alban/ansible-borgbackup
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[fix] Management server should have keys and should work

Browse Source
This commit is contained in:
Alban 2019-07-11 20:08:09 +00:00 committed by root
parent 4d6773c234
commit 23609395dc
6 changed files with 131 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
defaults/main.yml
View File

@ -4,26 +4,40 @@ borgbackup_required: true
borgbackup_client_user: root
borgbackup_ssh_key: "~{{ borgbackup_client_user }}/.ssh/id_borg_rsa"
borgbackup_version: "1.1.4"
borgbackup_checksum: "sha256:4ecf507f21f0db7c437b2ef34566273d7ba5a7d05e921c6f0e3406c3f96933a7"
borgbackup_version: "1.1.10"
borgbackup_checksum: "sha256:6338d67aad4b5cd327b25ea363e30f0ed4abc425ce2d6a597c75a67a876ef9af"
borgbackup_download_url: "https://github.com/borgbackup/borg/releases/download/{{ borgbackup_version }}/borg-linux64"
borgbackup_compression: "auto,zlib,6"
borgbackup_encryption_mode: keyfile
borgbackup_pre_commands:
- '[[ ! -f "/usr/sbin/automysqlbackup" ]] || /usr/sbin/automysqlbackup'
- "[ -d /etc/backup.d/ ] && run-parts --verbose /etc/backup.d/"
borgbackup_post_commands: []
borgbackup_include:
- "/etc"
- "/home"
- "/root"
- "/var/www"
- "/var/log"
- "/"
borgbackup_exclude: []
borgbackup_exclude:
- "*/local/*"
- "*/tmp/*"
- "*CACHE*"
- "/dev"
- "/proc"
- "/run"
- "/sys"
- "/tmp"
- "/var/cache/apt"
- "/var/lib/amavis/tmp"
- "/var/lib/amavis/virusmails"
- "/var/lib/lxc"
- "/var/lib/lxcfs"
- "/var/lib/php/sessions"
- "/var/lib/php5"
- "/var/run"
- "/var/spool/postfix"
- "/var/tmp"
borgbackup_retention:
hourly: 12
@ -42,6 +56,11 @@ borgbackup_management_station: ''
borgbackup_management_user: ''
borgbackup_management_ssh_pubkey: ''
borgbackup_management_copy_keys: true
borgbackup_management_key_name: 'backupserver_example_com__repo_dir_'
borgbackup_remote_ratelimit: 6250 # in KiB/s so 6250 <-> 50Mb/s
borgbackup_owner: root
borgbackup_group: root
borgbackup_shell: "/bin/bash"

64
tasks/borg-client.yml
View File

@ -33,57 +33,23 @@
{% endif %}
with_items: "{{ borgbackup_servers }}"
- name: client | put sshpubkey on the normal backupserver
- name: client | put non management sshpubkey on the normal backupserver
authorized_key:
user: "{{ item.user }}"
key: "{{ sshkey.stdout }}"
key_options: 'command="cd {{ item.home }}{{ item.pool }}/{{ inventory_hostname }};borg serve {% if borgbackup_appendonly %}--append-only {% endif %}--restrict-to-path {{ item.home }}/{{ item.pool }}/{{ inventory_hostname }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
delegate_to: "{{ item.fqdn }}"
when: item.type == 'normal'
when: inventory_hostname != borgbackup_management_station
with_items: "{{ borgbackup_servers }}"
# rsync.net and hetzner have no python, so we can only use raw to manage ssh keys - workaround with local tmp file
- name: client | get authorized_keys file
raw: scp {{ item.user }}@{{ item.fqdn }}:.ssh/authorized_keys /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys
delegate_to: localhost
become: false
when: item.type in ['rsync.net','hetzner']
with_items: "{{ borgbackup_servers }}"
changed_when: false
- name: client | modify local rsync.net/hetzner authorized_keys
- name: client | put management sshpubkey on backupservers, no appendonly nor path restriction
authorized_key:
user: "{{ ansible_user_id }}"
user: "{{ item.user }}"
key: "{{ sshkey.stdout }}"
key_options: 'command="cd {{ item.pool }}/{{ inventory_hostname }};/usr/local/bin/borg1 serve {% if borgbackup_appendonly %}--append-only {% endif %} --restrict-to-path {{ item.pool }}/{{ inventory_hostname }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
path: "/tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys"
manage_dir: false
delegate_to: localhost
become: false
when: item.type in ['rsync.net','hetzner']
key_options: 'command="cd {{ item.home }}{{ item.pool }}/{{ inventory_hostname }};borg serve ",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
delegate_to: "{{ item.fqdn }}"
when: inventory_hostname == borgbackup_management_station
with_items: "{{ borgbackup_servers }}"
register: authkeys
- name: client | upload local authorized_keys to rsync.net / hetzner
raw: scp /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys {{ item.user }}@{{ item.fqdn }}:.ssh/authorized_keys
delegate_to: localhost
become: false
when: item.type in ['rsync.net','hetzner'] and authkeys.changed
with_items: "{{ borgbackup_servers }}"
- name: client | remove tmp authorized_keys files
file:
path: /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys
state: absent
delegate_to: localhost
become: false
with_items: "{{ borgbackup_servers }}"
when: authkeys.changed
changed_when: false
- name: client | check for mysql
stat: path=/var/lib/automysqlbackup
register: automysql
- name: client | put wrapper script
template:
@ -109,12 +75,10 @@
day: "{{ borgbackup_cron_day }}"
job: "/usr/local/bin/borg-backup backup"
- name: client | disable automysqlbackup cronjob, it's in our pre-backup-tasks
lineinfile:
dest: "/etc/cron.daily/automysqlbackup"
regexp: "^/usr/sbin/automysqlbackup$"
line: "#/usr/sbin/automysqlbackup"
state: "present"
backrefs: true
create: false
when: automysql.stat.isdir is defined and automysql.stat.isdir == True
- name: client | create log directory
file:
path: "/var/log/borgbackup"
state: "directory"
owner: "root"
group: "root"
mode: "0755"

