Harden backup integrity, implement verified restore and safe upgrades
This commit is contained in:
admin committed
1 parent
099688ea48
commit
4d58fc7b66
22 files changed
+1928
-1106
No files matched your search
@@ -1,122 +1,97 @@
|
||||
# app-backup.conf
|
||||
# -----------------------------------------------------------------------------
|
||||
# Konfiguration für app-backup.sh und app-restore.sh
|
||||
# Pfade/Accounts bitte an eure Umgebung anpassen.
|
||||
# -----------------------------------------------------------------------------
|
||||
|
||||
# === Core paths ===
|
||||
# app-backup v2. Trusted Bash configuration, root:root, mode 600.
|
||||
# Existing installations retain their file; merge new options from .conf.dist.
|
||||
WORKDIR="/var/backups/app-backup"
|
||||
STAGING_ROOT="${WORKDIR}/staging"
|
||||
ARCHIVE_DIR="${WORKDIR}/archives"
|
||||
STAGING_ROOT="$WORKDIR/staging"
|
||||
ARCHIVE_DIR="$WORKDIR/archives"
|
||||
RESTORE_ROOT="$WORKDIR/restore"
|
||||
LOG_DIR="/var/log/app-backup"
|
||||
LOCKFILE="/run/app-backup.lock"
|
||||
ARCHIVE_PREFIX="appbackup"
|
||||
|
||||
# === Retention ===
|
||||
LOCAL_RETENTION_DAYS=7
|
||||
|
||||
# === Compression ===
|
||||
# zstd (schnell + gut) oder gzip (kompatibel)
|
||||
# Local staging and archives contain plaintext: use an encrypted server volume.
|
||||
MIN_FREE_GB=10
|
||||
COMPRESSOR="zstd"
|
||||
ZSTD_LEVEL=6
|
||||
ZSTD_THREADS=2
|
||||
LOG_RETENTION_DAYS=30
|
||||
LOCAL_RETENTION_DAYS=7
|
||||
REMOTE_RETENTION_DAYS=30
|
||||
RETENTION_KEEP_LAST=3
|
||||
# Enable deliberately after a successful restore rehearsal. v1 runs are retained.
|
||||
ENABLE_REMOTE_RETENTION="false"
|
||||
|
||||
# === Remote (rclone) ===
|
||||
ENABLE_UPLOAD="true"
|
||||
RCLONE_BIN="rclone"
|
||||
RCLONE_CONFIG="/root/.config/rclone/rclone.conf"
|
||||
RCLONE_REMOTE_BASE="OneDriveCrypt:gemini"
|
||||
RCLONE_RETRIES=6
|
||||
RCLONE_LOW_LEVEL_RETRIES=20
|
||||
RCLONE_RETRIES_SLEEP="30s"
|
||||
RCLONE_STATS="1m"
|
||||
RCLONE_BWLIMIT="0" # "0" = unbegrenzt
|
||||
ENABLE_REMOTE_RETENTION="true"
|
||||
REMOTE_RETENTION_DAYS=30
|
||||
|
||||
# === Safety ===
|
||||
MIN_FREE_GB=10
|
||||
NICE_LEVEL=10
|
||||
IONICE_CLASS=2
|
||||
IONICE_LEVEL=6
|
||||
|
||||
# === Mail report (lokaler postfix/sendmail) ===
|
||||
RCLONE_TIMEOUT="1h"
|
||||
RCLONE_CONTIMEOUT="30s"
|
||||
RCLONE_TRANSFERS=2
|
||||
RCLONE_CHECKERS=4
|
||||
# OneDrive chunks must be multiples of 320 KiB; 80 MiB satisfies this.
|
||||
RCLONE_ONEDRIVE_CHUNK_SIZE="80Mi"
|
||||
RCLONE_BWLIMIT="0"
|
||||
ENABLE_MAIL_REPORT="true"
|
||||
MAIL_TO="johannes"
|
||||
MAIL_FROM="app-backup@$(hostname -f 2>/dev/null || hostname)"
|
||||
MAIL_SUBJECT_PREFIX="[app-backup]"
|
||||
MAIL_INCLUDE_LOG_TAIL_LINES=200
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Was soll gesichert werden?
|
||||
# -----------------------------------------------------------------------------
|
||||
ENABLE_WORDPRESS="true"
|
||||
WP_DIR="/var/www/html"
|
||||
# Nextcloud paths below WP_DIR are automatically excluded (including on restore).
|
||||
WP_EXCLUDES=()
|
||||
|
||||
ENABLE_NEXTCLOUD="true"
|
||||
ENABLE_NEXTCLOUD_DATA="true"
|
||||
ENABLE_NEXTCLOUD_MAINTENANCE="true"
|
||||
ENABLE_DB_DUMPS="true"
|
||||
ENABLE_MAIL="true" # optional
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# WordPress / Webroot
|
||||
# -----------------------------------------------------------------------------
|
||||
# In eurem Setup liegt WordPress direkt in /var/www/html
|
||||
WP_DIR="/var/www/html"
