Project

General

Profile

Backup Setup when we don't have root » History » Version 5

Jon Goldberg, 09/07/2021 04:57 PM

1 1 Jon Goldberg
# Backup Setup when we don't have root
2
3
We normally rely on a modified version `backupninja` for backup, which requires root access.  When we don't have root access but we do have `borgbackup`, we have a modified procedure for backing up to rsync.net using borgbackup.
4
5
In the example below, `1234` should be your rsync.net user number, `yourrsyncserver.rsync.net` should be your rsync.net server (e.g. `usw-s008.rsync.net`). `clientname` and `servershortname` can be anything you want as long as they're consistent between `borg init` and the shell script. `server.longname.org` should be the name of the server as Icinga knows it. `/path/to/back/up` should be the path you want to back up.  You can have more than one, separated by spaces.
6
7 5 Jon Goldberg
Run the following on a local computer that has its public key on the rsync.net server.
8
```shell 
9
#!/bin/bash # Get the public key for the SSH user who will be running the backup on the client's server. 
10
# This Add it to the rsync.net account: 
11
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC1SlLpapSVuMm5O35LN/FWNa8DmRgxYRiaIhcrlFetmso3/+6s2ZGaMHtheTmfZuCm9VNHHp3YHXYqsDPPLuxFg4iKw7ccDc6nRRV32rl5doQE6708fZc6dMp4hFIGNLA1RBFvK/7bGBdQw+ryG/rKFuW7o1X2DrhWRYPVwavjqci2NiHEB5SwjLzetXKF6VLnoZxERZJcBG0d8uQ/EgbcMLN4xXbDDsNsofM4wok0aMULucogSvayHezu5HDt6Dta8iDaWbqQtJwtpcgWrqy+HTPZTxJ5PtZuOfG4KrVR0R+TQSdYe6CFFevGPp3TujO03h885zyXPiLqjEmrVLt " | ssh 1234@yourrsyncserver.rsync.net 'dd of=.ssh/authorized_keys oflag=append conv=notrunc' 
12
# Create a borg repo. 
13
borg init 1234@yourrsyncserver.rsync.net:clientname-servershortname -e repokey --remote-path=/usr/local/bin/borg1/borg1 
14
``` 
15 1 Jon Goldberg
16
```shell
17
#!/bin/bash
18 4 Jon Goldberg
# This script requires jq.  Bail if not found.  You can download a static binary from the jq homepage.
19
if ! command -v ./jq &> /dev/null
20
then
21
    echo "jq could not be found. Please install and try again"
22
    exit
23
fi
24
25 1 Jon Goldberg
# borg backupninja backup script
26
REPOSITORY="1234@yourrsyncserver.rsync.net:clientname-servershortname"
27
export BORG_PASSPHRASE='StrongPassphrase'
28
# On rsync.net: Specify /usr/local/bin/borg/borg for borg 0.29; /usr/local/bin/borg1 for 1.x
29
REMOTE_PATH=/usr/local/bin/borg1/borg1
30
31
ICINGA2_API_USER=backupninja
32
ICINGA2_SERVER_ADDRESS=icinga.megaphonetech.com
33
ICINGA2_API_PORT=5665
34
ICINGA2_API_PASSWORD=<Icinga2 API password>
35
ICINGA2_HOSTNAME=server.longname.org
36
# Set level to 0, "OK", and we'll change it if anything goes wrong.
37
LEVEL=0
38
# Run the backup.
39
OUTPUT=$( (
40 4 Jon Goldberg
/usr/bin/borg create --warning --filter=AME --stats --compression lz4         \
41 1 Jon Goldberg
--remote-path $REMOTE_PATH \
42
$REPOSITORY::'{hostname}-{now:%Y-%m-%d}' \
43
/path/to/back/up \
44 3 Jon Goldberg
--exclude '*/templates_c' \
45
--exclude '*/Maildir' \
46
--exclude '.config/borg' \
47 1 Jon Goldberg
--exclude '*/civicrm/upload/cache'
48
) 2>&1)
49
if [ $? -ne 0 ]
50
then
51
  LEVEL=2
52
fi
53
# Remove old backups.
54 3 Jon Goldberg
OUTPUT=${OUTPUT}\\n$( (
55 1 Jon Goldberg
/usr/bin/borg prune -v $REPOSITORY --prefix '{hostname}-' --keep-daily=15 --keep-weekly=9 --keep-monthly=6 --remote-path $REMOTE_PATH
56
) 2>&1)
57
if [ $? -ne 0 ]
58
  then
59
  LEVEL=2
60
fi
61
62
# Check the integrity of the backup.
63
OUTPUT=${OUTPUT}\\n$( (
64
/usr/bin/borg check $REPOSITORY --remote-path $REMOTE_PATH
65
) 2>&1)
66
if [ $? -ne 0 ]
67
  then
68 3 Jon Goldberg
  LEVEL=2
69 1 Jon Goldberg
fi
70
unset BORG_PASSPHRASE
71 4 Jon Goldberg
# Escape JSON characters
72
echo $OUTPUT
73
OUTPUT=$( echo $OUTPUT | ./jq --raw-input --slurp --ascii-output . )
74
echo "after jq"
75
echo $OUTPUT
76 1 Jon Goldberg
# Send to Icinga
77 4 Jon Goldberg
DATA="{ \"exit_status\": $LEVEL, \"plugin_output\": ${OUTPUT} }"
78 1 Jon Goldberg
/usr/bin/curl -k -s -u $ICINGA2_API_USER:$ICINGA2_API_PASSWORD -H 'Accept: application/json' -X POST "https://$ICINGA2_SERVER_ADDRESS:$ICINGA2_API_PORT/v1/actions/process-check-result?service=${ICINGA2_HOSTNAME}!backupninja" --data "${DATA}" > /dev/null
79
# Reschedule the next dummy backupninja check
80
RESCHEDULE_TIME=$(/bin/date -d "tomorrow 6am" "+%s")
81 3 Jon Goldberg
RESCHEDULE_JSON="{ \"next_check\": \"${RESCHEDULE_TIME}\" }"
82
/usr/bin/curl -k -s -u $ICINGA2_API_USER:$ICINGA2_API_PASSWORD -H 'Accept: application/json' -X POST "https://$ICINGA2_SERVER_ADDRESS:$ICINGA2_API_PORT/v1/actions/reschedule-check?service=${ICINGA2_HOSTNAME}!backupninja" --data "${RESCHEDULE_JSON}" > /dev/null
83 1 Jon Goldberg
```
84
85 4 Jon Goldberg
`chmod +x` this file, then add it to the user's `crontab` looking something like this:
86
```
87
0 2 * * * cd /home/members/example/sites/crm.example.org/users/example/bin && /home/members/example/sites/crm.example.org/users/example/bin/borgbackup.sh 
88
```
89
90 1 Jon Goldberg
Add `vars.has_backupninja = true` to the server's Icinga config and restart Icinga.