From 4ef3487f1a0b0cdd2138b39d6ae6681578d1cedc Mon Sep 17 00:00:00 2001 From: neox Date: Thu, 23 Nov 2023 13:47:15 +0100 Subject: [PATCH] Plan de sauvegarde officiel --- Plan Borg/.gitkeep | 0 README.md | 516 +++++++++++++++++- Plan Borg/README.md => README.md.backup | 7 +- {Plan Borg/bin => bin}/countbackups | 0 {Plan Borg/bin => bin}/deploy-remote | 0 {Plan Borg/bin => bin}/dobackup-local | 0 {Plan Borg/bin => bin}/dobackup-remote | 0 {Plan Borg/bin => bin}/dobackup-rsync | 0 {Plan Borg/bin => bin}/dobackups | 0 {Plan Borg/bin => bin}/dochecks | 0 {Plan Borg/bin => bin}/dochecksb | 0 {Plan Borg/bin => bin}/doinit | 0 {Plan Borg/bin => bin}/doinit-local | 0 {Plan Borg/bin => bin}/doinit-remote | 0 {Plan Borg/bin => bin}/doinit-rsync | 0 {Plan Borg/bin => bin}/doprunes | 0 {Plan Borg/bin => bin}/doprunesb | 0 {Plan Borg/bin => bin}/doreport | 0 {Plan Borg/bin => bin}/dump-influx | 0 {Plan Borg/bin => bin}/dump-msql | 0 {Plan Borg/bin => bin}/dump-psql | 0 {Plan Borg/bin => bin}/dumps | 0 {Plan Borg/bin => bin}/lastbackups | 0 {Plan Borg/bin => bin}/listarchives | 0 {Plan Borg/bin => bin}/push-mirror | 0 {Plan Borg/models => models}/cron | 0 {Plan Borg/models => models}/dobackups | 0 {Plan Borg/models => models}/excludes | 0 .../models => models}/model-conf-local.yaml | 0 .../model-conf-remote-client.yaml | 0 .../models => models}/model-conf-remote.yaml | 0 .../models => models}/model-conf-rsync.yaml | 0 {Plan Borg/models => models}/retention.yaml | 0 script_backups_aunt.sh | 9 - script_backups_mother.sh | 22 - virt-backup_aunt.yml | 128 ----- virt-backup_mother.yml | 128 ----- 37 files changed, 504 insertions(+), 306 deletions(-) delete mode 100644 Plan Borg/.gitkeep rename Plan Borg/README.md => README.md.backup (99%) rename {Plan Borg/bin => bin}/countbackups (100%) rename {Plan Borg/bin => bin}/deploy-remote (100%) rename {Plan Borg/bin => bin}/dobackup-local (100%) rename {Plan Borg/bin => bin}/dobackup-remote (100%) rename {Plan Borg/bin => bin}/dobackup-rsync (100%) rename {Plan Borg/bin => bin}/dobackups (100%) rename {Plan Borg/bin => bin}/dochecks (100%) rename {Plan Borg/bin => bin}/dochecksb (100%) rename {Plan Borg/bin => bin}/doinit (100%) rename {Plan Borg/bin => bin}/doinit-local (100%) rename {Plan Borg/bin => bin}/doinit-remote (100%) rename {Plan Borg/bin => bin}/doinit-rsync (100%) rename {Plan Borg/bin => bin}/doprunes (100%) rename {Plan Borg/bin => bin}/doprunesb (100%) rename {Plan Borg/bin => bin}/doreport (100%) rename {Plan Borg/bin => bin}/dump-influx (100%) rename {Plan Borg/bin => bin}/dump-msql (100%) rename {Plan Borg/bin => bin}/dump-psql (100%) rename {Plan Borg/bin => bin}/dumps (100%) rename {Plan Borg/bin => bin}/lastbackups (100%) rename {Plan Borg/bin => bin}/listarchives (100%) rename {Plan Borg/bin => bin}/push-mirror (100%) rename {Plan Borg/models => models}/cron (100%) rename {Plan Borg/models => models}/dobackups (100%) rename {Plan Borg/models => models}/excludes (100%) rename {Plan Borg/models => models}/model-conf-local.yaml (100%) rename {Plan Borg/models => models}/model-conf-remote-client.yaml (100%) rename {Plan Borg/models => models}/model-conf-remote.yaml (100%) rename {Plan Borg/models => models}/model-conf-rsync.yaml (100%) rename {Plan Borg/models => models}/retention.yaml (100%) delete mode 100644 script_backups_aunt.sh delete mode 100644 script_backups_mother.sh delete mode 100644 virt-backup_aunt.yml delete mode 100644 virt-backup_mother.yml diff --git a/Plan Borg/.gitkeep b/Plan Borg/.gitkeep deleted file mode 100644 index e69de29..0000000 diff --git a/README.md b/README.md index ed8b1d0..6f17f87 100644 --- a/README.md +++ b/README.md @@ -1,21 +1,511 @@ -# Configuration des sauvegardes de l'infrastructure Libre en Communs +# Plan de Sauvegarde Borg -## Support de sauvegarde +Le plan Borg est une solution de sauvegarde basée sur Borgmatic. -Toutes les sauvegardes sont actuellement réalisées sur un disque mécanique de 6To connecté à la machine physique mother. +Documentations : +- Borgmatic : https://torsion.org/borgmatic/docs/reference/command-line/ ; +- Borgbackups : https://borgbackup.readthedocs.io/en/stable/index.html (recommandation d'aller voir le sous-menu `Usage`). -Il est prévu de réaliser des sauvegardes hors-site prochainement. +# Principes -## Sauvegardes des machines physiques +Borgmatic prend une définition déclarative des paramètres d'une sauvegarde (excludes, rétention, nommage, chemin dépôt…) pour les traduire en action Borg : créer un dépôt, le purger, le vérifier… -Les machines physiques sont sauvegardées avec rsync tous les jours à l'aide du script dédié. +Quelques pré-requis : +- l'adminsys d'une machine doit pouvoir régler lui-même certaines