,26 +4,40 @@ borgbackup_required: true
|
||||
borgbackup_client_user: root
|
||||
borgbackup_ssh_key: "~{{ borgbackup_client_user }}/.ssh/id_borg_rsa"
|
||||
|
||||
borgbackup_version: "1.1.4"
|
||||
borgbackup_checksum: "sha256:4ecf507f21f0db7c437b2ef34566273d7ba5a7d05e921c6f0e3406c3f96933a7"
|
||||
borgbackup_version: "1.1.10"
|
||||
borgbackup_checksum: "sha256:6338d67aad4b5cd327b25ea363e30f0ed4abc425ce2d6a597c75a67a876ef9af"
|
||||
borgbackup_download_url: "https://github.com/borgbackup/borg/releases/download/{{ borgbackup_version }}/borg-linux64"
|
||||
|
||||
borgbackup_compression: "auto,zlib,6"
|
||||
borgbackup_encryption_mode: keyfile
|
||||
|
||||
borgbackup_pre_commands:
|
||||
- '[[ ! -f "/usr/sbin/automysqlbackup" ]] || /usr/sbin/automysqlbackup'
|
||||
- "[ -d /etc/backup.d/ ] && run-parts --verbose /etc/backup.d/"
|
||||
|
||||
borgbackup_post_commands: []
|
||||
|
||||
borgbackup_include:
|
||||
- "/etc"
|
||||
- "/home"
|
||||
- "/root"
|
||||
- "/var/www"
|
||||
- "/var/log"
|
||||
- "/"
|
||||
|
||||
borgbackup_exclude: []
|
||||
borgbackup_exclude:
|
||||
- "*/local/*"
|
||||
- "*/tmp/*"
|
||||
- "*CACHE*"
|
||||
- "/dev"
|
||||
- "/proc"
|
||||
- "/run"
|
||||
- "/sys"
|
||||
- "/tmp"
|
||||
- "/var/cache/apt"
|
||||
- "/var/lib/amavis/tmp"
|
||||
- "/var/lib/amavis/virusmails"
|
||||
- "/var/lib/lxc"
|
||||
- "/var/lib/lxcfs"
|
||||
- "/var/lib/php/sessions"
|
||||
- "/var/lib/php5"
|
||||
- "/var/run"
|
||||
- "/var/spool/postfix"
|
||||
- "/var/tmp"
|
||||
|
||||
borgbackup_retention:
|
||||
hourly: 12
|
||||
@ -42,6 +56,11 @@ borgbackup_management_station: ''
|
||||
borgbackup_management_user: ''
|
||||
borgbackup_management_ssh_pubkey: ''
|
||||
|
||||
borgbackup_management_copy_keys: true
|
||||
borgbackup_management_key_name: 'backupserver_example_com__repo_dir_'
|
||||
|
||||
|
||||
borgbackup_remote_ratelimit: 6250 # in KiB/s so 6250 <-> 50Mb/s
|
||||
borgbackup_owner: root
|
||||
borgbackup_group: root
|
||||
borgbackup_shell: "/bin/bash"
|
||||
|
||||
@ -33,57 +33,23 @@
|
||||
{% endif %}
|
||||
with_items: "{{ borgbackup_servers }}"
|
||||
|
||||
- name: client | put sshpubkey on the normal backupserver
|
||||
- name: client | put non management sshpubkey on the normal backupserver
|
||||
authorized_key:
|
||||
user: "{{ item.user }}"
|
||||
key: "{{ sshkey.stdout }}"
|
||||
key_options: 'command="cd {{ item.home }}{{ item.pool }}/{{ inventory_hostname }};borg serve {% if borgbackup_appendonly %}--append-only {% endif %}--restrict-to-path {{ item.home }}/{{ item.pool }}/{{ inventory_hostname }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
|
||||
delegate_to: "{{ item.fqdn }}"
|
||||
when: item.type == 'normal'
|
||||
when: inventory_hostname != borgbackup_management_station
|
||||
with_items: "{{ borgbackup_servers }}"
|
||||
|
||||
# rsync.net and hetzner have no python, so we can only use raw to manage ssh keys - workaround with local tmp file
|
||||
- name: client | get authorized_keys file
|
||||
raw: scp {{ item.user }}@{{ item.fqdn }}:.ssh/authorized_keys /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
when: item.type in ['rsync.net','hetzner']
|
||||
with_items: "{{ borgbackup_servers }}"
