Skip to content

Commit 7606e59

Browse files
author
Alik
committed
Initial commit
0 parents  commit 7606e59

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+5542
-0
lines changed

‎README.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
A small guide on how to build compact, silent and energy-efficient Linux home server that runs:
2+
3+
- Docker
4+
- NFSv4 server secured with Kerberos
5+
- Unbound DNS server
6+
- SOCKS5 over VPN proxy server
7+
- Transmission over VPN
8+
- Nextcloud
9+
- ... and more
10+
11+
The latest HTML version of the guide is hosted online using GitLab Pages
12+
and can be viewed here: https://kosheo.gitlab.io/silverbox-server
13+
14+
# Compiling
15+
The guide is written in [AsciiDoc](https://en.wikipedia.org/wiki/AsciiDoc) format
16+
and can be compiled into different output formats, such as HTML or PDF.
17+
18+
If you have Docker installed, you can use Asciidoctor Docker container.
19+
For example, to build HTML version:
20+
21+
```
22+
git clone https://gitlab.com/kosheo/silverbox-server.git
23+
docker run -it --rm -v ./silverbox-server:/documents asciidoctor/docker-asciidoctor asciidoctor silverbox-server.adoc
24+
```
25+
26+
Or to build a PDF:
27+
28+
```
29+
docker run -it --rm -v ./silverbox-server:/documents asciidoctor/docker-asciidoctor asciidoctor-pdf silverbox-server.adoc
30+
```
31+
32+
See [Generating Custom Document](https://kosheo.gitlab.io/silverbox-server.html#_generating_custom_document)
33+
section for more details.
34+
35+
## Customizing Document
36+
Most of the configuration-specific parameters (such as IP addresses, host names, port numbers etc.)
37+
are not hardcoded, but defined using AsciiDoc attributes.
38+
This way you can redefine these attributes with your specific parameter values
39+
and build your very own version of this document.
40+
41+
By default these parameter values contain simple placeholders,
42+
such as `{SERVER_IP_ADDR}` for the server local IP address.
43+
You can replace them with the values you want by editing `parameters.adoc` file and then compiling the document.
44+
45+
# License
46+
This document is licensed under Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0) License.
47+
48+
For more details see:
49+
50+
- https://creativecommons.org/licenses/by-nc/4.0
51+
- https://creativecommons.org/licenses/by-nc/4.0/legalcode
52+

‎backup/backup.adoc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
== Backup
2+
This section describes how to configure secure automatic backup of valuable files
3+
from the server to external drive and to the cloud.
4+
5+
include::overview.adoc[]
6+
7+
include::disk-preparation.adoc[]
8+
9+
include::configuration.adoc[]
10+
11+
include::monitoring.adoc[]
12+
13+
include::restore.adoc[]
14+
15+
include::references.adoc[]
16+