6
tasks/main.yml
View File

@ -22,3 +22,9 @@
when: >
inventory_hostname in borgbackup_management_group and
inventory_hostname not in borgbackup_servers_group
- include_tasks: management-keys.yml
when: >
inventory_hostname not in borgbackup_management_group and
inventory_hostname not in borgbackup_servers_group and
borgbackup_management_copy_keys

23
tasks/management-keys.yml Normal file
View File

@ -0,0 +1,23 @@
---
- name: management | get key file
fetch:
src: "~{{ borgbackup_client_user}}/.config/borg/keys/{{ borgbackup_management_key_name }}{{ inventory_hostname }}"
dest: /tmp/.borgbackup_key_{{ inventory_hostname }}
flat: yes
changed_when: false
- name: management | upload key to management
raw: scp /tmp/.borgbackup_key_{{ inventory_hostname }} {{ borgbackup_management_user }}@{{ borgbackup_management_station }}:~/.config/borg/keys/{{ borgbackup_management_key_name }}{{ inventory_hostname }}
delegate_to: localhost
become: false
changed_when: false
- name: management | clean local copy
raw: rm -f /tmp/.borgbackup_key_{{ inventory_hostname }}
delegate_to: localhost
become: false
changed_when: false

41
templates/borg-backup.sh.j2
View File

@ -73,33 +73,58 @@ if [ "$1" = "backup" ]
then
date=`date +%Y%m%d-%H%M`
# Running some commands pre-backup
LOG_DEST="/var/log/borgbackup/${date}"
LOG_FILE="${LOG_DEST}.log"
log(){ echo -e "\n$(date '+%Y-%m-%d %H:%M:%S') $@" | tee -a "$LOG_FILE"; }
_term(){ echo -e "\n## END ##" | tee -a "$LOG_FILE"; exit 1; }
trap _term SIGINT SIGTERM
# Running some commands pre-backup
(
{% for precommand in borgbackup_pre_commands %}
{{ precommand }}
{{ precommand }}
{% endfor %}
) &>> "$LOG_FILE"
{% if borgbackup_remote_ratelimit %}
{% set rate_limit %} --remote-ratelimit={{borgbackup_remote_ratelimit}} {% endset %}
{% else %}
{% set rate_limit = " " %}
{% endif %}
{% for b in borgbackup_servers %}
printf "Backing up to {{ b.fqdn }} :\n"
{% if b.type == 'hetzner' %}
REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ inventory_hostname }}
{% else %}
REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ inventory_hostname }}
{% endif %}
/usr/local/bin/borg create -x --progress --compression {{ borgbackup_compression }} --stats {{ b.options }} $REPOSITORY::$date {% for dir in borgbackup_include %}{{ dir }} {% endfor %}{% if automysql.stat.isdir is defined and automysql.stat.isdir == True %}/var/lib/automysqlbackup{% endif %} {% for dir in borgbackup_exclude %} --exclude '{{ dir }}'{% endfor %}
log "## Backing up to {{ b.fqdn }} "
/usr/local/bin/borg create {{ rate_limit }} -x --compression {{ borgbackup_compression }} --stats {{ b.options }} $REPOSITORY::$date {% for dir in borgbackup_include %}{{ dir }} {% endfor %} {% for dir in borgbackup_exclude %} --exclude '{{ dir }}'{% endfor %} &>> $LOG_FILE
if [ "$?" -eq "0" ]; then printf "Backup succeeded on $date to {{ b.fqdn }}\n" >> /var/log/borg-backup.log; fi
log "## Checking the archive integrity "
/usr/local/bin/borg check $REPOSITORY::$date -v &>> "$LOG_FILE"