|
||||
changed_when: false
|
||||
|
||||
- name: client | modify local rsync.net/hetzner authorized_keys
|
||||
- name: client | put management sshpubkey on backupservers, no appendonly nor path restriction
|
||||
authorized_key:
|
||||
user: "{{ ansible_user_id }}"
|
||||
user: "{{ item.user }}"
|
||||
key: "{{ sshkey.stdout }}"
|
||||
key_options: 'command="cd {{ item.pool }}/{{ inventory_hostname }};/usr/local/bin/borg1 serve {% if borgbackup_appendonly %}--append-only {% endif %} --restrict-to-path {{ item.pool }}/{{ inventory_hostname }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
|
||||
path: "/tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys"
|
||||
manage_dir: false
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
when: item.type in ['rsync.net','hetzner']
|
||||
key_options: 'command="cd {{ item.home }}{{ item.pool }}/{{ inventory_hostname }};borg serve ",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
|
||||
delegate_to: "{{ item.fqdn }}"
|
||||
when: inventory_hostname == borgbackup_management_station
|
||||
with_items: "{{ borgbackup_servers }}"
|
||||
register: authkeys
|
||||
|
||||
- name: client | upload local authorized_keys to rsync.net / hetzner
|
||||
raw: scp /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys {{ item.user }}@{{ item.fqdn }}:.ssh/authorized_keys
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
when: item.type in ['rsync.net','hetzner'] and authkeys.changed
|
||||
with_items: "{{ borgbackup_servers }}"
|
||||
|
||||
- name: client | remove tmp authorized_keys files
|
||||
file:
|
||||
path: /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys
|
||||
state: absent
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
with_items: "{{ borgbackup_servers }}"
|
||||
when: authkeys.changed
|
||||
changed_when: false
|
||||
|
||||
- name: client | check for mysql
|
||||
stat: path=/var/lib/automysqlbackup
|
||||
register: automysql
|
||||
|
||||
- name: client | put wrapper script
|
||||
template:
|
||||
@ -109,12 +75,10 @@
|
||||
day: "{{ borgbackup_cron_day }}"
|
||||
job: "/usr/local/bin/borg-backup backup"
|
||||
|
||||
- name: client | disable automysqlbackup cronjob, it's in our pre-backup-tasks
|
||||
lineinfile:
|
||||
dest: "/etc/cron.daily/automysqlbackup"
|
||||
regexp: "^/usr/sbin/automysqlbackup$"
|
||||
line: "#/usr/sbin/automysqlbackup"
|
||||
state: "present"
|
||||
backrefs: true
|
||||
create: false
|
||||
when: automysql.stat.isdir is defined and automysql.stat.isdir == True
|
||||
- name: client | create log directory
|
||||
file:
|
||||
path: "/var/log/borgbackup"
|
||||
state: "directory"
|
||||
owner: "root"
|
||||
group: "root"
|
||||
mode: "0755"
|
||||
|
||||
@ -22,3 +22,9 @@
|
||||
when: >
|
||||
inventory_hostname in borgbackup_management_group and
|
||||
inventory_hostname not in borgbackup_servers_group
|
||||
|
||||
- include_tasks: management-keys.yml
|
||||
when: >
|
||||
inventory_hostname not in borgbackup_management_group and
|
||||
inventory_hostname not in borgbackup_servers_group and
|
||||
borgbackup_management_copy_keys
|
||||
|
||||
23
tasks/management-keys.yml
Normal file
23
tasks/management-keys.yml