caractéristiques de la sauvegarde de sa machine : avec Borgmatic, il dispose d'un fichier de configuration où configurer des hooks (pour une base de données par exemple) ou définir les dossiers à sauver, définir les exclusions… +- l'adminsys de la sauvegarde doit pouvoir régler lui-même certaines caractérisiques des sauvegardes tels que rétention, horaire et autres : il dispose d'un fichier de configuration par machine sauvegardée et d'un script de déclenchement des sauvegardes. -## Sauvegardes des machines virtuelles +Flux en mode `local` : +``` +saukvipeu:/etc/cron.d/backups + -> /srv/borg/bin/dobackup-local + --> borgmatic create --verbosity 1 + -> /etc/borgmatic/fqdn.yaml + /etc/borgmatic/excludes + --> /var/backups/borg/fqdn.repo +``` -Les machines virtuelles sont sauvegardées avec virt-backup de façon quotidienne avec les périodicités suivantes : +Flux en mode `remote` : +``` +Systemd.borgmatic.timer(fqdn1) + --> systemclt start borgmatic.service + -> fqdn1:/etc/borgmatic/config.yaml + /etc/borgmatic/excludes + --ssh(borg@sauvkipeu)--> /var/backups/borg/fqdn1.repo +``` - hourly: 0 - daily: 2 - weekly: 2 - monthly: 1 - yearly: 0 +Flux en mode `rysnc` : +``` +fqdn:cron backup + --> rsync fqdn1 sauvkipeu:/var/backups/borg/mirrors/fqdn + fqdn.cache +sauvkipeu:/etc/cron.d/backups + --> /srv/borg/bin/dobackup-rsync fqdn + --> borgmatic create --verbosity 1 + -> fqdn1:/etc/borgmatic/config.yaml + --> /var/backups/borg/fqdn.repo +``` + + +Organisation des fichiers côté machine sauvegardée en mode `remote` : +- /etc/borgmatic/ + - config.yaml : configuration de la sauvegarde, + - excludes : liste d'exclusions pour la sauvegarde. + +Organisation des fichiers côté serveur de sauvegarde : +- /etc/borgmatic/ + - retention.yaml : paramétrage par défaut de la purge, par défaut inclus par les fichiers de configuration de `/etc/borgmatic.d`, + - excludes : pattern d'exclusion pour la sauvegarde du serveur de sauvegarde, +- /etc/borgmatic.d/ : configurations des sauvegardes, 1 fichier par machine pour permettre la personnalisation, + - fqdn1.yaml + - fqdn2.yaml + - … +- /var/backups/borg/ : espace de stockage des sauvegardes + - dobackups.log : log des sauvegardes, + - dochecks.log : log des vériciations des sauvegardes, + - doprunes.log : log des purges des sauvegardes, + - fqdn1.repo : dépôt des sauvegardes de la machine fqdn1, + - fqdn2.repo : dépôt des sauvegardes de la machine fqdn2, + - … +- /var/backups/borg/mirrors/ : + - fqdn3/ + - fqdn3.cache/ +- /srv/borg/bin/ : ensemble de scripts pour gérer les sauvegardes, + - countbackups : affiche le nombre de sauvegardes pour chaque dépôt de sauvegarde, + - dobackups : lance la sauvegarde de toutes les machines, appelé par `cron`, + - dobackup-local : lance une sauvegarde du serveur de sauvegarde, + - ~~dobackup-remote : lance une sauvegarde en mode `remote`, c'est à dire par une commande `ssh`,~~ + - dobackup-rsync : lance une sauvegarde en mode `rsync`, c'est à dire via un miroir, + - dochecks : lance la vériciation de chaque dépôt de sauvegarde, appelé par `cron`, + - doreport : génère un rapport sur les sauvegardes, + - doprunes : lance la purge de chaque dépôt de sauvegarde, appelé par `cron`, + - doinit : créé un dépôt de sauvegarde dans `/var/backups/borg/`, + - doinit-local : appelle `doinit` et créé le fichier de configuration associé pour le serveur de sauvegarde, + - doinit-remote : appelle `doinit` et créé le fichier de configuration associé, + - doinit-rsync : appelle `doinit` et créé le fichier de configuration associé, + - lastbackups : affiche la dernière sauvegarde de chaque dépôt, +- /srv/borg/models/ + - cron : modèle pour un fichier `cron`, + - excludes : modèle pour l'exclusion par défaut pendant les sauvegardes, + - model-conf-local.yaml, + - model-conf-remote.yaml, + - model-conf-rsync.yaml, + - retention.yaml : modèle pour le paramétrage par défaut des purges, +- /srv/borg/.borg-passphrase : passphrase des dépôts, +- /srv/borg/.ssh/ : + - authorized_keys : définition des accès restreint pour les machines à sauvegarder. + + +# Installation d'un serveur de sauvegarde + +Ajouter les backports bullseye dans `/etc/apt/source.list.d/` : +``` +echo "deb http://ftp.fr.debian.org/debian/ bullseye-backports main" > /etc/apt/sources.list.d/backports.list +``` + +Installer les paquets nécessaires : +``` +apt update +apt install -t bullseye-backports borgmatic borgbackup +apt install rsync gawk bc +``` + +Désactiver le lancement quotidien de Borgmatic : +``` +systemctl stop borgmatic.timer +``` + +Créer un utilisateur dédié `borg` : +``` +adduser --disabled-password --system --group --home /srv/borg/ --shell /bin/bash borg +``` + +Créer des clés `ssh` pour l'utilisateur `root` (si besoin) : +``` +ssh-keygen -t ed25519 +``` + +Récupérer les scripts et modèles : +``` +cd ~borg/ +mkdir bin models +URL=https://git.a-lec.org/a-lec/commissions/infrastructure/sauvegardes/-/raw/main/Plan%20Borg/ +cd bin +wget -nv $URL/bin/countbackups +wget -nv $URL/bin/dobackup-server +wget -nv $URL/bin/dobackup-remote +wget -nv $URL/bin/dobackup-rsync +wget -nv $URL/bin/dobackups +wget -nv $URL/bin/dochecks +wget -nv $URL/bin/dochecksb +wget -nv $URL/bin/doinit +wget -nv $URL/bin/doprunes +wget -nv $URL/bin/doprunesb +wget -nv $URL/bin/lastbackups +cd ../models +wget -nv $URL/models/cron +wget -nv $URL/models/excludes +wget -nv $URL/models/model-conf-local.yaml +wget -nv $URL/models/model-conf-remote.yaml +#wget -nv $URL/models/model-conf-remote-client.yaml +#wget -nv $URL/models/model-conf-rsync.yaml +wget -nv $URL/models/retention.yaml +cd .. ; find +``` + +Déployer la configuration générique de Borgmatic : +``` +mkdir -p /etc/borgmatic/ /etc/borgmatic.d/ +cp /srv/borg/models/retention.yaml /etc/borgmatic/ +cp /srv/borg/models/excludes /etc/borgmatic/ +``` +Définir une passphrase générique : +``` +echo "XXXXXXXXXXXXXXXXXXXXXXXXXXX" > ~borg/.borg-passphrase +``` + +Ajouter la ligne suivante dans `/root/.bashrc` (facilite la commande `borg` directe même si normalement on fait tout avec la commande `borgmatic`) : +``` +export BORG_PASSCOMMAND="cat /srv/borg/.borg-passphrase" +``` + +Créer un dossier dédié aux sauvegardes du plan Borg : +``` +mkdir -p /var/backups/borg +chown borg /var/backups/borg +``` + +Configurer le `cron` dans `/etc/cron.d/backups` : +``` +cp /srv/borg/models/cron /etc/cron.d/backups +cd /srv/borg/ +ln -s /etc/cron.d/backups cron +``` + +# Configurer la sauvegarde du serveur de sauvegarde + +Initialiser le contexte Borgmatic : +``` +/srv/borg/bin/doinit-local +``` + +Lancer la première sauvegarde locale (dure moins d'une minutes) : +``` +time /srv/borg/bin/dobackup-local +``` + +Afficher les informations du dépôt : +``` +borgmatic -c /etc/borgmatic.d/$(hostname).yaml info +``` + +Afficher la liste des sauvegardes du dépôt : +``` +borgmatic -c /etc/borgmatic.d/$(hostname).yaml list +``` + +Afficher le contenu de la sauvegarde : +``` +borgmatic -c /etc/borgmatic.d/$(hostname).yaml list --archive $(borgmatic -c /etc/borgmatic.d/$(hostname).yaml list --short | tail -1) +``` + +Ajouter le déclenchement de la sauvegarde dans `/srv/borg/bin/dobackups` : +``` +/srv/borg/bin/dobackup-local +``` + +# Configurer la sauvegarde d'une machine en remote + +C'est le cas nominal. Le principe consiste à configurer le serveur de sauvegarde pour déclencher l'action de sauvegarde sur la machine à sauvegarder. + +## Côté machine à sauvegarder + +Script expérimental (s'arrêtant à l'ajout de la passphrase, reprendre à ce moment ci-dessous) : +``` +wget -O /tmp/deploy-remote https://git.a-lec.org/a-lec/commissions/infrastructure/sauvegardes/-/raw/main/Plan%20Borg/bin/deploy-remote +bash /tmp/deploy-remote +``` + +Sinon, mode manuel ci-après. + +Ajouter les backports bullseye dans `/etc/apt/source.list.d` : +``` +echo "deb http://ftp.fr.debian.org/debian/ bullseye-backports main" > /etc/apt/sources.list.d/backports.list +``` + +Installer les paquets nécessaires : +``` +apt update +apt install -t bullseye-backports borgmatic borgbackup +``` + +Par défaut, le service Systemd de Borgmatic n'a pas d'action en paramètre et cela déclenche une série d'actions : `prune`, `create…` Le prune est lancé côté serveur donc il faut forcer l'action `create`. De même, des actions de restrictions de permissions y sont activées donc il faut les désactiver. Ces changements sont à faire dans `/usr/lib/systemd/system/borgmatic.service` : + +``` +sed -i s#/usr/bin/borgmatic#/usr/bin/borgmatic\ create# /usr/lib/systemd/system/borgmatic.service +sed -i 's/CapabilityBoundingSet/#CapabilityBoundingSet/' /usr/lib/systemd/system/borgmatic.service +systemctl daemon-reload +``` + +Créer des clés `ssh` pour l'utilisateur `root` (si besoin) : +``` +ssh-keygen -t ed25519 +``` + +Créer et peupler le dossier de configruation de Borgmatic : +``` +mkdir -p /etc/borgmatic +cd /etc/borgmatic +URL=https://git.a-lec.org/a-lec/commissions/infrastructure/sauvegardes/-/raw/main/Plan%20Borg/ +wget -nv $URL/models/excludes +wget -nv $URL/models/model-conf-remote-client.yaml -O /etc/borgmatic/config.yaml +mkdir -p /etc/borgmatic/hooks/ +cd /etc/borgmatic/hooks +wget -nv $URL/bin/dumps +wget -nv $URL/bin/dump-msql +wget -nv $URL/bin/dump-psql +wget -nv $URL/bin/dump-influx +chmod u+x /etc/borgmatic/hooks/dump* +``` + +Configurer la passphrase dans `/etc/borgmatic/config.yaml` : +``` + encryption_passphrase: 'XXXXXXXXXXXXXX' +``` + +Vérifier que la configuration