‎backup/configuration.adoc‎

Lines changed: 258 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,258 @@
1+
=== Configuration
2+
This section describes how to install all the necessary software and configure backup to the external drive and to the cloud.
3+
4+
==== Borg Backup
5+
Borg backup will be used to backup valuable files from the server to the external drive.
6+
7+
===== Installation
8+
Borg backup can be installed directly from the repositories:
9+
10+
----
11+
sudo apt install borgbackup
12+
----
13+
14+
===== Backup Repository Creation
15+
Borg backups files to what it calls repository, which is essentially a directory on disk.
16+
17+
Initialize a new empty Borg repository on the external drive:
18+
19+
----
20+
sudo borg init --encryption=repokey /mnt/backup/borgrepo
21+
----
22+
23+
You'll be prompted for a passphrase that will be used to generate encryption key for the backups.
24+
25+
IMPORTANT: Store this passphrase somewhere outside of the server,
26+
so that it can be used to decrypt backups in the case of total server failure.
27+
28+
===== Automatic Backup Creation
29+
Create a directory where backup related scripts will be stored:
30+
31+
----
32+
sudo mkdir /root/silverbox/backup
33+
sudo chmod 700 /root/silverbox/backup
34+
----
35+
36+
Create the `/root/silverbox/backup/backup.sh` file with the following content:
37+
38+
./root/silverbox/backup/backup.sh
39+
[source,bash]
40+
----
41+
#!/bin/sh
42+
43+
if pidof -x borg >/dev/null; then
44+
echo "borg is already running"
45+
exit 1
46+
fi
47+
48+
export BORG_PASSPHRASE='{BORG_PASSPHRASE}' # <1>
49+
50+
# Create backup
51+
borg create -v --stats /mnt/backup/borgrepo::'{hostname}-{now:%Y-%m-%d}' \ # <2>
52+
/etc/letsencrypt/archive \ # <3>
53+
/srv/nextcloud \
54+
/srv/nfs \
55+
--exclude '/srv/nfs/torrents' \
56+
--exclude '/srv/nextcloud/html' \
57+
--exclude '/srv/nextcloud/data/*.log' \
58+
--exclude '/srv/nextcloud/data/*/preview' \
59+
--exclude '/srv/nextcloud/db/*.pid' \
60+
--exclude '/srv/nextcloud/db/*.opts' \
61+
--exclude '/srv/nextcloud/db/pg_stat_tmp'
62+
63+
if [ "$?" -ne "0" ]; then
64+
echo "borg create failed"
65+
exit 2
66+
fi
67+
68+
# Prune old backups
69+
borg prune -v --list /mnt/backup/borgrepo --keep-daily=3 --keep-weekly=4 --keep-monthly=6 # <4>
70+
71+
if [ "$?" -ne "0" ]; then
72+
echo "borg prune failed"
73+
exit 3
74+
fi
75+
76+
echo "backup completed"
77+
----
78+
<1> Set `\{BORG_PASSPHRASE}` to your Borg passphrase.
79+
<2> Feel free to adjust the mask controlling how backups will be names.
80+
<3> This list of what to backup is just an example, adjust it according to your needs.
81+
<4> Feel free to adjust backup retention settings according to your needs.
82+
83+
Mark this file as executable and only accessible by root:
84+
85+
----
86+
sudo chmod 700 /root/silverbox/backup/backup.sh
87+
----
88+
89+
To run backup script automatically on a schedule a Systemd timer is used.
90+
Create the `/etc/systemd/system/borg-backup.service` file with the following content:
91+
92+
./etc/systemd/system/borg-backup.service
93+
----
94+
[Unit]
95+
Description=Create backup using Borg backup
96+
97+
[Service]
98+
Type=oneshot
99+
ExecStart=/bin/sh -c "/root/silverbox/backup/backup.sh"
100+
----
101+
102+
Next, create the `/etc/systemd/system/borg-backup.timer` file with the following content:
103+
104+
./etc/systemd/system/borg-backup.timer
105+
----
106+
[Unit]
107+
Description=Create backup using Borg backup
108+
109+
[Timer]
110+
OnCalendar=*-*-* 00:00:00 # <1>
111+
AccuracySec=1h
112+
Persistent=true
113+
114+
[Install]
115+
WantedBy=timers.target
116+
----
117+
<1> In this configuration backup is created daily at midnight.
118+
119+
Enable and start the timer:
120+
121+
----
122+
sudo systemctl daemon-reload
123+
sudo systemctl enable borg-backup.timer
124+
sudo systemctl start borg-backup.timer
125+
----
126+
127+
To create the first backup and verify that everything works run the service manually:
128+
129+
----
130+
sudo systemctl start borg-backup.service
131+
----
132+
133+