Normal file
@ -0,0 +1,23 @@
|
||||
---
|
||||
|
||||
- name: management | get key file
|
||||
fetch:
|
||||
src: "~{{ borgbackup_client_user}}/.config/borg/keys/{{ borgbackup_management_key_name }}{{ inventory_hostname }}"
|
||||
dest: /tmp/.borgbackup_key_{{ inventory_hostname }}
|
||||
flat: yes
|
||||
changed_when: false
|
||||
|
||||
- name: management | upload key to management
|
||||
raw: scp /tmp/.borgbackup_key_{{ inventory_hostname }} {{ borgbackup_management_user }}@{{ borgbackup_management_station }}:~/.config/borg/keys/{{ borgbackup_management_key_name }}{{ inventory_hostname }}
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
changed_when: false
|
||||
|
||||
- name: management | clean local copy
|
||||
raw: rm -f /tmp/.borgbackup_key_{{ inventory_hostname }}
|
||||
delegate_to: localhost
|
||||
become: false
|
||||
changed_when: false
|
||||
|
||||
|
||||
|
||||
@ -73,33 +73,58 @@ if [ "$1" = "backup" ]
|
||||
then
|
||||
date=`date +%Y%m%d-%H%M`
|
||||
|
||||
# Running some commands pre-backup
|
||||
LOG_DEST="/var/log/borgbackup/${date}"
|
||||
LOG_FILE="${LOG_DEST}.log"
|
||||
log(){ echo -e "\n$(date '+%Y-%m-%d %H:%M:%S') $@" | tee -a "$LOG_FILE"; }
|
||||
_term(){ echo -e "\n## END ##" | tee -a "$LOG_FILE"; exit 1; }
|
||||
trap _term SIGINT SIGTERM
|
||||
|
||||
# Running some commands pre-backup
|
||||
(
|
||||
{% for precommand in borgbackup_pre_commands %}
|
||||
{{ precommand }}
|
||||
{{ precommand }}
|
||||
{% endfor %}
|
||||
) &>> "$LOG_FILE"
|
||||
|
||||
{% if borgbackup_remote_ratelimit %}
|
||||
{% set rate_limit %} --remote-ratelimit={{borgbackup_remote_ratelimit}} {% endset %}
|
||||
{% else %}
|
||||
{% set rate_limit = " " %}
|
||||
{% endif %}
|
||||
|
||||
{% for b in borgbackup_servers %}
|
||||
printf "Backing up to {{ b.fqdn }} :\n"
|
||||
{% if b.type == 'hetzner' %}
|
||||
REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ inventory_hostname }}
|
||||
{% else %}
|
||||
REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ inventory_hostname }}
|
||||
{% endif %}
|
||||
|
||||
/usr/local/bin/borg create -x --progress --compression {{ borgbackup_compression }} --stats {{ b.options }} $REPOSITORY::$date {% for dir in borgbackup_include %}{{ dir }} {% endfor %}{% if automysql.stat.isdir is defined and automysql.stat.isdir == True %}/var/lib/automysqlbackup{% endif %} {% for dir in borgbackup_exclude %} --exclude '{{ dir }}'{% endfor %}
|
||||
log "## Backing up to {{ b.fqdn }} "
|
||||
/usr/local/bin/borg create {{ rate_limit }} -x --compression {{ borgbackup_compression }} --stats {{ b.options }} $REPOSITORY::$date {% for dir in borgbackup_include %}{{ dir }} {% endfor %} {% for dir in borgbackup_exclude %} --exclude '{{ dir }}'{% endfor %} &>> $LOG_FILE
|
||||
|
||||
if [ "$?" -eq "0" ]; then printf "Backup succeeded on $date to {{ b.fqdn }}\n" >> /var/log/borg-backup.log; fi
|
||||
|
||||
log "## Checking the archive integrity "
|
||||
/usr/local/bin/borg check $REPOSITORY::$date -v &>> "$LOG_FILE"
|
||||
|
||||
log "## Retrieving archive json file"
|
||||
/usr/local/bin/borg info $REPOSITORY::$date --json > "${LOG_DEST}.json"
|
||||
|
||||
{% if not borgbackup_appendonly %}
