Off-site Backup with Backupninja - Revision history

Rra at 13:42, 16 February 2026

2026-02-16T13:42:40Z

← Older revision		Revision as of 13:42, 16 February 2026
Line 123:		Line 123:
	This passphrase needs to be entered every time you interact with the repo (unless you set the <code>BORG_PASSPHRASE</code> env variable for the duration of the session).		This passphrase needs to be entered every time you interact with the repo (unless you set the <code>BORG_PASSPHRASE</code> env variable for the duration of the session).

	Furthermore, ~~all repos require~~ a key which is not attached to the repo itself. Passphrases and keys are available in the keepass.		Furthermore, each repo has a unique key, which is not attached to the repo itself. Passphrases and keys are available in the keepass.

	=== Inspecting ===		=== Inspecting ===

Rra: /* Inspecting / Restoring */

2026-02-16T13:40:09Z

Inspecting / Restoring

← Older revision		Revision as of 13:40, 16 February 2026
Line 114:		Line 114:
	* What the passphrase is for the key		* What the passphrase is for the key

	As of writing Feb 2026 we have the following:		'''As of writing Feb 2026 we have the following:'''

	Agnes has one backup repository (agnes-system in ninjahelper) sent to [[Tinc Settings for LURK\|Manis and Stuff]].		* Agnes has one backup repository (agnes-system in ninjahelper) sent to [[Tinc Settings for LURK\|Manis and Stuff]].
			* Larix has two backup repositories (larix-system, mastodon-borg) sent to [[Tinc Settings for LURK\|Manis and Stuff]].

	Larix has two ~~backup repositories (larix-system, mastodon-borg) sent to [[Tinc Settings for LURK\|Manis and Stuff]]~~.		Agnes' repo has its own passphrase. Larix has another passphrase but its two repos share the same one.

	~~Agnes' repo has its own~~ passphrase ~~and Larix have their own passphrase, which are necessary~~ every time you interact with ~~them~~ (unless you set the <code>BORG_PASSPHRASE</code> env variable). Furthermore, all repos require a key which is not attached to the repo itself. Passphrases and keys are available in the keepass.		This passphrase needs to be entered every time you interact with the repo (unless you set the <code>BORG_PASSPHRASE</code> env variable for the duration of the session).

			Furthermore, all repos require a key which is not attached to the repo itself. Passphrases and keys are available in the keepass.

	=== Inspecting ===		=== Inspecting ===
Line 165:		Line 168:
	borg extract --list --dry-run ssh://user@10.0.1.5/path/to/repository::2026-02-16T11:00:10 home/mastodon/live/.env.production		borg extract --list --dry-run ssh://user@10.0.1.5/path/to/repository::2026-02-16T11:00:10 home/mastodon/live/.env.production

	'''n.b.''' [https://borgbackup.readthedocs.io/en/master/usage/extract.html From the docs]: This command always extracts to (".") and will recreate the full folder structure. So make sure you cd to the right place before calling borg extract. When parent directories are not extracted (because of using file/directory selection or any other reason), Borg cannot restore parent directories’ metadata, e.g., owner, group, permissions, etc.		'''n.b.''' [https://borgbackup.readthedocs.io/en/master/usage/extract.html From the docs]: This command always extracts to (".") and will recreate the full folder structure (<code>home/mastodon/live/.env.production</code> in the example above). So make sure you cd to the right place before calling borg extract. When parent directories are not extracted (because of using file/directory selection or any other reason), Borg cannot restore parent directories’ metadata, e.g., owner, group, permissions, etc.

			=== Restoring from other location ===

			To restore from a place that does not have the keys, such as from a new server, you first need to import the key for the appropriate repository.

			The keys in the keepass are the ones exported by running <code>borg key export ssh://user@10.0.1.5/path/to/repository </code>.

			These can be imported on a new machine by writing them to a file on the new server and importing them from there. Note the structure of the key:

			BORG_KEY f80fe7d9b22c3425222a979eb607585bd0eb968163cb1e9b
			hqlhbGdvcml0aG2mc2hhMjU2pGRhdGHaAN4tcXvK6kpfvKnENuufVl3HumRd+ejS+Rw5bp
			23gYW8qGcnxPECz9BOWau2jcF12OdOyUJE+JlYIreH90p9PDDkXU7SCJ1R70MtR49+063D
			xsmGpOw6zcJLtVFVVv15lhYC9KQzZUd2ChGwOXnu8jTXA+q0OfMzNHXZymEA6eJTKX/qQS
			U9z0A+wZqCxwp5w875TITW5/6bDXm4+rmqMDL8P5mgiFsRxZgTHwD3tP4hHuwfG72vqXEx
			4/2KApRwYp34gLtOc5Y4P7jLKZq/DRC7Qpu4r6f2IQEcs9ktcrmkaGFzaNoAINJleelRBv
			BWLhh/Iqs27Etba8JaIAArppQbzCBFDZUnqml0ZXJhdGlvbnPOAAGGoKRzYWx02gAgipER
			XyJdua9isfZGrJ2U8WuHKosRQgC1k/2J9vDcg2CndmVyc2lvbgE=

			The header includes the repository id, the key includes linebreaks.

