Restricted Backup

This is a script to send either btrfs snapshots or rsync backups to a remote server It uses rrsync to restrict the rsync connection to a certain directory and does something similar with btrfs to restrict those to a certain connection as well.

Installation

git clone https://git.phlipphlop.me/phlipphlop/restricted_backup.git
cd restricted_backup
python -m build
pip install dist/restricted_backup-0.0.1.tar.gz

Nixos

Include this repository as a flake and follow the instructions below

Usage

Server

When run in server mode all commands are run the from the host machine and ssh is used to interact with the script.

• Decrypt and mount cat backup.key | ssh $user@$ip cryptsetup open
• Unmount and encrypt ssh $user@$ip cryptsetup close
• rsync rsync ... ssh $user@$ip:/ use regular rsync command, the destination is restricted. Snapshots are automatically created
• Receive a btrfs snapshot btrfs send snapshot | ssh $user@$ip btrfs receive $subvolume where subvolume is a subvolume inside the restricted directory
• Get parent snapshot for sending incremental snapshot ssh $user@$ip btrfs parent

Client

Client mode is supposed to be used directly via the command line or automated to run periodically using your method of choice. Run restricted_backup.py client -h for more info.

Limitations

• The backup drive must be btrfs formatted
• The subvolumes that get sent cannot have the same basename

Setup

On backup drive

The backup drive must be formated with the btrfs filesystem. The layout of the subvolumes is unimportant however once mounted all the hostnames of the devices you wish to backup should be present on the root of the backup device. You must therefore create a subvolume for every host that will backup to this drive in the root of the drive as well as a snapshots subvolume to store snapshots created from rsync backups. The snapshots directory can be omitted if only btrfs snapshots are sent and rsync is never used.

The directory structure will be different for devices backed up with rsync or with btrfs. Both can be used in conjunction, however not for the same client.

btrfs

/path/to/mnt/client_hostname/root/ # contains snapshots of subvol named / root
/path/to/mnt/client_hostname/subvol/ # contains snapshots of subvol named subvol

rsync

/path/to/mnt/client_hostname/ # root of backup containing everything from rsync
/path/to/mnt/snapshots/client_hostname/root/ # contains snapshots of client_hostname/
/path/to/mnt/snapshots/client_hostname/home/ # contains snapshots of client_hostname/home

Btrfs subvolumes and their parent directories must be created, the rest are created automatically. It is up to you to decide what should be a directory and what should be a subvolume, snapshots are by definition subvolumes.

On server

The server is the machine that will store the backups on the external drive.

restricted_backup.py is the script that does most of the main work however there is some setup required.

1. Create a user with a home directory optionally in /var.
2. Give the user permission to run restricted-backup.py as sudo passwordless and enable editing the environment in sudo. Add to sudoers file: username ALL=(root) NOPASSWD:SETENV: /path/to/restricted_backup.py replace username with the user that you created in the first step.
3. Configure sshd for the user to force a command. Add the following to the sshd_config file again replacing Username with the user you created in the first step as well as the path where the drive will be mounted.

Match User Username
    ForceCommand sudo -E /var/remote-backup/restricted_backup.py server --your --args --here
    PasswordAuthentication no

4. Add the ssh-keys of the machines that you want to backup to $HOME/.ssh/authorized_keys.

On Client

No setup on the client is required. Run the script with the argument client and other wanted arguments. Optionally run the script periodically using either cron or a systemd. I leave this setup as an exercise to the user.

Note: This script must be able to read all of the files that are going to be backed up. Easiest is to run as root

Nixos

Include this repository in your flake.nix file

  inputs = {
    restricted_backup = {
      type = "git";
      url = "https://git.phlipphlop.me/phlipphlop/restricted_backup.git";
      inputs.nixpkgs.follows = "nixpkgs"; # optional
    };
  };

Then include it in your imports list

  imports = [
    inputs.restricted_backup.nixosModules.default
  ];

Options

There are a number of options defined for nixos. Client options can be found in modules/backup-client.nix Server options can be found in modules/backup-server.nix