The first backup creation may take very long time.
134+
135+
==== Rclone
136+
Rclone is a tool that can synchronize local files with remote cloud storage.
137+
In this deployment it is used to sync backup files generated by Borg to remote cloud storage.
138+
139+
The prerequisite to this section is to have cloud storage configured and ready for use.
140+
I chose to use OVH object storage, but you can chose any storage that is supported by Rclone
141+
(list of supported storages available on Rclone website, see link in the references section).
142+
143+
===== Installation
144+
Rclone can be installed directly from the repositories:
145+
146+
----
147+
sudo apt install rclone
148+
----
149+
150+
===== Storage Configuration
151+
After installation, Rclone needs to be configured to work with your cloud storage.
152+
This can either be done by running `rclone config`
153+
or by putting configuration into the `/root/.config/rclone/rclone.conf` file.
154+
155+
Since the configuration depends on what cloud provider you use, it is not described in this document.
156+
For OVH, there is a helpful article mentioned in the references to this section.
157+
158+
Once Rclone is configured, you can test that it has access to the storage by doing:
159+
160+
----
161+
sudo rclone ls {REMOTE_STORAGE}:{STORAGE_PATH} -v # <1>
162+
----
163+
<1> Replace `\{REMOTE_STORAGE}` and `\{STORAGE_PATH}` with remote storage that you configured and path respectively.
164+
165+
===== Automatic Backup Sync
166+
Create the `/root/silverbox/backup/sync.sh` file with the following content:
167+
168+
./root/silverbox/backup/sync.sh
169+
[source,bash]
170+
----
171+
#!/bin/sh
172+
173+
if pidof -x borg >/dev/null; then
174+
echo "borg is already running"
175+
exit 1
176+
fi
177+
178+
if pidof -x rclone >/dev/null; then
179+
echo "rclone is already running"
180+
exit 1
181+
fi
182+
183+
export BORG_PASSPHRASE='{BORG_PASSPHRASE}' # <1>
184+
185+
# Check backup for consistency before syncing to the cloud
186+
borg check -v /mnt/backup/borgrepo
187+
188+
if [ "$?" -ne "0" ]; then
189+
echo "borg check failed"
190+
exit 2
191+
fi
192+
193+
# Sync backup
194+
rclone -v sync /mnt/backup/borgrepo {REMOTE_STORAGE}:{STORAGE_PATH} # <2>
195+
196+
if [ "$?" -ne "0" ]; then
197+
echo "rclone sync failed"
198+
exit 3
199+
fi
200+
201+
echo "backup sync completed"
202+
----
203+
<1> Set `\{BORG_PASSPHRASE}` to your Borg passphrase.
204+
<2> Replace `\{REMOTE_STORAGE}` and `\{STORAGE_PATH}` with the actual values.
205+
206+
Mark this file as executable and only accessible by root:
207+
208+
----
209+
sudo chmod 700 /root/silverbox/backup/sync.sh
210+
----
211+
212+
To run backup sync script automatically on a schedule a Systemd timer is used.
213+
Create the `/etc/systemd/system/sync-backup.service` file with the following content:
214+
215+
./etc/systemd/system/sync-backup.service
216+
----
217+
[Unit]
218+
Description=Sync backup files to the cloud
219+
220+
[Service]
221+
Type=oneshot
222+
ExecStart=/bin/sh -c "/root/silverbox/backup/sync.sh"
223+
----
224+
225+
Next, create the `/etc/systemd/system/sync-backup.timer` file with the following content:
226+
227+
./etc/systemd/system/sync-backup.timer
228+
----
229+
[Unit]
230+
Description=Sync backup files to the cloud
231+
232+
[Timer]
233+
OnCalendar=Mon *-*-* 03:00:00 # <1>
234+
AccuracySec=1h
235+
Persistent=true
236+
237+
[Install]
238+
WantedBy=timers.target
239+
----
240+
<1> In this configuration backup is synced every Monday at 3 am.
241+
The reason sync is done only once a week is to save some bandwidth and data.
242+
243+
Enable and start the timer:
244+
245+
----
246+
sudo systemctl daemon-reload
247+
sudo systemctl enable sync-backup.timer
248+
sudo systemctl start sync-backup.timer
249+
----
250+
251+
To run the initial sync and verify that everything works run the service manually:
252+
253+
----
254+
sudo systemctl start sync-backup.service
255+
----
256+
257+
The first sync may take very long time (depending on your internet bandwidth and backup size).
258+

0 commit comments

Comments
 (0)