Wrapper to simplify backups with borgbackup
Put the script somewhere practical
cp borgwrapper /usr/local/bin/borgwrapper
chown root. /usr/local/bin/borgwrapper
chmod 750 /usr/local/bin/borgwrapper
By default borgwrapper expects the configuration to be located at /etc/borgwrapper/config.
An example configuration file is included in config.example.
Ensure restrictive permissions on this file as it exposes the passphrase.
chown root. config
chmod 600 config
Copy the example systemd unit files to /etc/systemd/system/. Then for each
configuration file in /etc/borgwrapper/<config_name> do:
systemctl enable borgwrapper-backup@<config_name>.timer
systemctl enable borgwrapper-verify@<config_name>.timer
systemctl start borgwrapper-backup@<config_name>.timer
systemctl start borgwrapper-verify@<config_name>.timer
The included systemd files are set up using a daily schedule. If you want to
take backups more often than that you can either change the Timer parameters
directly in the systemd timer files, or if you only want to override them for
some of the backups you can add per-config overrides by using
systemctl edit borgwrapper-backup@<config>.timer
and add the wanted overrides. Here is an example where you run a backup 4 times
a day (every 6 hours). See the manual for systemd.timer for more information on
the OnCalendar format.
[Timer]
OnCalendar=00/6:00
RandomizedDelaySec=0
The output will land in
/etc/systemd/system/borgwrapper-backup@<config>.timer.d/override.conf
You can just drop files in the directory directly too, without editing via systemctl. This is better suited for configuration management systems.
You can view the backup logs with:
journalctl -xu borgwrapper-backup@<config_name>
journalctl -xu borgwrapper-verify@<config_name>
If you want to run the tasks manually outside the timers you can just start them like usual services:
systemctl start borgwrapper-backup@<config_name>
systemctl start borgwrapper-verify@<config_name>
# Run the backup daily
23 1 * * * /usr/local/bin/borgwrapper backup
# Verify the backups once a month
40 17 23 * * /usr/local/bin/borgwrapper verify
Install borg and then
adduser --system --group --shell /bin/bash borg
mkdir /srv/borg
chown borg. /srv/borg
chmod 755 /srv/borg
Generate the needed passwordless ssh-keys as root (the user you run the backup as) on the client
ssh-keygen
Copy the content of the generated public key from /root/.ssh/<key>.pub to /home/borg/.ssh/authorized_keys on the server, with
some restrictions so it looks something like this:
command="borg serve --restrict-to-path /srv/borg/<hostname>",no-pty,no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-user-rc ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDeCInOLjv0hgzI0u1b/p4yYnCEV5n89HIXF1hrLor+ZQ7lSUii21tpn47Aw8RJJAjfDCwCdQ27MXjpzNelBf4KrlAiN1K3FcnGGIiE3XFNoj4LW7oAjzjFgOKC/ea/hXaCI6E8M/Pn5+MhdNN1ZsWNm/9Zp0+jza+l74DQgOE33XhSBjckUchqtBci7BqoCejy2lVvboFA231mSEpPValcKmG2qaNphAkCgAPjtDOx3V6DGQ8e7jfA2McQYxfju6HlpWPUx/li6VJhRa5huczfJ3J/sdfu123s/lgTW4rG5QNng1vt1FOIZ/TkaEsPt2wzD2Qxdwo70qVts3hrd+r root@client
borgwrapper init
borgwrapper backup
borgwrapper verify
Use exec <borg arguments>. BORG_REPO is exported to the environment so use :: when the repo
argument is required.
Examples:
borgwrapper exec mount :: /mnt
borgwrapper exec list
Run in subshell if you do not want the passphrase stored in the current shell after the command have exited.
Examples:
(. /etc/borgwrapper/config; export BORG_PASSPHRASE; borg mount "$BORG_REPO" /mnt)
(. /etc/borgwrapper/config; export BORG_PASSPHRASE; borg list "$BORG_REPO")