Repository files navigation

Simple wrapper forborg backup andsnapper

• Config file example.

You can store the backup over SSH on a remote server.

This even works for multiple clients to one server as borg can jail clients by ssh forced commands.

Backup targets:

• Remote server via SSH (you have a borg remote url)
• Local storage (secondary harddrive, anfs/samba mount, ...)

If you do your backup remotely via SSH, you need a SSH key first.

• Generate ssh-key for userroot
  • Of course you may reuse an existing ssh key, but root has to be configured to use it.

HOME=/root sudo ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519_backup

• Provide your ssh public key in/root/.ssh/id_ed25519_backup.pub to the server operator
• Configure SSH to use the rightuser andssh key in/root/.ssh/config:

# example config if your borg backup remote url is "borg@borgbackup.somewhere.net:reponame"Host borgbackup.somewhere.net    User borg    IdentityFile ~/.ssh/id_ed25519_backup

• Configuresftbackup in/etc/sftbackup.cfg
• Setpassword = ... to encrypt the backup
  • To generate a password, you can usepwgen 30 1
  • Note down the password somewhere (to be able to restore the backup!)
• Userepo = ... to specify where to store the backup
  • Remote backup via SSH:repo = borg@borgbackup.somewhere.net:reponame
  • Local storage, e.g. external HDD:repo = /mnt/backupdrive
• Adjust other things like paths, excludepaths, ...

• Create the repo:sudo sftbackup init
• This will initialize the borg repo inrepokey mode.

• Test the creation of the first backup by runningsudo sftbackup backup

This is only suitable for devices that are permanently running (e.g. servers)

• Install thesftbackup.timer andsftbackup.service systemd units
• Enable and start thesftbackup.timer

Enjoy your backups!

Repo storage:

• Create aborg user on your host:sudo useradd -m borg
• Create the storage directory:sudo mkdir /home/borg/repos.
• Create theauthorized_keys file in/home/borg/.ssh/authorized_keys
  • Ensure the.ssh andauthorized_keys file belong to userborg

Client access:

• Create a directory/home/borg/repos/clientname (owned by userborg)
• Grant access inauthorized_keys:

command="cd /home/borg/repos/clientname; borg serve --restrict-to-repository /home/borg/repos/clientname/reponame --storage-quota 1.5T",restrict ssh-ed25519 client's_ssh_public_key_... root@clientname

• Add--append-only to disallow this client to remove data in its repos (very handy so a server can't delete its own backup when hacked).
• Seeman borg-serve for further information on how to restrict client access

• Retrieve and store file(s) from repo
  • useborg extract
• Mount repo asFUSE
  • useborg mount

As you might have guessed, you can report issues and submit patches through pull requests easily.

GNU GPLv3 or later; seecopying.md andlegal/GPLv3.