chaas/proxmox-backup-helper
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add setup.sh with nightly systemd timer; move key and excludes into /opt/backup

Browse source
This commit is contained in:
Christoph Haas 2026-09-19 20:36:47 +00:00
parent 99c716d35b
commit 2db05c9bb6
6 changed files with 151 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

26
README.backup.md
View file

@ -13,23 +13,35 @@ Everything lives in `/opt/backup/`. The connection details and credentials
|------|---------|
| `backup.env` | Shared config: server, datastore, namespace, token, key (sourced by both scripts) |
| `backup.env.sample` | Template — copy to `backup.env` and fill in real values |
| `setup.sh` | Install the client and create the encryption key (run once as root) |
| `backup.sh` | Full backup of `/` with client-side encryption |
| `restore.sh` | FUSE-mount the encrypted backup to browse/restore files |
| `/etc/proxmox-backup/encryption-key.pem` | Client-side encryption key (store a copy off-host!) |
| `/etc/proxmox-backup/defaults.exclude` | Paths excluded from the backup |
| `/opt/backup/encryption-key.pem` | Client-side encryption key (store a copy off-host!) |
| `/opt/backup/exclude` | Paths excluded from the backup |
## Setup
On a fresh host, as root:
```
./setup.sh
cp backup.env.sample backup.env
$EDITOR backup.env # fill in server, datastore, namespace, token
chmod 600 backup.env
```
## How `backup.sh` works
1. Sources `backup.env`, which exports the connection/auth settings (server,
datastore, port, API token) as separate `PBS_*` component variables. This
matters: `PBS_AUTH_ID` is only honoured when `PBS_REPOSITORY` is *not* set.
2. Builds `--exclude` flags from `/etc/proxmox-backup/defaults.exclude`
2. Builds `--exclude` flags from `/opt/backup/exclude`
(`/proc`, `/sys`, `/dev`, `/run`, `/tmp`, …).
3. Runs:
```
proxmox-backup-client backup "${HOSTNAME}-root.pxar:/" \
--keyfile /etc/proxmox-backup/encryption-key.pem \
--keyfile /opt/backup/encryption-key.pem \
--ns "$BACKUP_NS" \
--exclude /proc/* ...
```
@ -46,8 +58,8 @@ The **encryption key is the only thing that makes the backups readable**. If
this host and the key are both lost, the backup is unrecoverable — no one at
the PBS provider can help.
- File: `/etc/proxmox-backup/encryption-key.pem`
- Fingerprint: `proxmox-backup-client key show /etc/proxmox-backup/encryption-key.pem`
- File: `/opt/backup/encryption-key.pem`
- Fingerprint: `proxmox-backup-client key show /opt/backup/encryption-key.pem`
Keep a copy somewhere safe that is **not this machine**:
- offline USB stick / printed paperkey
@ -138,7 +150,7 @@ First source the shared config (`source /opt/backup/backup.env`), then:
```
proxmox-backup-client restore host/<hostname>/<time> <hostname>-root.pxar /restore/dir \
--ns <namespace> \
--keyfile /etc/proxmox-backup/encryption-key.pem \
--keyfile /opt/backup/encryption-key.pem \
--pattern "etc/postfix/main.cf"
```