|
||||
|
||||
# Wenn Nextcloud unterhalb von WP_DIR liegt, wird es sonst doppelt gesichert.
|
||||
# Modus:
|
||||
# - auto => exclude "nextcloud/" automatisch, wenn NC_DIR == WP_DIR/nextcloud
|
||||
# - manual => nutzt WP_EXCLUDES Array
|
||||
WP_EXCLUDES_MODE="auto"
|
||||
#WP_EXCLUDES_MODE="manual"
|
||||
#WP_EXCLUDES=("nextcloud/")
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Nextcloud
|
||||
# -----------------------------------------------------------------------------
|
||||
NC_DIR="/var/www/html/nextcloud"
|
||||
|
||||
# User für occ-Kommandos (Rocky/Apache meist: apache)
|
||||
NC_DATA_DIR="$NC_DIR/data"
|
||||
NC_OCC_USER="apache"
|
||||
|
||||
# Achtung: Das Dataverzeichnis ist oft NICHT unter /var/www/html/nextcloud/data!
|
||||
# Ermitteln mit:
|
||||
# sudo -u apache php /var/www/html/nextcloud/occ config:system:get datadirectory
|
||||
NC_DATA_DIR="/var/www/html/nextcloud/data"
|
||||
# Native MariaDB-backed Gitea. Enable only after checking app.ini paths.
|
||||
ENABLE_GITEA="false"
|
||||
ENABLE_GITEA_SERVICE_STOP="true"
|
||||
GITEA_SERVICE_NAME="gitea"
|
||||
GITEA_DATA_DIR="/var/lib/gitea/data"
|
||||
GITEA_ETC_DIR="/etc/gitea"
|
||||
# Repository ROOT and custom directory can be OUTSIDE APP_DATA_PATH.
|
||||
# GITEA_REPOS_DIR="/var/lib/gitea/repositories"
|
||||
# GITEA_CUSTOM_DIR="/var/lib/gitea/custom"
|
||||
|
||||
# Optional: nach Restore files:scan ausführen (kann lange dauern)
|
||||
NC_FILES_SCAN_AFTER_RESTORE="false"
|
||||
# Stop all writers throughout dumps + staging; downtime depends on data size.
|
||||
ENABLE_HTTPD_STOP="true"
|
||||
HTTPD_SERVICE_NAME="httpd"
|
||||
ENABLE_PHPFPM_STOP="true"
|
||||
PHPFPM_SERVICE_NAME="php-fpm"
|
||||
# Add actual Nextcloud cron timers/services, queue workers, containers, etc.
|
||||
# A timer and its currently running service must BOTH be included, timer first.
|
||||
QUIESCE_SERVICES=()
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Datenbanken (MariaDB/MySQL)
|
||||
# -----------------------------------------------------------------------------
|
||||
# DB-Namen
|
||||
ENABLE_DB_DUMPS="true"
|
||||
# Auto-detect mariadb-dump/mariadb; fallback to mysqldump/mysql.
|
||||
# DB_DUMP_BIN="mariadb-dump"
|
||||
# DB_CLIENT_BIN="mariadb"
|
||||
WP_DB_NAME="wordpress"
|
||||
NC_DB_NAME="nextcloud"
|
||||
|
||||
# Zugangsdaten über my.cnf Dateien (empfohlen, keine Passwörter im Script)
|
||||
# Beispiel-Inhalt:
|
||||
# [client]
|
||||
# user=backup
|
||||
# password=SEHR_GEHEIM
|
||||
# host=localhost
|
||||
GITEA_DB_NAME="gitea"
|
||||
WP_DB_CNF="/etc/app-backup/wp-db.cnf"
|
||||
NC_DB_CNF="/etc/app-backup/nc-db.cnf"
|
||||
GITEA_DB_CNF="/etc/app-backup/db-gitea.cnf"
|
||||
# Restore needs accounts with DDL/DML rights. Use a separate --config FILE for it.
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Mail (optional) - nur relevant wenn ENABLE_MAIL=true
|
||||
# -----------------------------------------------------------------------------
|
||||
ENABLE_MAIL="true"
|
||||
MAIL_BACKUP_MODE="stop"
|
||||
MAIL_DIR="/var/vmail"
|
||||
POSTFIX_DIR="/etc/postfix"
|
||||
DOVECOT_DIR="/etc/dovecot"
|
||||
ENABLE_MAIL_HOME_DIRS="true"
|
||||
MAIL_HOME_DIRS=("/home/johannes" "/home/luciana")
|
||||
# Home copies stay on one filesystem; excluded directories are not backed up.
|
||||
MAIL_HOME_EXCLUDES=("OneDrive/" ".cache/" ".ccache/" ".local/share/Trash/")
|
||||
|
||||
# -----------------------------------------------------------------------------
|
||||
# Restore Verhalten
|
||||
# -----------------------------------------------------------------------------
|
||||
# Wenn true: rsync --delete beim Restore (macht Ziel 1:1 wie im Backup)
|
||||
# Additional directories; only files, no automatic DB/container snapshot semantics.
|
||||
# Keep ordering stable: entries become extra-0, extra-1, ...
|
||||
EXTRA_PATHS=()
|
||||
# Restore target directories must already exist. Deletion is off by default.
|
||||
RESTORE_STRICT_DELETE="false"
|
||||
|
||||
# Restore Default-Schalter (können auch per env überschrieben werden)
|
||||
# DRY_RUN="true"
|
||||
# RESTORE_FILES="true"
|
||||
# RESTORE_DB="true"
|
||||
|
||||
# --- Force crypt remote (no fallback) ---
|
||||
ENABLE_UPLOAD="true"
|
||||
RCLONE_REMOTE_BASE="OneDriveCrypt:gemini"
|
||||
|
||||
# Optional: log level
|
||||
RCLONE_LOG_LEVEL="INFO"
|
||||
Reference in new issue
Block a user