Borgmatic est valide : +``` +validate-borgmatic-config +``` + +Si besoin, suivant les particularité de la machine à sauvegarder, ajouter des entrées dans le fichier `/etc/borgmatic/excludes`. + + +## Côté serveur de sauvegarde + +Initialiser le contexte Borgmatic : +``` +/srv/borg/bin/doinit-remote foo.bar.org +``` + +Ajouter un accès ssh restreint dans `/srv/borg/.ssh/authorized_keys` : +``` +command="export BORG_PASSCOMMAND=/srv/borg/.borg-passphrase; borg serve --restrict-to-path /var/backups/borg/foo.bar.org.repo/ --restrict-to-repository /var/backups/borg/foo.bar.org.repo --append-only",restrict ssh-rsa AAAAZZZZZ root666@foo.bar.org +``` + +## Tester côté marchine à sauvegarder + +Valider les clés des serveurs de sauvegarde (ignorer l'erreur) : +``` +ssh -p222 sauvkipeu.libre-en-communs.org +ssh -p222 gardefou.libre-en-communs.org +``` + +Lancer une première sauvegarde (prévoir 2 min) : +``` +systemctl start borgmatic +``` + +## Tester côté serveur + +~~Lancer une sauvegarde : `time /srv/borg/bin/dobackup-remote foo.bar.org`.~~ + +Afficher les informations du dépôt : +``` +borgmatic -c /etc/borgmatic.d/foo.bar.org.yaml info +``` + +Afficher la liste des sauvegardes du dépôt : +``` +borgmatic -c /etc/borgmatic.d/foo.bar.org.yaml list +``` + +Afficher le contenu de la sauvegarde : +``` +borgmatic -c /etc/borgmatic.d/foo.bar.org.yaml list --archive 2023-XX-XXTXX:XX +``` + +~~Ajouter~~ **Ne pas ajouter** le lancement de la sauvegarde dans `/srv/borg/bin/dobackups` : +``` + /srv/borg/bin/dobackup-remote foo.bar.org +``` + +# Configurer la sauvegarde d'une machine en rsync (OpenWRT) + +Le principe de cette sauvegarde consiste en deux étapes : +- création d'un miroir de la machine à sauvegarder ; +- sauvegarde borgmatic du miroir. + +C'est notamment adapté aux cas des routeurs OpenWRT où le logiciel Borgmatic n'est pas déployable. + +## Côté machine à sauvegarder (OpenWRT) + +Prérequis : installer rsync. + +Recommandation d'exporter quotidiennement la configuration Luci en ajoutant dans `/etc/crontabs/root` : +``` +54 23 * * * /sbin/sysupgrade --create-backup /root/backup-config-${HOSTNAME}.tgz +``` + +Bizarrement, dans `/etc/dropbear/`, on trouve les clés privés de la machine mais sans les clés publiques /o\ Pour contourner le problème, on va créer une paire de clé dédiées à la sauvegarde. On va la stocker à l'endroit habituel `/root/.ssh/` où viendra également le fichier `known_hosts`. + +Créer des clés `ssh` dédiées à la sauvegarde pour l'utilisateur `root` : +``` +mkdir ~/.ssh +chmod go-rwx .ssh/ +dropbearkey -t ed25519 -f ~/.ssh/backup_ssh_key +Generating 256 bit ed25519 key, this may take a while... +Public key portion is: +ssh-ed25519 AAAA5555555555555555555555555555555555555555555555555555555555555555 root@leparc +Fingerprint: sha1!! 55:55:55:55:55:55:55:55:55:55:55:55:55:55:55:55:55:55:55:55 +``` +Copier la clé publique ci-dessus (toute la ligne « ssh-ed25519 AAAA… ») dans le fichier `~/.ssh/backup_ssh_key.pub`. + +Récupérer le script de synchronisation : +``` +mkdir -p /root/bin/ +cd /root/bin +URL=https://git.a-lec.org/a-lec/commissions/infrastructure/sauvegardes/-/raw/main/Plan%20Borg/ +wget -nv $URL/bin/push-mirror +chmod u+x /root/bin/push-mirror +``` + +Ajouter l'appel dans `/etc/crontabs/root` : +``` +55 23 * * * /root/bin/push-mirror +``` + +## Côté serveur de sauvegarde + +Initialiser le contexte Borgmatic : +``` +/srv/borg/bin/doinit-rsync foo.bar.org +``` + +Ajouter un accès ssh restreint dans `/srv/borg/.ssh/authorized_keys` : +``` +command="/usr/bin/rrsync -wo /var/backups/borg/mirrors/foo.bar.org/",restrict ssh-ed25519 AAAAXXXXXXXXXXXX root@foo.bar.org +``` + +Ajouter le lancement de la sauvegarde dans `/srv/borg/bin/dobackups` : +``` +/srv/borg/bin/dobackup-rsync foo.bar.org +``` + +## Tester côté marchine à sauvegarder + +Valider les clés des serveurs de sauvegarde (ignorer l'erreur) : +``` +ssh -p222 sauvkipeu.libre-en-communs.org +ssh -p222 gardefou.libre-en-communs.org +``` + +Lancer une première synchronisation du miroir : +``` +/root/bin/push-mirror +``` + +## Tester côté serveur + +Lancer une sauvegarde : +``` +borgmatic -c /etc/borgmatic.d/foo.bar.org create --verbosity 1 +``` + +Afficher les informations du dépôt : +``` +borgmatic -c /etc/borgmatic.d/foo.bar.org.yaml info +``` + +Afficher la liste des sauvegardes du dépôt : +``` +borgmatic -c /etc/borgmatic.d/foo.bar.org.yaml list +``` + +Afficher le contenu de la sauvegarde : +``` +borgmatic -c /etc/borgmatic.d/foo.bar.org.yaml list --archive 2023-XX-XXTXX:XX +``` + +# Opérations sur les sauvegardes + +## Rapport général + +Résultat de `doreport` : +``` +COMPUTER COUNT Original Compressed Deduplicat Last Diff Duration +audio.a-lec.org 