Project

General

Profile

Backup » History » Version 20

Nicolas BERTRAND, 01/11/2017 04:31 PM

1 3 Laurent GUERBY
{{>toc}}
2 1 Laurent GUERBY
3 1 Laurent GUERBY
h1. Backup
4 1 Laurent GUERBY
5 1 Laurent GUERBY
h2. Liens
6 1 Laurent GUERBY
7 1 Laurent GUERBY
* [[Backup_infra]]
8 1 Laurent GUERBY
* [[Apt_Backports_TTNN]] borg debian packaging
9 6 Laurent GUERBY
* https://www.reddit.com/r/linux/comments/42feqz/i_asked_here_for_the_optimal_backup_solution_and/
10 1 Laurent GUERBY
11 1 Laurent GUERBY
h2. BackupPC
12 1 Laurent GUERBY
13 1 Laurent GUERBY
* http://backuppc.sourceforge.net/
14 1 Laurent GUERBY
15 1 Laurent GUERBY
h2. Attic
16 1 Laurent GUERBY
17 1 Laurent GUERBY
* https://attic-backup.org/
18 1 Laurent GUERBY
* https://lists.tetaneutral.net/pipermail/technique/2015-September/001971.html
19 1 Laurent GUERBY
** Logiciel de backup : choix de attic
20 1 Laurent GUERBY
21 1 Laurent GUERBY
h2. Borg
22 1 Laurent GUERBY
23 1 Laurent GUERBY
* https://github.com/borgbackup
24 1 Laurent GUERBY
* http://readthedocs.org/projects/borgbackup/
25 2 Laurent GUERBY
* http://puppet.tetaneutral.net/pool/main/b/borgbackup/
26 2 Laurent GUERBY
* http://puppet.tetaneutral.net/dists/
27 1 Laurent GUERBY
28 20 Nicolas BERTRAND
Pour un peu automatiser + cron, on peut utiliser borgmatic:
29 20 Nicolas BERTRAND
* https://github.com/witten/borgmatic
30 11 Laurent GUERBY
h2. Borg script
31 11 Laurent GUERBY
32 18 Laurent GUERBY
*Note 20160428* : le script est probablement inutile cf https://github.com/borgbackup/borg/issues/994
33 17 Laurent GUERBY
34 11 Laurent GUERBY
Pour une machine qui va etre eteinte et rallumée de maniere non controlable.
35 11 Laurent GUERBY
36 12 Laurent GUERBY
Creation initiale avec un user normal capable de ssh sur MACHINE:PORT :
37 12 Laurent GUERBY
38 12 Laurent GUERBY
<pre>
39 12 Laurent GUERBY
borg init --encryption keyfile ssh://USER@MACHINE:PORT/some/where/borg/NICK-repo
40 12 Laurent GUERBY
</pre>
41 12 Laurent GUERBY
42 19 Nicolas BERTRAND
On A 2 types d'encryption keyfile et repokey
43 19 Nicolas BERTRAND
* en keyfile: la clef est stockée 'localement' est doit aussi être backupé. mode "passphrase + key"
44 19 Nicolas BERTRAND
* repokey : la clef est stocké dans le repo only: mode "passphrase only"
45 19 Nicolas BERTRAND
<pre>
46 19 Nicolas BERTRAND
11.1026 < guerby> [09:39:25] zorun, tu as une ref dans la doc ? ce que j'ai trouvé http://borgbackup.readthedocs.io/en/stable/quickstart.html#encrypted-repos
47 19 Nicolas BERTRAND
11.1026 < guerby> [09:39:38] "so you still have the key in case it gets corrupted or lost. Also keep your passphrase at a safe place."
48 19 Nicolas BERTRAND
11.1026 < zorun> [09:50:10] guerby: cherche « repokey » dans https://borgbackup.readthedocs.io/en/stable/usage.html
49 19 Nicolas BERTRAND
11.1026 < zorun> [09:50:19] # Local repository (default is to use encryption in repokey mode)
50 19 Nicolas BERTRAND
11.1026 < zorun> [09:50:27] If you want “passphrase-only” security, use the repokey mode. The key will be stored inside the repository (in its “config” file). In above mentioned attack scenario, the attacker will have the key (but not the passphrase).
51 19 Nicolas BERTRAND
11.1026 < zorun> [09:50:43] If you want “passphrase and having-the-key” security, use the keyfile mode. The key will be stored in your home directory (in .config/borg/keys). In the attack scenario, the attacker who has just access to your repo won’t have the key (and also not the passphrase).
52 19 Nicolas BERTRAND
11.1026 < taziden> [09:51:21] et la méthode par défaut, c'est repokey
53 19 Nicolas BERTRAND
</pre>
54 19 Nicolas BERTRAND
  