log "## Retrieving archive json file"
/usr/local/bin/borg info $REPOSITORY::$date --json > "${LOG_DEST}.json"
{% if not borgbackup_appendonly %}
# prune old backups
/usr/local/bin/borg prune {{ b.options }} -v $REPOSITORY -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }}
log "## Pruning the repository"
/usr/local/bin/borg prune {{ b.options }} -v $REPOSITORY -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }} &>> "$LOG_FILE"
{% endif %}
{% endfor %}
# Running some commands post-backup
{% for postcommand in borgbackup_post_commands %}
{% if borgbackup_post_commands |length > 1 %}
(
{% for postcommand in borgbackup_post_commands %}
{{ postcommand }}
{% endfor %}
{% endfor %}
) &>> "$LOG_FILE"
{% endif %}
_term
fi

46
templates/prune.sh.j2
View File

@ -1,27 +1,35 @@
#jinja2:lstrip_blocks: True
#!/bin/bash
usage(){
cat << EOL
# This script is intended to run on a trusted management station to purge borg repo's in
# append-only mode.
# Don't put it on the backup server, it contains all borg secrets!
This script is intended to run on a trusted management station to purge borg repo's in
append-only mode.
Don't put it on the backup server, it contains all borg secrets!
EOL
}
DATE=$(date +%y%m%d)
LOG_DIR=/var/log/borgbackup
[ ! -d $LOG_DIR ] && mkdir $LOG_DIR
LOG_FILE=/var/log/borgbackup-prune/${DATE}.log
exec &> >(tee "$LOG_FILE")
{% for h in groups['all'] %}
{% if hostvars[h].borgbackup_required | default(True) -%}
# Host: {{ h }}
{% if h != borgbackup_management_station and h not in groups['borgbackup_servers'] -%}
echo "Host: {{ h }}"
export BORG_PASSPHRASE={{ hostvars[h].borgbackup_passphrase }}
{% if borgbackup_management_station is defined and inventory_hostname == borgbackup_management_station %}
{% for b in borgbackup_servers %}
{% if b.type == 'hetzner' %}
REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ h }}
{% else %}
REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ h }}
{% endif %}
/usr/local/bin/borg prune -v $REPOSITORY {{ b.options }} -H {{ borgbackup_retention.hourly }} -d {{ borgbackup_retention.daily }} -w {{ borgbackup_retention.weekly }} -m {{ borgbackup_retention.monthly }} -y {{ borgbackup_retention.yearly }}
export BORG_PASSPHRASE={{ hostvars[h].borgbackup_passphrase }}
{% if hostvars[h].borgbackup_management_station is defined and inventory_hostname == hostvars[h].borgbackup_management_station %}
{% for b in hostvars[h].borgbackup_servers %}
# {{ b.fqdn }}
{% if b.type == 'hetzner' %}
REPOSITORY=ssh://{{ b.user }}@{{ b.fqdn }}:23/./{{ b.home }}{{ b.pool }}/{{ h }}
{% else %}
REPOSITORY={{ b.user }}@{{ b.fqdn }}:{{ b.home }}{{ b.pool }}/{{ h }}
{% endif %}
/usr/local/bin/borg prune -v $REPOSITORY {{ b.options }} -H {{ hostvars[h].borgbackup_retention.hourly }} -d {{ hostvars[h].borgbackup_retention.daily }} -w {{ hostvars[h].borgbackup_retention.weekly }} -m {{ hostvars[h].borgbackup_retention.monthly }} -y {{ hostvars[h].borgbackup_retention.yearly }}
{% endfor %}
{% endif %}
{% endfor %}
{% endif %}
{% endif %}
{% endfor %}