|
||||
# prune old backups
|
||||
/usr/local/bin/borg prune {{ b.options }} -v $REPOSITORY -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }}
|
||||
log "## Pruning the repository"
|
||||
/usr/local/bin/borg prune {{ b.options }} -v $REPOSITORY -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }} &>> "$LOG_FILE"
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
|
||||
# Running some commands post-backup
|
||||
{% for postcommand in borgbackup_post_commands %}
|
||||
{% if borgbackup_post_commands |length > 1 %}
|
||||
(
|
||||
{% for postcommand in borgbackup_post_commands %}
|
||||
{{ postcommand }}
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
) &>> "$LOG_FILE"
|
||||
{% endif %}
|
||||
|
||||
_term
|
||||
fi
|
||||
|
||||
|
||||
@ -1,25 +1,33 @@
|
||||
#jinja2:lstrip_blocks: True
|
||||
#!/bin/bash
|
||||
usage(){
|
||||
cat << EOL
|
||||
|
||||
# This script is intended to run on a trusted management station to purge borg repo's in
|
||||
# append-only mode.
|
||||
# Don't put it on the backup server, it contains all borg secrets!
|
||||
This script is intended to run on a trusted management station to purge borg repo's in
|
||||
append-only mode.
|
||||
Don't put it on the backup server, it contains all borg secrets!
|
||||
|
||||
EOL
|
||||
}
|
||||
|
||||
DATE=$(date +%y%m%d)
|
||||
LOG_DIR=/var/log/borgbackup
|
||||
[ ! -d $LOG_DIR ] && mkdir $LOG_DIR
|
||||
LOG_FILE=/var/log/borgbackup-prune/${DATE}.log
|
||||
exec &> >(tee "$LOG_FILE")
|
||||
|
||||
{% for h in groups['all'] %}
|
||||
{% if hostvars[h].borgbackup_required | default(True) -%}
|
||||
# Host: {{ h }}
|
||||
|
||||
export BORG_PASSPHRASE={{ hostvars[h].borgbackup_passphrase }}
|
||||
|
||||
{% if hostvars[h].borgbackup_management_station is defined and inventory_hostname == hostvars[h].borgbackup_management_station %}
|
||||
{% for b in hostvars[h].borgbackup_servers %}
|
||||
# {{ b.fqdn }}
|
||||
{% if b.type == 'hetzner' %}
|
||||
REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ h }}
|
||||
{% else %}
|
||||
REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ h }}
|
||||
{% endif %}
|
||||
/usr/local/bin/borg prune -v $REPOSITORY {{ b.options }} -H {{ hostvars[h].borgbackup_retention.hourly }} -d {{ hostvars[h].borgbackup_retention.daily }} -w {{ hostvars[h].borgbackup_retention.weekly }} -m {{ hostvars[h].borgbackup_retention.monthly }} -y {{ hostvars[h].borgbackup_retention.yearly }}
|
||||
{% if h != borgbackup_management_station and h not in groups['borgbackup_servers'] -%}
|
||||
echo "Host: {{ h }}"
|
||||
export BORG_PASSPHRASE={{ hostvars[h].borgbackup_passphrase }}
|
||||
{% if borgbackup_management_station is defined and inventory_hostname == borgbackup_management_station %}
|
||||
{% for b in borgbackup_servers %}
|
||||
{% if b.type == 'hetzner' %}
|
||||
REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ h }}
|
||||
{% else %}
|
||||
REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ h }}
|
||||
{% endif %}
|
||||
/usr/local/bin/borg prune -v $REPOSITORY {{ b.options }} -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }}
|
||||
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user