55 19 Nicolas BERTRAND
56 12 Laurent GUERBY
Et setup cron + script :
57 11 Laurent GUERBY
<pre>
58 11 Laurent GUERBY
# crontab -l
59 11 Laurent GUERBY
@reboot /root/cron-borg.sh
60 11 Laurent GUERBY
61 11 Laurent GUERBY
62 11 Laurent GUERBY
63 11 Laurent GUERBY
# cat /root/cron-borg.sh
64 11 Laurent GUERBY
#!/bin/bash
65 11 Laurent GUERBY
export LANG=en_US.UTF-8
66 11 Laurent GUERBY
mkdir -p /root/borg >& /dev/null
67 11 Laurent GUERBY
68 11 Laurent GUERBY
sleep 300
69 11 Laurent GUERBY
echo === start === $(date) >> /root/borg/cron.log
70 11 Laurent GUERBY
71 11 Laurent GUERBY
NICK=myhost
72 11 Laurent GUERBY
REPO=ssh://USER@MACHINE:PORT/some/where/borg/${NICK}-repo
73 11 Laurent GUERBY
export BORG_PASSPHRASE=lalalala
74 11 Laurent GUERBY
75 11 Laurent GUERBY
if [ -f /root/borg/stamp ]; then
76 11 Laurent GUERBY
    STAMP=$(cat /root/borg/stamp)
77 11 Laurent GUERBY
    borg break-lock $REPO
78 11 Laurent GUERBY
else
79 11 Laurent GUERBY
    STAMP=$(date '+%Y%m%dT%H%M%S')
80 11 Laurent GUERBY
    if [ -f /root/borg/previous-stamp ]; then
81 1 Laurent GUERBY
	  PREVIOUS_STAMP=$(cat /root/borg/previous-stamp)
82 14 Laurent GUERBY
	  while [ "${STAMP%T*}" = "${PREVIOUS_STAMP%T*}" ]; do
83 14 Laurent GUERBY
              STAMP=$(date '+%Y%m%dT%H%M%S')
84 13 Laurent GUERBY
              echo === delay === $(date) >> /root/borg/cron.log
85 14 Laurent GUERBY
	      sleep 1h
86 14 Laurent GUERBY
	  done
87 11 Laurent GUERBY
    fi
88 11 Laurent GUERBY
    echo $STAMP > /root/borg/stamp
89 11 Laurent GUERBY
fi
90 11 Laurent GUERBY
91 11 Laurent GUERBY
92 16 Laurent GUERBY
borg create --compression lz4 --stats --verbose \
93 16 Laurent GUERBY
   --exclude /root/borg --exclude '/home/*/.cache' --exclude-caches --one-file-system \
94 16 Laurent GUERBY
   ${REPO}::${NICK}-$STAMP / >> /root/borg/log-$STAMP 2>> /root/borg/err-$STAMP
95 1 Laurent GUERBY
96 16 Laurent GUERBY
res=$?
97 16 Laurent GUERBY
98 16 Laurent GUERBY
if [ $res -eq 0 -o $res eq 1 ]; then
99 11 Laurent GUERBY
    mv -f /root/borg/stamp /root/borg/previous-stamp >& /dev/null
100 11 Laurent GUERBY
    rm -f /root/borg/stamp >& /dev/null
101 1 Laurent GUERBY
fi
102 1 Laurent GUERBY
103 1 Laurent GUERBY
104 16 Laurent GUERBY
echo === done === $res === $(date) >> /root/borg/cron.log
105 14 Laurent GUERBY
106 14 Laurent GUERBY
exec "$0"
107 11 Laurent GUERBY
</pre>
108 1 Laurent GUERBY
109 1 Laurent GUERBY
h2. Migration Attic vers Borg
110 7 Laurent GUERBY
111 4 Mehdi Abaakouk
* https://github.com/borgbackup/borg/pull/231
112 4 Mehdi Abaakouk
* old: https://chiliproject.tetaneutral.net/projects/git-tetaneutral-net/repository/puppet-backup
113 1 Laurent GUERBY
* new: https://chiliproject.tetaneutral.net/projects/git-tetaneutral-net/repository/puppetmaster/revisions/master/entry/modules/ttnn/manifests/backup.pp
114 1 Laurent GUERBY
** git history BackupPC => Attic => Borg
115 4 Mehdi Abaakouk
116 5 Laurent GUERBY
<pre>
117 4 Mehdi Abaakouk
# apt-get -t jessie-backports install borgbackup
118 4 Mehdi Abaakouk
$ cd /backup/attic/
119 4 Mehdi Abaakouk
$ borg upgrade <repo>
120 4 Mehdi Abaakouk
$ borg check --repair <repo>
121 4 Mehdi Abaakouk
$ mv <repo> ../borg/
122 4 Mehdi Abaakouk
$ chown -R backupinfra: /backup/borg/<repo>
123 4 Mehdi Abaakouk
</pre>
124 8 Laurent GUERBY
125 4 Mehdi Abaakouk
Dans le module puppet, le changement le plus important est le parametre compression explicite pour correspondre au défaut de attic create :
126 4 Mehdi Abaakouk
127 8 Laurent GUERBY
<pre>
128 4 Mehdi Abaakouk
attic create ... <repo> -> borg create --compression zlib,6 ... <repo>
129 4 Mehdi Abaakouk
</pre>
130 4 Mehdi Abaakouk
131 9 Laurent GUERBY
Sinon le prochain backup sera non compressé, et aucun nouveau chucks ne correspondra aux anciens -> perte de la dedup. "zlib,6" étant le niveau de compression de attic.
132 9 Laurent GUERBY
133 10 Laurent GUERBY
https://github.com/jborg/attic/issues/299
134 9 Laurent GUERBY
http://borgbackup.readthedocs.org/en/stable/usage.html#environment-variables
135 9 Laurent GUERBY
<pre>
136 9 Laurent GUERBY
export ATTIC_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=yes
137 1 Laurent GUERBY
</pre>