6 37.21 GB 10.31 GB 1.72 GB 2023-01-23T00:11 11.05 MB 00:00:20 +audio.chalec.org 10 68.38 GB 19.18 GB 2.16 GB 2023-01-23T00:18 24.09 MB 00:00:24 +aunt.libre-en-communs.org 1 23.48 GB 2.35 GB 2.23 GB 2023-01-22T02:43 2.23 GB 00:03:31 +ctrlv.chalec.org 6 41.24 GB 12.39 GB 2.10 GB 2023-01-23T00:19 3.42 MB 00:00:22 +dns.libre-en-communs.org 6 24.18 GB 10.78 GB 1.83 GB 2023-01-23T00:10 22.79 MB 00:00:26 +forge.chalec.org 5 54.85 GB 27.66 GB 5.41 GB 2023-01-23T00:19 696.08 MB 00:01:46 +gestion.a-lec.org 5 72.35 GB 30.94 GB 5.78 GB 2023-01-23T00:11 23.53 MB 00:02:26 +git.a-lec.org 5 74.12 GB 38.07 GB 7.68 GB 2023-01-23T00:14 130.11 MB 00:01:18 +isengard.libre-en-communs.org 5 61.74 GB 25.47 GB 5.37 GB 2023-01-23T00:10 130.18 MB 00:00:39 +libreverse.chalec.org 6 60.97 GB 23.88 GB 5.55 GB 2023-01-23T00:21 680.08 MB 00:00:47 +mail.a-lec.org 5 54.40 GB 24.77 GB 4.41 GB 2023-01-23T00:15 67.06 MB 00:01:11 +pad.chalec.org 6 49.18 GB 18.28 GB 2.98 GB 2023-01-23T00:22 77.97 MB 00:00:44 +petition.chalec.org 6 37.76 GB 11.50 GB 1.87 GB 2023-01-23T00:23 6.50 MB 00:00:33 +sauvkipeu.libre-en-communs.org 12 15.73 GB 7.37 GB 661.52 MB 2023-01-23T00:10 6.04 MB 00:00:12 +stats.chalec.org 10 64.43 GB 18.29 GB 1.98 GB 2023-01-23T00:24 26.15 MB 00:00:22 +status.chalec.org 11 23.24 GB 9.91 GB 1.20 GB 2023-01-23T00:24 13.34 MB 00:00:18 +visio.chalec.org 6 43.08 GB 13.35 GB 2.23 GB 2023-01-23T00:24 12.38 MB 00:00:21 +www.a-lec.org 5 27.91 GB 12.35 GB 2.24 GB 2023-01-23T00:17 24.66 MB 00:00:25 +www.chalec.org 6 40.95 GB 14.57 GB 2.32 GB 2023-01-23T00:25 16.68 MB 00:00:24 +xmpp.a-lec.org 6 74.14 GB 41.13 GB 6.97 GB 2023-01-23T00:17 48.87 MB 00:00:45 +xmpp.chalec.org 6 69.83 GB 27.70 GB 5.31 GB 2023-01-23T00:25 556.20 MB 00:01:08 +Total repository count: 21 +Total archive count: 134 +Total disk size: 73G . +Sys. de fichiers Taille Utilisé Dispo Uti% Monté sur +/dev/sda1 229G 75G 142G 35% / +``` + +## Récupération + +Lister les sauvegardes de la machine `audio.a-lec.org` : +``` +$ borgmatic -c /etc/borgmatic.d/audio.a-lec.org.yaml list +/var/backups/borg/audio.a-lec.org.repo: Listing archives +2023-01-20T01:34 Fri, 2023-01-20 01:34:12 [625a6eb4255718932254fa8eda18a17f10ada05d051c1576168758ea1ec9e014] +2023-01-21T12:52 Sat, 2023-01-21 12:52:23 [b256357077848c23ca0650164f4ec51ecb97a8bb8fc38d652a8acb1e0968a951] +2023-01-22T01:03 Sun, 2023-01-22 01:03:37 [c51614c0545d106881e49942d58d2f1c1adebfe3e11fae22d897de4442dafc58] +2023-01-23T00:11 Mon, 2023-01-23 00:11:34 [8c6720c3b4da7646512d90c4f65a6063d95894bfc909e57ef20d94622bfac04f] +2023-01-24T00:11 Tue, 2023-01-24 00:11:41 [687d58fd4acfad1bf0f3aa302ed57484e149db7447bef05865888cdf8b2fcc5c] +``` + +Lister les fichiers d'une sauvegarde : +``` +mkdir -p tmp ; cd tmp +borgmatic -c /etc/borgmatic.d/audio.a-lec.org.yaml list --archive 2023-01-25T00:11 +/var/backups/borg/audio.a-lec.org.repo: Listing archives +drwxr-xr-x root root 0 Fri, 2023-01-20 01:22:45 etc +drwxr-xr-x root root 0 Mon, 2021-08-16 17:00:51 etc/console-setup +-rw-r--r-- root root 34 Thu, 2019-08-15 16:11:30 etc/console-setup/compose.ARMSCII-8.inc +-rw-r--r-- root root 31 Thu, 2019-08-15 16:11:30 etc/console-setup/compose.CP1251.inc +-rw-r--r-- root root 31 Thu, 2019-08-15 16:11:30 etc/console-setup/compose.CP1255.inc +-rw-r--r-- root root 31 Thu, 2019-08-15 16:11:30 etc/console-setup/compose.CP1256.inc +-rw-r--r-- root root 569 Fri, 2022-05-13 11:40:24 etc/fstab +[…] +``` + +Récupérer un fichier ou un dossier : +``` +mkdir -p tmp ; cd tmp +borgmatic -c /etc/borgmatic.d/audio.a-lec.org.yaml extract --archive 2023-01-25T00:11 --path /etc/fstab +ll etc/fstab +-rw-r--r-- 1 root root 569 13 mai 2022 etc/fstab +``` + +Récupérer tout une sauvegarde : +``` +mkdir -p tmp ; cd tmp +borgmatic -c /etc/borgmatic.d/audio.a-lec.org.yaml extract --archive 2023-01-25T00:11 +``` + +## Suppression + +Borgmatic ne prévoit pas de commande pour supprimer une sauvegarde. Il faut passer par Borg : +``` +borg delete /var/backups/borg/audio.a-lec.org.repo::2023-01-25T00:11 +``` + +## Protection d'une sauvegarde +La purge automatique utilise un filtre sélectionnant uniquement les sauvegardes commençant par le chiffre 2 (en référence à 2023…). Pour qu'une sauvegarde échappe à toute suppression automatique, il suffit de la nommer en commençant par autre chose. diff --git a/Plan Borg/README.md b/README.md.backup similarity index 99% rename from Plan Borg/README.md rename to README.md.backup index cc5977b..0d805a1 100644 --- a/Plan Borg/README.md +++ b/README.md.backup @@ -1,9 +1,4 @@ -| Plan Borg | -| --------- | - -[[_TOC_]] - -# Introduction +# Plan de Sauvegarde BORG Le plan Borg est une solution de sauvegarde basée sur Borgmatic. diff --git a/Plan Borg/bin/countbackups