Project

General

Profile

Wiki ยป

Borg backups

This is documentation and scripts for using Borg backups with backupninja. This relies heavily on the work of Jon Goldberg, Benzhaomin, and Guillaume Subiron.

What is Borg?

From the Borg docs:

BorgBackup (short: Borg) is a deduplicating backup program. Optionally, it supports compression and authenticated encryption.

The main goal of Borg is to provide an efficient and secure way to backup data. The data deduplication technique used makes Borg suitable for daily backups since only changes are stored. The authenticated encryption technique makes it suitable for backups to not fully trusted targets.

Usage

Main borg docs: https://borgbackup.readthedocs.io/en/stable/

List backups

borg list /path/to/repo

Mount a single backup

borg mount /path/to/repo::individual_backup /tmp/mymountpoint

Check viability of the repo

borg check -v /path/to/repo

For help fixing a repo that fails borg check see this example from work on VCW osTicket.

If the backup has a passphrase, you'll need to enter it to do any of those commands. The passphrase should be in the client credentials, and will be in the /etc/backup.d/ jobs

Setup

For Rsync.net backups, using borg backup, using backupninja
With Rsync.net username USERNAME to back up server SERVERNAME

In your password manager, create a new borg passphrase for the new server.

Start a SSH session into the new server, using -A to pass your individual SSH key up.

ssh -A SERVERNAME
sudo -Es

Make sure borg and backupninja are installed.

apt install backupninja
apt install borg

Make sure the root user has a SSH RSA key that we can pull.

ls -la /root/.ssh/

If it doesn't, create a new one. Hit enter to use defaults, and don't set a passphrase.

ssh-keygen -t rsa -b 4096

Add the servers RSA key to the rsync.net user

cat /root/.ssh/id_rsa.pub | ssh USERNAME@USERNAME.rsync.net 'dd of=.ssh/authorized_keys oflag=append conv=notrunc'

Test to make sure that you can SSH to the rsync.net server.

ssh USERNAME@USERNAME.rsync.net quota

Make a new folder on our sync.net for the backups.

ssh USERNAME@USERNAME.rsync.net mkdir /data2/home/USERNAME/SERVERNAME

Make sure there's nothing in that folder and that it exists with the correct permissions.

ssh USERNAME@USERNAME.rsync.net ls -la /data2/home/USERNAME

Initiate Borg backup to that folder. It will ask you for the passphrase, use the one saved in Bitwarden in the first step.

borg init --remote-path=borg12 --encryption=repokey USERNAME@USERNAME.rsync.net:/data2/home/USERNAME/SERVERNAME

Create a hidden file with the passphrase.

vim /root/.borg-passphrase

Copy the appropriate backupninja jobs into the /etc/backup.d folder.
For Palante Tech, these jobs live in our git repo.
Change the passphrase variable in these jobs to the passphrase created during the first step.

Start in a root screen an initial run of your backupninja job, to make sure it doesn't error out immediately.

screen
cd /etc/backup.d
backupninja -n -d --run 60-rsync.borg

troubleshooting

There is a version of the borg handler now included in newer versions of backupninja.
That handler requires two changes to job 71:

  • need to add encryption = none just above the passphrase
  • change the path to the directory to be the complete full path, not use the tilde for home like ~/backups/borgbackups/offal, and must start with a slash so /home/members/srlp/backups/srlp-sync/borgbackups not borgbackups/

documentation:
https://0xacab.org/riseuplabs/backupninja/merge_requests/1
https://labs.riseup.net/code/projects/backupninja
https://borgbackup.readthedocs.io/en/stable/