			Import the key from a file like so:

			borg key import ssh://user@10.0.1.5/path/to/repository /path/to/keyfile

	[[Category:System]] [[Category: backup]]		[[Category:System]] [[Category: backup]]

Rra at 13:10, 16 February 2026

2026-02-16T13:10:58Z

← Older revision		Revision as of 13:10, 16 February 2026
Line 106:		Line 106:
	* '''Optional:''' run <code>ninjahelper</code>, select the <code>90.borg</code> action and <code>run</code> it to make sure it's being sent to the off-site machine. If you're sure of your changes, you can also wait the next backup to happen to see if it worked.		* '''Optional:''' run <code>ninjahelper</code>, select the <code>90.borg</code> action and <code>run</code> it to make sure it's being sent to the off-site machine. If you're sure of your changes, you can also wait the next backup to happen to see if it worked.

			== Inspecting / Restoring ==

			To inspect or restore the files from the off-site backups you need to know a few things:

			* Where the backup repositories are
			* What key they are encrypted with
			* What the passphrase is for the key

			As of writing Feb 2026 we have the following:

			Agnes has one backup repository (agnes-system in ninjahelper) sent to [[Tinc Settings for LURK\|Manis and Stuff]].

			Larix has two backup repositories (larix-system, mastodon-borg) sent to [[Tinc Settings for LURK\|Manis and Stuff]].

			Agnes' repo has its own passphrase and Larix have their own passphrase, which are necessary every time you interact with them (unless you set the <code>BORG_PASSPHRASE</code> env variable). Furthermore, all repos require a key which is not attached to the repo itself. Passphrases and keys are available in the keepass.

			=== Inspecting ===

			'''n.b.''' You can find the actual paths and usernames by looking at the appropriate repo config in <code>/usr/local/etc/backup.d/</code> on either Agnes or Larix.

			Get general info on the repository:

			borg info ssh://user@10.0.1.5/path/to/repository

			This gives you some details such as whether they key is in the repository (that is on the off-site location) or only on the server the backing up happens from. This becomes relevant when you need to restore a backup from any other location than the server you are backing up from.

			Repository ID: f80fe7d9b22c3425222a979eb607585bd0eb968163cb1e9b
			Location: ssh://user@10.0.1.5/path/to/repository
			Encrypted: Yes (repokey)
			Cache: /root/.cache/borg/f80fe7d9b22c3425222a979eb607585bd0eb968163cb1e9b
			Security dir: /root/.config/borg/security/f80fe7d9b22c3425222a979eb607585bd0eb968163cb1e9b
			------------------------------------------------------------------------------
			Original size Compressed size Deduplicated size
			All archives: 259.11 GB 257.04 GB 104.89 GB

			Unique chunks Total chunks
			Chunk index: 123440 525923


			List all the repository snapshots:

			borg list ssh://user@10.0.1.5/path/to/repository

			This will output all the different snapshots:

			2026-02-14T11:00:08 Sat, 2026-02-14 11:00:10 [74easd341e160560585bd0eb968163cb1e9b89a0de405c5daa629c370895]
			2026-02-15T11:00:09 Sun, 2026-02-15 11:00:10 [48d4gdsd4161293e62e286a1e9a0f6b5c2b0082d0ac8fb665a7ea3e5eccc]
			2026-02-16T11:00:10 Mon, 2026-02-16 11:00:11 [dc08d6dqwe6973287f8f932b64474a6e4fcf0fe6950bf7209f1f2efa0068]

			Query a specific snapshot from the ones listed above by appending the date (will flood terminal with thousands of file names):

			borg list ssh://user@10.0.1.5/path/to/repository::2026-02-16T11:00:10

			=== Restoring ===

			Restore an important file from a specific snapshot:

			borg extract --list --dry-run ssh://user@10.0.1.5/path/to/repository::2026-02-16T11:00:10 home/mastodon/live/.env.production

			'''n.b.''' [https://borgbackup.readthedocs.io/en/master/usage/extract.html From the docs]: This command always extracts to (".") and will recreate the full folder structure. So make sure you cd to the right place before calling borg extract. When parent directories are not extracted (because of using file/directory selection or any other reason), Borg cannot restore parent directories’ metadata, e.g., owner, group, permissions, etc.

