Add setup.sh with nightly systemd timer; move key and excludes into /opt/backup

setup.sh

@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ==============================================================================
+# Set up Proxmox Backup Client on a Debian trixie host.
+#
+# Installs the client and creates the client-side encryption key. Everything
+# lives in /opt/backup (see backup.env for the connection/auth config).
+#
+# Run as root. Safe to re-run: it will not overwrite an existing key.
+# ==============================================================================
+
+KEYRING="/usr/share/keyrings/proxmox-archive-keyring.gpg"
+KEYRING_URL="https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg"
+SOURCES_FILE="/etc/apt/sources.list.d/pbs-client.sources"
+BACKUP_DIR="/opt/backup"
+KEY_FILE="${BACKUP_DIR}/encryption-key.pem"
+EXCLUDE_FILE="${BACKUP_DIR}/exclude"
+ENV_FILE="${BACKUP_DIR}/backup.env"
+ENV_SAMPLE="${BACKUP_DIR}/backup.env.sample"
+SERVICE_UNIT="/etc/systemd/system/pbs-backup.service"
+TIMER_UNIT="/etc/systemd/system/pbs-backup.timer"
+BACKUP_TIME="02:00"
+
+# 1. Proxmox archive signing key
+wget "$KEYRING_URL" -O "$KEYRING"
+
+# 2. APT source for the client-only repository
+cat > "$SOURCES_FILE" <<'EOF'
+Types: deb
+URIs: http://download.proxmox.com/debian/pbs-client
+Suites: trixie
+Components: main
+Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
+EOF
+
+# 3. Install the client
+apt-get update
+apt-get install -y proxmox-backup-client
+
+# 4. Client-side encryption key (no password). Never overwrite an existing key.
+mkdir -p "$BACKUP_DIR"
+if [ -e "$KEY_FILE" ]; then
+    echo "Encryption key already exists at $KEY_FILE — leaving it untouched." >&2
+else
+    proxmox-backup-client key create "$KEY_FILE" --kdf none
+    chmod 600 "$KEY_FILE"
+    echo "Created encryption key: $KEY_FILE"
+fi
+
+# 5. Exclude list (created only if it doesn't exist yet)
+if [ ! -f "$EXCLUDE_FILE" ]; then
+    cat > "$EXCLUDE_FILE" <<'EOF'
+/proc/*
+/sys/*
+/dev/*
+/run/*
+/tmp/*
+/mnt/*
+/media/*
+/lost+found
+/var/tmp/*
+/var/cache/*
+EOF
+    echo "Created exclude list: $EXCLUDE_FILE"
+fi
+
+# 6. Config template -> backup.env (unless backup.env already exists)
+if [ -f "$ENV_FILE" ]; then
+    echo "backup.env already exists — leaving it untouched." >&2
+elif [ -f "$ENV_SAMPLE" ]; then
+    cp "$ENV_SAMPLE" "$ENV_FILE"
+    chmod 600 "$ENV_FILE"
+    echo "Created $ENV_FILE from $ENV_SAMPLE"
+else
+    echo "warning: $ENV_SAMPLE not found — create $ENV_FILE manually" >&2
+fi
+
+# 7. systemd timer — run the backup daily at night
+cat > "$SERVICE_UNIT" <<EOF
+[Unit]
+Description=Proxmox Backup Client host backup
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=${BACKUP_DIR}/backup.sh
+Nice=19
+IOSchedulingClass=idle
+EOF
+
+cat > "$TIMER_UNIT" <<EOF
+[Unit]
+Description=Daily Proxmox Backup
+
+[Timer]
+OnCalendar=*-*-* ${BACKUP_TIME}
+RandomizeDelaySec=1800
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now pbs-backup.timer
+
+echo
+echo "Done. Fill in the credentials, then run ${BACKUP_DIR}/backup.sh (or wait for the timer):"
+echo "    ${EDITOR:-vi} ${ENV_FILE}   # server/datastore/namespace/token"
+echo "    systemctl list-timers pbs-backup.timer"
+echo "    journalctl -u pbs-backup"