Browse Source

add simple borg backup role

Thomas Buck 3 years ago
parent
commit
6aefcdf892

+ 28
- 0
roles/backup/defaults/main.yml View File

@@ -0,0 +1,28 @@
1
+secret_root: '{{ inventory_dir | realpath }}'
2
+secret_name: 'secret'
3
+secret: '{{ secret_root + "/" + secret_name }}'
4
+
5
+backup_vpn_net: "10.8.0.0/24"
6
+backup_vpn_bridge: "10.8.0.2"
7
+backup_host: "192.168.0.10"
8
+backup_share: "/mnt/data/backups"
9
+backup_borg_passphrase: "{{ lookup('password', secret + '/' + 'backup_borg_passphrase length=20') }}"
10
+backup_daily: "7"
11
+backup_weekly: "4"
12
+backup_monthly: "6"
13
+backup_source: "/"
14
+backup_repo_dir: "/mnt/nas_backups"
15
+backup_repo_name: "borg-linux-{{ server_name }}"
16
+backup_destination: "{{ backup_repo_dir }}/{{ backup_repo_name }}"
17
+backup_excludes:
18
+  - "/home/*/.cache/*"
19
+  - "/var/cache/*"
20
+  - "/var/tmp/*"
21
+  - "/media/*"
22
+  - "/mnt/*"
23
+  - "/dev/*"
24
+  - "/proc/*"
25
+  - "/sys/*"
26
+  - "/tmp/*"
27
+  - "/run/*"
28
+  - "/lost+found/*"

+ 88
- 0
roles/backup/tasks/backup.yml View File

@@ -0,0 +1,88 @@
1
+
2
+- name: Install Borg-Backup, NFS Tools and their dependencies
3
+  apt:
4
+    name: "{{ packages }}"
5
+    state: present
6
+  vars:
7
+    packages:
8
+    - borgbackup
9
+    - nfs-common
10
+    - python-pexpect
11
+  tags:
12
+    - dependencies
13
+
14
+- name: Remove static route over VPN on shutdown
15
+  lineinfile:
16
+    path: /etc/network/interfaces.d/50-cloud-init.cfg
17
+    insertafter: "iface eth0 inet dhcp"
18
+    line: "pre-down ip route del {{ backup_vpn_net }} via {{ backup_vpn_bridge }} || true"
19
+
20
+- name: Add static route over VPN on boot
21
+  lineinfile:
22
+    path: /etc/network/interfaces.d/50-cloud-init.cfg
23
+    insertafter: "iface eth0 inet dhcp"
24
+    line: "post-up ip route add {{ backup_vpn_net }} via {{ backup_vpn_bridge }} || true"
25
+
26
+- name: Apply static route for current session
27
+  command: "ip route add {{ backup_vpn_net }} via {{ backup_vpn_bridge }}"
28
+  ignore_errors: yes
29
+
30
+- name: Creates directory for NFS mount
31
+  file:
32
+    path: "{{ backup_repo_dir }}"
33
+    state: directory
34
+    owner: root
35
+    group: root
36
+  ignore_errors: yes
37
+
38
+- name: Add NFS mount to /etc/fstab
39
+  lineinfile:
40
+    path: /etc/fstab
41
+    line: "{{ backup_host }}:{{ backup_share }} {{ backup_repo_dir }} nfs rw,async,hard,intr,noexec 0 0"
42
+
43
+- name: Mount NFS share
44
+  mount:
45
+    path: "{{ backup_repo_dir }}"
46
+    src: "{{ backup_host }}:{{ backup_share }}"
47
+    fstype: "nfs"
48
+    state: mounted
49
+
50
+- name: Create Borg Repo
51
+  expect:
52
+    chdir: "{{ backup_repo_dir }}"
53
+    creates: "{{ backup_destination }}"
54
+    command: "borg init --encryption=repokey {{ backup_repo_name }}"
55
+    responses:
56
+      "Enter new passphrase": "{{ backup_borg_passphrase }}"
57
+      "Enter same passphrase again": "{{ backup_borg_passphrase }}"
58
+      "Do you want your passphrase to be displayed for verification": "y"
59
+
60
+- name: Dump Borg Repo Key
61
+  command: borg key export {{ backup_destination }} /home/deploy/borg_repo_key
62
+
63
+- name: Dump Borg Repo Key
64
+  fetch:
65
+    src: /home/deploy/borg_repo_key
66
+    dest: "{{ secret }}/borg_repo_key"
67
+    fail_on_missing: yes
68
+
69
+- name: Remove Borg Repo Key dump
70
+  command: rm -rf /home/deploy/borg_repo_key
71
+
72
+- name: Unmount NFS share
73
+  command: "umount -l {{ backup_repo_dir }}"
74
+
75
+- name: Copy backup script
76
+  template:
77
+    src: home_deploy_backup-root_sh.j2
78
+    dest: /home/deploy/backup-root.sh
79
+    owner: root
80
+    group: root
81
+    mode: 0500
82
+
83
+- name: Configure daily backup cronjob
84
+  cron:
85
+    hour: "1"
86
+    minute: "0"
87
+    job: /home/deploy/backup-root.sh
88
+    name: "nas-backup"