	[[Category:System]] [[Category: backup]]		[[Category:System]] [[Category: backup]]

Rra at 11:52, 16 February 2026

2026-02-16T11:52:43Z

← Older revision		Revision as of 11:52, 16 February 2026
Line 107:		Line 107:


	[[Category:System]]		[[Category:System]] [[Category: backup]]

Rra at 08:45, 5 July 2023

2023-07-05T08:45:58Z

@@ Line 12: / Line 12: @@
 * As <code>lurk</code> create directories for each server
   mkdir /data/lurk/douglas /data/lurk/agnesbaxter
 == On each server ==
@@ Line 88: / Line 105: @@
 * Make changes in the section <code># files to include in the backup</code>
 * '''Optional:''' run <code>ninjahelper</code>, select the <code>90.borg</code> action and <code>run</code> it to make sure it's being sent to the off-site machine. If you're sure of your changes, you can also wait the next backup to happen to see if it worked.
 [[Category:System]]

Rra: /* Borg Backup */

2023-07-04T13:09:20Z

Borg Backup

← Older revision		Revision as of 13:09, 4 July 2023
Line 76:		Line 76:
	** dest_type <code>remote</code>		** dest_type <code>remote</code>
	* set up ssh keys and test remote connection		* set up ssh keys and test remote connection
	* enable encryption~~, choose~~ a nice long passphrase		* enable encryption by setting <code>encryption = keyfile</code> and choosing a nice long passphrase
	* enable pruning, keep <code>120D</code> (you can adjust if you will run out of space! Keep in mind this is incremental though, so don't panic)		* enable pruning, keep <code>120D</code> (you can adjust if you will run out of space! Keep in mind this is incremental though, so don't panic)
	* '''select the action and test/run/review the config'''		* '''select the action and test/run/review the config'''

Rra at 07:26, 25 July 2019

2019-07-25T07:26:49Z

← Older revision		Revision as of 07:26, 25 July 2019
Line 6:		Line 6:
	* A <code>lurk</code> user created on the off-site backup that will be used specifically by the backup scripts		* A <code>lurk</code> user created on the off-site backup that will be used specifically by the backup scripts
	* Debian based servers (not sure Backupninja will run otherwise without some slight modifications)		* Debian based servers (not sure Backupninja will run otherwise without some slight modifications)
	* All the machines (servers and the backup machine) on a working Tinc VPN		* All the machines (servers and the backup machine) on a working [[VPN_with_Tinc \| Tinc VPN]]
	* Enough space on the off-site backup machine :)		* Enough space on the off-site backup machine :)

	== On the Off-site machine ==		== On the Off-site machine ==
	* As <code>lurk</code> create directories for each server		* As <code>lurk</code> create directories for each server
	mkdir /~~media~~/~~lurk_backup~~/douglas /~~media~~/~~lurk_backup~~/agnesbaxter		mkdir /data/lurk/douglas /data/lurk/agnesbaxter

	== On each server ==		== On each server ==
	=== Installation ===		=== Installation ===
	* As <code>~~root~~</code>
	~~apt install backupninja~~		Clone Backupninja from https://0xacab.org/riseuplabs/backupninja

			cd /usr/src/ && git clone https://0xacab.org/riseuplabs/backupninja
			cd /usr/src/backupninja

			./autogen.sh
			./configure
			make
			make install

			note that by running the above all configurations will be in <code>/usr/local/etc/</code>

	=== Configuration ===		=== Configuration ===
Line 50:		Line 60:
	* leave ninjahelper		* leave ninjahelper

	==== ~~Rdiff backup~~ ====		==== Borg Backup ====
	This is the action that will not only allow you to select which part of your local filesystem to remotely send and rotate to the off-site backup machine, but it will also make sure the local backups above are sent as well!		This is the action that will not only allow you to select which part of your local filesystem to remotely send and rotate to the off-site backup machine, but it will also make sure the local backups above are sent as well!

	* As <code>root</code> run ~~the command~~:		* make sure you have <code>borgbackup</code> installed:
			apt install borgbackup

			* As <code>root</code> run:
	ninjahelper		ninjahelper
	* create a new backup action		* create a new backup action, choose borg
	* rdiff-backup
	* choose file to include & exclude, add paths, wildcard accepted		* choose file to include & exclude, add paths, wildcard accepted
	* configure backup destination:		* configure backup destination:
	** keep <code>120D</code> (you can adjust if you will run out of space! Keep in mind this is incremental though, so don't panic)		** dest_directory <code>/data/lurk/name-of-server-to-backup</code>
	** dest_directory <code>/~~media~~/~~lurk_backup~~/name-of-server-to-backup</code>
	** dest_host <code>10.0.1.2</code> Adjust to the Tinc IP of the off-site backup machine.		** dest_host <code>10.0.1.2</code> Adjust to the Tinc IP of the off-site backup machine.
	** dest_user <code>lurk</code>		** dest_user <code>lurk</code>
	** dest_type <code>remote</code>		** dest_type <code>remote</code>
	* set up ssh keys and test remote connection		* set up ssh keys and test remote connection
			* enable encryption, choose a nice long passphrase
			* enable pruning, keep <code>120D</code> (you can adjust if you will run out of space! Keep in mind this is incremental though, so don't panic)
	* '''select the action and test/run/review the config'''		* '''select the action and test/run/review the config'''
	* check that everything is showing up nicely on the backup server in the destination directory!		* check that everything is showing up nicely on the backup server in the destination directory!
Line 70:		Line 83:
	== Fine tuning ==		== Fine tuning ==
	=== Edit/Change the local filesystem path to include/exclude ===		=== Edit/Change the local filesystem path to include/exclude ===
	By default Babckupninja will backup some folder and exclude some others. This can be changed during the initial configuration of the ~~rdiff~~ action but can also be done later.		By default Babckupninja will backup some folder and exclude some others. This can be changed during the initial configuration of the borg action but can also be done later.

	* As root, edit <code>/etc/backup.d/90.~~rdiff~~</code>		* As root, edit <code>/etc/backup.d/90.borg</code>
	* Make changes in the section <code># files to include in the backup</code>		* Make changes in the section <code># files to include in the backup</code>
	* '''Optional:''' run <code>ninjahelper</code>, select the <code>90.~~rdiff~~</code> action and <code>run</code> it to make sure it's being sent to the off-site machine. If you're sure of your changes, you can also wait the next backup to happen to see if it worked.		* '''Optional:''' run <code>ninjahelper</code>, select the <code>90.borg</code> action and <code>run</code> it to make sure it's being sent to the off-site machine. If you're sure of your changes, you can also wait the next backup to happen to see if it worked.

	[[Category:System]]		[[Category:System]]

320x200: /* Edit/Change the local filesystem path to include/exclude */

2018-08-26T12:04:27Z

Edit/Change the local filesystem path to include/exclude

← Older revision		Revision as of 12:04, 26 August 2018
Line 72:		Line 72:
	By default Babckupninja will backup some folder and exclude some others. This can be changed during the initial configuration of the rdiff action but can also be done later.		By default Babckupninja will backup some folder and exclude some others. This can be changed during the initial configuration of the rdiff action but can also be done later.

	* As root, edit </code>/etc/backup.d/90.rdiff</code>		* As root, edit <code>/etc/backup.d/90.rdiff</code>
	* Make changes in the section <code># files to include in the backup</code>		* Make changes in the section <code># files to include in the backup</code>
	* '''Optional:''' run <code>ninjahelper</code>, select the <code>90.rdiff</code> action and <code>run</code> it to make sure it's being sent to the off-site machine. If you're sure of your changes, you can also wait the next backup to happen to see if it worked.		* '''Optional:''' run <code>ninjahelper</code>, select the <code>90.rdiff</code> action and <code>run</code> it to make sure it's being sent to the off-site machine. If you're sure of your changes, you can also wait the next backup to happen to see if it worked.

	[[Category:System]]		[[Category:System]]

320x200: /* Edit/Change the local filesystem path to include/exclude */

2018-08-26T11:52:38Z

Edit/Change the local filesystem path to include/exclude

← Older revision		Revision as of 11:52, 26 August 2018
Line 74:		Line 74:
	* As root, edit </code>/etc/backup.d/90.rdiff</code>		* As root, edit </code>/etc/backup.d/90.rdiff</code>
	* Make changes in the section <code># files to include in the backup</code>		* Make changes in the section <code># files to include in the backup</code>
	* Optional: run <code>ninjahelper</code>, select the <code>90.rdiff</code> action and <code>run</code> it to make sure it's being sent to the off-site machine.		* '''Optional:''' run <code>ninjahelper</code>, select the <code>90.rdiff</code> action and <code>run</code> it to make sure it's being sent to the off-site machine. If you're sure of your changes, you can also wait the next backup to happen to see if it worked.

	[[Category:System]]		[[Category:System]]

320x200: /* Fine tuning */

2018-08-26T11:51:46Z

Fine tuning

← Older revision		Revision as of 11:51, 26 August 2018
Line 70:		Line 70:
	== Fine tuning ==		== Fine tuning ==
	=== Edit/Change the local filesystem path to include/exclude ===		=== Edit/Change the local filesystem path to include/exclude ===
	~~TODO~~		By default Babckupninja will backup some folder and exclude some others. This can be changed during the initial configuration of the rdiff action but can also be done later.

			* As root, edit </code>/etc/backup.d/90.rdiff</code>
			* Make changes in the section <code># files to include in the backup</code>
			* Optional: run <code>ninjahelper</code>, select the <code>90.rdiff</code> action and <code>run</code> it to make sure it's being sent to the off-site machine.

	[[Category:System]]		[[Category:System]]