2f0d93a0ae
apiscp-borg is a sibling of apiscp-kopia built on BorgBackup. This first milestone lands the project scaffold and the Layer 1 engine: - borg-apiscp-backup: per-site named archives (siteN-shadow/info/db), fresh per-site DB dumps via ApisCP site-context export, system + custom archives, borg prune retention per prefix, Prometheus metrics, email notifications. - apiscp-borg-common.sh: logging, mail, site/owner helpers. - config example, systemd service+timer, install.sh, README, DESIGN. Borg preserves POSIX ACLs and xattrs natively, so (unlike the kopia engine) no metadata sidecar is required; DESIGN.md records how Borg reshapes the design. Repository/restore tools, Layer 2 panel integration, hooks, uninstall, and the full reference are the next milestones.
75 lines
3.3 KiB
Text
75 lines
3.3 KiB
Text
# apiscp-borg configuration. Copy to /etc/apiscp-borg/config (root-owned, 0600:
|
|
# it holds the repository passphrase). All keys have sane defaults so the engine
|
|
# also runs on a stock ApisCP box once BORG_REPO and BORG_PASSPHRASE are set.
|
|
#
|
|
# This file is sourced by POSIX sh. Quote values; do not add spaces around '='.
|
|
|
|
# --- repository ---------------------------------------------------------------
|
|
# Borg repository location. Either a local path or an ssh URL, e.g.:
|
|
# BORG_REPO="/mnt/backups/apiscp-borg"
|
|
# BORG_REPO="ssh://borg@backup.example.net:22/./apiscp-borg"
|
|
BORG_REPO=""
|
|
|
|
# Repository passphrase. Borg reads BORG_PASSPHRASE from the environment; the
|
|
# engine exports whatever is set here. Keep this file 0600 and root-owned.
|
|
# For recoverability, back it up off the machine (borg-apiscp-repo backup-key).
|
|
BORG_PASSPHRASE=""
|
|
|
|
# Encryption mode used when CREATING a new repository (repokey keeps the key in
|
|
# the repo so only the passphrase is needed to recover). Other modes:
|
|
# repokey-blake2 (default), keyfile-blake2 (key stored under ~/.config/borg).
|
|
BORG_ENCRYPTION="repokey-blake2"
|
|
|
|
# Extra SSH options for ssh:// repositories (e.g. a dedicated key). Passed to
|
|
# borg via BORG_RSH.
|
|
BORG_RSH="ssh -o BatchMode=yes"
|
|
|
|
# Where the one-time key/passphrase backup is written (store a copy off-machine).
|
|
KEY_BACKUP_DIR="/root/apiscp-borg-keys"
|
|
|
|
# --- what to back up ----------------------------------------------------------
|
|
# "all" (default), "none", or a comma-separated list of site ids (site1,site3).
|
|
BACKUP_SITES="all"
|
|
# Back up the shared system paths (1, default) or skip them (0).
|
|
BACKUP_SYSTEM="1"
|
|
# Dump and archive per-site databases via ApisCP's site-context export (1) or
|
|
# skip (0).
|
|
BACKUP_DATABASES="1"
|
|
# Extra absolute paths to back up, comma or space separated (default none).
|
|
BACKUP_PATHS=""
|
|
# Shared system paths and globs (space separated).
|
|
SYSTEM_PATHS="/etc /opt"
|
|
SYSTEM_GLOBS="/var/log/mailer_table* /var/lib/mysql/mysql-grants* /var/lib/pgsql/*/backups /root/apnscp* /root/license*"
|
|
# Comma-separated Borg exclude patterns (globs). The in-site restore staging dir
|
|
# /.borg-restore is always excluded.
|
|
BACKUP_EXCLUDES=""
|
|
|
|
# --- retention (borg prune, applied after each run) ---------------------------
|
|
# Blank means "no limit" for that bucket. Applied per site archive prefix.
|
|
RETENTION_KEEP_WITHIN=""
|
|
RETENTION_KEEP_DAILY=""
|
|
RETENTION_KEEP_WEEKLY=""
|
|
RETENTION_KEEP_MONTHLY=""
|
|
RETENTION_KEEP_ANNUAL=""
|
|
|
|
# --- schedule -----------------------------------------------------------------
|
|
# HH:MM for a daily run, or a full systemd OnCalendar expression. Managed via
|
|
# the panel or borg-apiscp-repo set-schedule (writes a timer drop-in).
|
|
BACKUP_SCHEDULE="03:30"
|
|
|
|
# --- notifications ------------------------------------------------------------
|
|
# Email a report of each run. NOTIFY_EMAIL empty disables it. NOTIFY_ON is
|
|
# "failure" (default), "always", or "never". NOTIFY_FROM overrides the sender.
|
|
NOTIFY_EMAIL=""
|
|
NOTIFY_ON="failure"
|
|
NOTIFY_FROM=""
|
|
|
|
# --- engine internals ---------------------------------------------------------
|
|
VIRTBASE="/home/virtual"
|
|
STAGE="/var/lib/apiscp-borg"
|
|
METRICS_DIR=""
|
|
RUN_DB_EXPORT="1"
|
|
APNSCP_CMD="/usr/local/apnscp/bin/cmd"
|
|
# Optionally also capture ACL/xattr text sidecars (Borg already preserves them
|
|
# natively, so this is off by default).
|
|
CAPTURE_META_SIDECAR="0"
|