+ 1
- 0
roles/backup/tasks/main.yml View File

@@ -0,0 +1 @@
1
+- include: backup.yml tags=backup

+ 67
- 0
roles/backup/templates/home_deploy_backup-root_sh.j2 View File

@@ -0,0 +1,67 @@
1
+#!/bin/sh
2
+
3
+mount {{ backup_repo_dir }}
4
+
5
+# Setting this, so the repo does not need to be given on the commandline:
6
+export BORG_REPO={{ backup_destination }}
7
+
8
+# Setting this, so you won't be asked for your repository passphrase:
9
+export BORG_PASSPHRASE='{{ backup_borg_passphrase }}'
10
+
11
+# some helpers and error handling:
12
+info() { printf "\n%s %s\n\n" "$( date )" "$*" >&2; }
13
+trap 'echo $( date ) Backup interrupted >&2; exit 2' INT TERM
14
+
15
+info "Starting backup"
16
+
17
+# Backup the most important directories into an archive named after
18
+# the machine this script is currently running on:
19
+
20
+borg create \
21
+    --verbose \
22
+    --filter AME \
23
+    --stats \
24
+    --show-rc \
25
+    --compression lz4 \
26
+    --exclude-caches \
27
+{% for path in backup_excludes %}
28
+    --exclude '{{ path }}' \
29
+{% endfor %}
30
+    ::'{hostname}-{now}' \
31
+    {{ backup_source }} \
32
+
33
+backup_exit=$?
34
+
35
+info "Pruning repository"
36
+
37
+# Use the `prune` subcommand to maintain 7 daily, 4 weekly and 6 monthly
38
+# archives of THIS machine. The '{hostname}-' prefix is very important to
39
+# limit prune's operation to this machine's archives and not apply to
40
+# other machines' archives also:
41
+
42
+borg prune \
43
+    --list \
44
+    --prefix '{hostname}-' \
45
+    --show-rc \
46
+    --keep-daily {{ backup_daily }} \
47
+    --keep-weekly {{ backup_weekly }} \
48
+    --keep-monthly {{ backup_monthly }} \
49
+
50
+prune_exit=$?
51
+
52
+# use highest exit code as global exit code
53
+global_exit=$(( backup_exit > prune_exit ? backup_exit : prune_exit ))
54
+
55
+if [ ${global_exit} -eq 1 ];
56
+then
57
+    info "Backup and/or Prune finished with a warning"
58
+fi
59
+
60
+if [ ${global_exit} -gt 1 ];
61
+then
62
+    info "Backup and/or Prune finished with an error"
63
+fi
64
+
65
+umount -l {{ backup_repo_dir }}
66
+
67
+exit ${global_exit}

Loading…
Cancel
Save