b/bin/countbackups similarity index 100% rename from Plan Borg/bin/countbackups rename to bin/countbackups diff --git a/Plan Borg/bin/deploy-remote b/bin/deploy-remote similarity index 100% rename from Plan Borg/bin/deploy-remote rename to bin/deploy-remote diff --git a/Plan Borg/bin/dobackup-local b/bin/dobackup-local similarity index 100% rename from Plan Borg/bin/dobackup-local rename to bin/dobackup-local diff --git a/Plan Borg/bin/dobackup-remote b/bin/dobackup-remote similarity index 100% rename from Plan Borg/bin/dobackup-remote rename to bin/dobackup-remote diff --git a/Plan Borg/bin/dobackup-rsync b/bin/dobackup-rsync similarity index 100% rename from Plan Borg/bin/dobackup-rsync rename to bin/dobackup-rsync diff --git a/Plan Borg/bin/dobackups b/bin/dobackups similarity index 100% rename from Plan Borg/bin/dobackups rename to bin/dobackups diff --git a/Plan Borg/bin/dochecks b/bin/dochecks similarity index 100% rename from Plan Borg/bin/dochecks rename to bin/dochecks diff --git a/Plan Borg/bin/dochecksb b/bin/dochecksb similarity index 100% rename from Plan Borg/bin/dochecksb rename to bin/dochecksb diff --git a/Plan Borg/bin/doinit b/bin/doinit similarity index 100% rename from Plan Borg/bin/doinit rename to bin/doinit diff --git a/Plan Borg/bin/doinit-local b/bin/doinit-local similarity index 100% rename from Plan Borg/bin/doinit-local rename to bin/doinit-local diff --git a/Plan Borg/bin/doinit-remote b/bin/doinit-remote similarity index 100% rename from Plan Borg/bin/doinit-remote rename to bin/doinit-remote diff --git a/Plan Borg/bin/doinit-rsync b/bin/doinit-rsync similarity index 100% rename from Plan Borg/bin/doinit-rsync rename to bin/doinit-rsync diff --git a/Plan Borg/bin/doprunes b/bin/doprunes similarity index 100% rename from Plan Borg/bin/doprunes rename to bin/doprunes diff --git a/Plan Borg/bin/doprunesb b/bin/doprunesb similarity index 100% rename from Plan Borg/bin/doprunesb rename to bin/doprunesb diff --git a/Plan Borg/bin/doreport b/bin/doreport similarity index 100% rename from Plan Borg/bin/doreport rename to bin/doreport diff --git a/Plan Borg/bin/dump-influx b/bin/dump-influx similarity index 100% rename from Plan Borg/bin/dump-influx rename to bin/dump-influx diff --git a/Plan Borg/bin/dump-msql b/bin/dump-msql similarity index 100% rename from Plan Borg/bin/dump-msql rename to bin/dump-msql diff --git a/Plan Borg/bin/dump-psql b/bin/dump-psql similarity index 100% rename from Plan Borg/bin/dump-psql rename to bin/dump-psql diff --git a/Plan Borg/bin/dumps b/bin/dumps similarity index 100% rename from Plan Borg/bin/dumps rename to bin/dumps diff --git a/Plan Borg/bin/lastbackups b/bin/lastbackups similarity index 100% rename from Plan Borg/bin/lastbackups rename to bin/lastbackups diff --git a/Plan Borg/bin/listarchives b/bin/listarchives similarity index 100% rename from Plan Borg/bin/listarchives rename to bin/listarchives diff --git a/Plan Borg/bin/push-mirror b/bin/push-mirror similarity index 100% rename from Plan Borg/bin/push-mirror rename to bin/push-mirror diff --git a/Plan Borg/models/cron b/models/cron similarity index 100% rename from Plan Borg/models/cron rename to models/cron diff --git a/Plan Borg/models/dobackups b/models/dobackups similarity index 100% rename from Plan Borg/models/dobackups rename to models/dobackups diff --git a/Plan Borg/models/excludes b/models/excludes similarity index 100% rename from Plan Borg/models/excludes rename to models/excludes diff --git a/Plan Borg/models/model-conf-local.yaml b/models/model-conf-local.yaml similarity index 100% rename from Plan Borg/models/model-conf-local.yaml rename to models/model-conf-local.yaml diff --git a/Plan Borg/models/model-conf-remote-client.yaml b/models/model-conf-remote-client.yaml similarity index 100% rename from Plan Borg/models/model-conf-remote-client.yaml rename to models/model-conf-remote-client.yaml diff --git a/Plan Borg/models/model-conf-remote.yaml b/models/model-conf-remote.yaml similarity index 100% rename from Plan Borg/models/model-conf-remote.yaml rename to models/model-conf-remote.yaml diff --git a/Plan Borg/models/model-conf-rsync.yaml b/models/model-conf-rsync.yaml similarity index 100% rename from Plan Borg/models/model-conf-rsync.yaml rename to models/model-conf-rsync.yaml diff --git a/Plan Borg/models/retention.yaml b/models/retention.yaml similarity index 100% rename from Plan Borg/models/retention.yaml rename to models/retention.yaml diff --git a/script_backups_aunt.sh b/script_backups_aunt.sh deleted file mode 100644 index 3047ec2..0000000 --- a/script_backups_aunt.sh +++ /dev/null @@ -1,9 +0,0 @@ -#! /bin/bash - -mount /var/backups/vm - -echo "BACKUP SESSION $(date)" >> /var/log/backup.log -virt-backup backup 1>> /var/log/backup.log -virt-backup clean 1>> /var/log/backup.log - -/opt/sharedfs/outils/blockcommit_all.sh diff --git a/script_backups_mother.sh b/script_backups_mother.sh deleted file mode 100644 index 8ce1e4b..0000000 --- a/script_backups_mother.sh +++ /dev/null @@ -1,22 +0,0 @@ -#! /bin/bash - -rsync -avcHS --exclude 'var/backups' --exclude 'opt' --exclude 'sys' --exclude 'proc' --exclude 'dev' --delete / /var/backups/mother 1>> /var/log/backup.log -rsync -avcHS --exclude 'var/backups' --exclude 'opt' --exclude 'sys' --exclude 'proc' --exclude 'dev' --delete aunt.onlink:/ /var/backups/aunt 1>> /var/log/backup.log - -echo "BACKUP SESSION $(date)" >> /var/log/backup.log -virt-backup backup 1>> /var/log/backup.log -virt-backup clean 1>> /var/log/backup.log - -/opt/sharedfs/outils/blockcommit_all.sh - -#find /var/backups -type f -exec sudo fallocate -v -d {} \; - -# Wait for aunt to finish -processes=$(ssh aunt 'ps aux' | grep virt-backup) - -while [ ! -z "$processes" ]; -do - sleep 60 -done - -find /var/backups -type f -exec sudo fallocate -v -d {} \; diff --git a/virt-backup_aunt.yml b/virt-backup_aunt.yml deleted file mode 100644 index 9ce8026..0000000 --- a/virt-backup_aunt.yml +++ /dev/null @@ -1,128 +0,0 @@ ---- - -######################## -#### Global options #### -######################## - -## Be more verbose ## -debug: False - -## How many threads (simultaneos backups) to run. Use 0 to use all CPU threads -## detected, 1 to disable multitheading for backups, or the number of threads -## wanted. Default: 1 -threads: 0 - - -############################ -#### Libvirt connection #### -############################ - -## Libvirt URI ## -uri: "qemu+ssh://127.0.0.1:223/system" - -## Libvirt authentication, if needed ## -username: -passphrase: - - -####################### -#### Backup groups #### -####################### - -## Groups are here to share the same backup options between multiple domains. -## That way, it is possible, for example, to have a different policy retention -## for a pool of guests in testing than for the one in production. - -## Define default options for all groups. ## -default: - hourly: 0 - daily: 2 - weekly: 2 - monthly: 1 - yearly: 0 - -## Groups definition ## -groups: - ## Group name ## - aunt: - ## Backup directory ## - target: /var/backups/vm/aunt - - ## Packager to use for each backup: - ## directory: images will be copied as they are, in a directory per domain - ## tar: images will be packaged in a tar file - ## zstd: images will be compressed with zstd. Requires python "zstandard" package to be installed. - packager: directory - - ## Options for the choosen packager: - #tar: - ## # Compression algorithm to use. Default to None. - # compression: "xz" - #None | "xz" | "gz" | "bz2" - ## # Compression level to use for each backup. - ## # Generally this should be an integer between 1~9 (depends on the - ## # compression algorithm), where 1 will be the fastest while having - ## # the lowest compression ratio, and 9 gives the best compression ratio - ## # but takes the longest time to compress. - # compression_lvl: 5 - ## - ## zstd: - ## # Compression level to use for each backup. - ## # 1 will be the fastest while having the lowest compression ratio, - ## # and 22 gives the best compression ratio but takes the longest time - ## # to compress. - ## compression_lvl: [1-22] - #packager_opts: - # compression: xz - # compression_lvl: 6 - - ## When doing `virt-backup backup` without specifying any group, only - ## groups with the autostart option enabled will be backup. - autostart: True - - ## Retention policy: the first backup of the day is considered as the - ## "daily" backup, first of the week "weekly", etc. The following options - ## detail how many backups of each type has to be kept. Set to "*" or None for an - ## infinite retention. - ## Default to 5 for everything, meaning that calling "virt-backup clean" will let 5 - ## backups for each period not specified in the config. - hourly: 0 - daily: 2 - weekly: 2 - monthly: 1 - yearly: 0 - - ## Enable the Libvirt Quiesce option when taking the external snapshots. - ## - ## From Libvirt documentation: libvirt will try to freeze and unfreeze the guest - ## virtual machine’s mounted file system(s), using the guest agent. However, if the - ## guest virtual machine does not have a guest agent, snapshot creation will fail. - ## - ## However, virt-backup has a fallback mechanism if the snapshot happens to fail - ## with Quiesce enabled, and retries without it. - quiesce: False - - ## Hosts definition ## - hosts: - ## This policy will match the domain "domainname" in libvirt, and will - ## backup the disks "vba" and "vdb" only. - #- host: domainname - # disks: - # - vda - # - vdb - ## Quiesce option can also be overriden per host definition. - # quiesce: False - ## Will backup all disks of "domainname2" ## - #- domainname2 - ## Regex that will match for all domains starting with "prod". The regex - ## syntax is the same as the python one - - host: "r:.