hyteck-blog/content/post/raspi-backup.md

148 lines
4.0 KiB
Markdown
Raw Permalink Normal View History

2022-10-27 08:39:09 +00:00
---
title: "Raspberry Pi as Offsite Backup"
date: 2022-10-23T10:12:54+02:00
draft: false
image: "uploads/logos/raspi_backup.png"
categrories: ["homelab"]
tags: ["english"]
---
# Use Case
You have one (or more) servers at a hosting provider and a raspberry pi at home. You want to have an offsite backup of the websites, apps and databases at home.
# Prerequesits
You configure your raspberry pi to be reachable from *the internet* using DynDNS. In the following we assume that it is reachable at offsite.example.com.
# Preparing your backup raspberry pi
We want to make sure that backups on the raspberry pi can come from multiple sources and one source can not delete another.
## Create an additional user
and change to that user afterwards. You can change service1 to the name of the service that this user should backup.
```
sudo useradd service1_backup
sudo su service1_backup
cd ~
```
## Create an SSH key for the user
This SSH key will later be used by your server to push backups automatically. Therefore you should not set a passphrase for the key (just press enter until the key is generated)
```
$ ssh-keygen -t ed25519
```
## Create your backup directory
```
mkdir backup && cd backup
```
If you want to use an external drive you can mount it to this users home directory.
## Initialzie the borg repository
```
borg init --encryption=repokey ./
```
Make sure to set a strong passphrase and note it down somewhere safe. Without it you will not be able to access you backup!
## Make sure the user can only access the backup directory
Put the following in `~/.ssh/authorized_keys` and make sure everything is in one line. The last values are simply your public key that can be found in `~/.ssh/id_ed25519.pub`
```
command="borg serve --restrict-to-repository /home/<user>/backup",restrict <key type> <key> <key host>
```
**Done with the raspberry pi**
# Configure your server
In this guide we will use [borgmatic](https://torsion.org/borgmatic/) to configure and automatically run the backup in the server.
## Install borgmatic
```
sudo pip3 install --user --upgrade borgmatic
```
## Configure borgmatic
The following is a small configuration example. Place it in `/etc/borgmatic.d/servic1.yaml`. If you need more options check out the [full configuration file reference](https://torsion.org/borgmatic/docs/reference/configuration/)
```
location:
source_directories:
- /home/service1/static
repositories:
- ssh://service1_backup@offsite1.example.com/./backup
storage:
encryption_passphrase: "ThePassphraseouUsedOnYourRaspi"
ssh_command: ssh -i /etc/borgmatic.d/service1_backup_key
retention:
# Number of daily archives to keep.
keep_daily: 7
hooks:
# List of one or more shell commands or scripts to execute
# before creating a backup, run once per configuration file.
before_backup:
- echo "Starting a backup."
# List of one or more shell commands or scripts to execute
# after creating a backup, run once per configuration file.
after_backup:
- echo "Finished a backup."
after_everything:
- echo "Completed actions."
postgresql_databases:
- name: service1
# mysql_databases:
# - name: users
```
## Place the private SSH key
The server will need the private SSH key so connect to your raspberry pi
On the raspberry pi use
```
cat ~/.ssh/id_ed25519
```
to get the private key and place it on your server in the file `/etc/borgmatic.d/service1_backup_key`.
As this is a private SSH key it must only be readable by the user. Ro change its permissions correctly use
```
chown 600 service1_backup_key
```
## Check if the backup works
Create your backup with
```
sudo borgmatic create --verbosity 1 --list --stats
```
Now check out the [borgmatic configuration](https://torsion.org/borgmatic/docs/how-to/set-up-backups/#autopilot) on how to properly set up automated backups
# Done
Congrats, you should now have a fully functioning backup configuration!
{{< chat raspi-backup>}}