diff --git a/design/BackupStrategy.md b/design/BackupStrategy.md index 80a1f6f..f6828fb 100644 --- a/design/BackupStrategy.md +++ b/design/BackupStrategy.md @@ -1,17 +1,18 @@ -Backup Strategy +# Requirements -# Backup Strategy -## Requirements - All data that are difficult or impossible to reconstruct must be backed up and able to be restored from backup if lost. - Backups must be automated and must occur without manual interaction with any user. - Backups must be monitored and tested on a regular basis, to ensure that - 1. Backups actually occur when they are scheduled - 2. Backed-up data can be restored and that the restored data is correct. + 1. Backups actually occur when they are scheduled + 2. Backed-up data can be restored and the restored data are correct. - Backups are encrypted for privacy and security. - All data exist in at least three places: on the device (client or server) where it is used; on a backup device on our home network; and on an off-site device. + ## Strategy + - On-site backup for client devices will be provided by the Teal server. The backup tool is Restic, accessible from client devices via SFTP. - On-site backup for the Teal server itself will be provided by the Cygnus server (Synology). Backup is by Restic over SFTP. +- Note that the choice of the SFTP transport requires that the user account under which Restic is executed on each backup source machine must have passwordless SSH / SFTP access to the backup target machine (where the Restic repository resides). This means that you must log on to the source machine as the user which will be running Restic, execute ssh-keygen to generate a key (with no passphrase), and execute ssh-copy-id sftpuser@target-host to install the key on the target machine. - Off-site backup is not currently implemented. Two different strategies are being considered: - 1. Build a custom ZFS-based NAS and deploy it at 28 Carlisle Rd. This server and the Teal server would provide off-site backup for each other via ZFS send / receive. - 2. Contract with a cloud storage provider for off-backup, probably either Backblaze using Restic over B2 or rsync.net using ZFS send / receive. + 1. Build a custom ZFS-based NAS and deploy it at 28 Carlisle Rd. This server and the Teal server would provide off-site backup for each other via ZFS send / receive. + 2. Contract with a cloud storage provider for off-backup, probably either Backblaze using Restic over B2 or rsync.net using ZFS send / receive. diff --git a/design/ClientBackup.md b/design/ClientBackup.md new file mode 100644 index 0000000..fb42e42 --- /dev/null +++ b/design/ClientBackup.md @@ -0,0 +1,26 @@ +# Client Device Backup Implementation + +## Target Repository + +Client devices are backed up to the client-backup Restic repository on Teal. The transport protocol is SFTP. + +## Windows Clients + +Windows clients are backed up using the restic-windows-backup PowerShell scripts. The source code and documentation for these scripts is in a repository on our Gitea server at https://gitea.objectbrokers.com/cjones/restic-windows-backup.git (cloned from Kevin Woley's Github repository at https://github.com/kmwoley/restic-windows-backup.git). +The restic-windows-backup scripts are installed at C:\restic on each Windows client system. The script code is tailored to the requirements of the client system to specify directories to be backed up, needed passwords, etc. The process for configuring backup on a Windows system, in brief, is: + +1. Install the scripts at C:\restic +2. Configure the location and password of the target Restic repository and the email information to be used for notifications in the file secrets.ps1. Use the supplied secrets_sample.ps1 as a guide. +3. Configure the directories to be backed up and snapshot retention and pruning policies in the file config.ps1. Use the supplied config_sample.ps1 as a guide. + +Consult the README.md in the root of the restic-windows-backup repository for full documentation of the install and configuration process. + +Scheduled backups are handled by creating a task in Windows Task Scheduler. In order to use the Windows VSS facility to back up files that are in use or whose permissions would not allow reading for backup, the Scheduler task must run as the SYSTEM user. That, in turn, means that SSH keys must be generated (and copied to the target server) for the SYSTEM user. Use PsExec.exe from the PsTools suite to open a command window logged on as SYSTEM in order to generate and install these SSH keys. See the discussion of "Backup Over SFTP" in the README file in the Git repository at https://gitea.objectbrokers.com/cjones/restic-automatic-backup-scheduler/src/branch/main/README.md. + +## Linux Clients + +Linux clients are backed up using the restic-automatic-backup-scheduler scripts. The source code and documentation for these scripts is in a repository on our Gitea server at https://gitea.objectbrokers.com/cjones/restic-automatic-backup-scheduler.git (cloned from Erik Westrup's Github repository at https://github.com/erikw/restic-automatic-backup-scheduler.git). +The restic-automatic-backup-scheduler scripts are installed as a systemd service on each Linux client system (driven by a systemd timer). Configuration is done by customizing two scripts at /etc/restic: _global.env.sh and default.env.sh. At present, _global.env.sh is used unchanged (as supplied from the Git repo). default.env.sh is customized to specify the Restic repository and the directories to be backed up: + +* export RESTIC_REPOSITORY="sftp:sftpuser@teal.objectbrokers.com:/srv/restic/client-backup" +* export RESTIC_BACKUP_PATHS="/etc:/root:/home"