*" - # disks: - # - vda - - ## Exclude the domain domainname3 (useful with regex, for example) - #- "!domainname3" - ## Exclude all domains starting with "test" - - "!r:^generic.*" - -# vim: set ts=2 sw=2: diff --git a/virt-backup_mother.yml b/virt-backup_mother.yml deleted file mode 100644 index 3063c04..0000000 --- a/virt-backup_mother.yml +++ /dev/null @@ -1,128 +0,0 @@ ---- - -######################## -#### Global options #### -######################## - -## Be more verbose ## -debug: False - -## How many threads (simultaneos backups) to run. Use 0 to use all CPU threads -## detected, 1 to disable multitheading for backups, or the number of threads -## wanted. Default: 1 -threads: 0 - - -############################ -#### Libvirt connection #### -############################ - -## Libvirt URI ## -uri: "qemu+ssh://127.0.0.1:222/system" - -## Libvirt authentication, if needed ## -username: -passphrase: - - -####################### -#### Backup groups #### -####################### - -## Groups are here to share the same backup options between multiple domains. -## That way, it is possible, for example, to have a different policy retention -## for a pool of guests in testing than for the one in production. - -## Define default options for all groups. ## -default: - hourly: 0 - daily: 2 - weekly: 2 - monthly: 1 - yearly: 0 - -## Groups definition ## -groups: - ## Group name ## - mother: - ## Backup directory ## - target: /var/backups/vm/mother - - ## Packager to use for each backup: - ## directory: images will be copied as they are, in a directory per domain - ## tar: images will be packaged in a tar file - ## zstd: images will be compressed with zstd. Requires python "zstandard" package to be installed. - packager: directory - - ## Options for the choosen packager: - #tar: - ## # Compression algorithm to use. Default to None. - # compression: "xz" - #None | "xz" | "gz" | "bz2" - ## # Compression level to use for each backup. - ## # Generally this should be an integer between 1~9 (depends on the - ## # compression algorithm), where 1 will be the fastest while having - ## # the lowest compression ratio, and 9 gives the best compression ratio - ## # but takes the longest time to compress. - # compression_lvl: 5 - ## - ## zstd: - ## # Compression level to use for each backup. - ## # 1 will be the fastest while having the lowest compression ratio, - ## # and 22 gives the best compression ratio but takes the longest time - ## # to compress. - ## compression_lvl: [1-22] - #packager_opts: - # compression: xz - # compression_lvl: 6 - - ## When doing `virt-backup backup` without specifying any group, only - ## groups with the autostart option enabled will be backup. - autostart: True - - ## Retention policy: the first backup of the day is considered as the - ## "daily" backup, first of the week "weekly", etc. The following options - ## detail how many backups of each type has to be kept. Set to "*" or None for an - ## infinite retention. - ## Default to 5 for everything, meaning that calling "virt-backup clean" will let 5 - ## backups for each period not specified in the config. - hourly: 0 - daily: 2 - weekly: 2 - monthly: 1 - yearly: 0 - - ## Enable the Libvirt Quiesce option when taking the external snapshots. - ## - ## From Libvirt documentation: libvirt will try to freeze and unfreeze the guest - ## virtual machine’s mounted file system(s), using the guest agent. However, if the - ## guest virtual machine does not have a guest agent, snapshot creation will fail. - ## - ## However, virt-backup has a fallback mechanism if the snapshot happens to fail - ## with Quiesce enabled, and retries without it. - quiesce: False - - ## Hosts definition ## - hosts: - ## This policy will match the domain "domainname" in libvirt, and will - ## backup the disks "vba" and "vdb" only. - #- host: domainname - # disks: - # - vda - # - vdb - ## Quiesce option can also be overriden per host definition. - # quiesce: False - ## Will backup all disks of "domainname2" ## - #- domainname2 - ## Regex that will match for all domains starting with "prod". The regex - ## syntax is the same as the python one - - host: "r:.*" - # disks: - # - vda - - ## Exclude the domain domainname3 (useful with regex, for example) - #- "!domainname3" - ## Exclude all domains starting with "test" - - "!r:^generic.*" - -# vim: set ts=2 sw=2: