geerlingguy / ansible-role-backup Goto Github PK

View Code? Open in Web Editor NEW

147.0 9.0 50.0 42 KB

Ansible Role - Backup for simple servers

Home Page: https://galaxy.ansible.com/geerlingguy/backup/

License: MIT License

Shell 94.19% Jinja 5.81%

backup ansible role server linux disaster-recovery ubuntu redhat centos debian data

ansible-role-backup's Introduction

Ansible Role: Backup for Simple Servers

Back up Linux servers with a simple Rsync-and-Cron-based solution.

Requirements

Requires the following to be installed:

rsync
cron

MySQL or a MySQL-compatible database needs to be installed if you'd like to enable MySQL database backups.

It's also assumed you have a server running somewhere that can accept backup data via Rsync, and on this backup server, you need to install rsync, and configure accounts with SSH authentication that allows this role to deliver backups to a specific directory via SSH.

Role Variables

Available variables are listed below, along with default values (see defaults/main.yml):

backup_cron_job_state: present
backup_hour: "3"
backup_minute: "00"

Controls whether the backup script is called via a managed cron job. You should stagger backup times among servers so your backup server doesn't get a huge influx of data at once.

backup_user: "{{ ansible_env.SUDO_USER | default(ansible_env.USER, true) | default(ansible_user_id, true) }}"

User under which backup jobs will run.

backup_path: /home/{{ backup_user }}/backups

Path to where backups configuration will be stored. Generally speaking, you should use a special backup user account, but you can set this to whatever account has the proper access to the directories you need to back up.

backup_directories:
  - /home/{{ backup_user }}/domains
  - /home/{{ backup_user }}/repositories

Directories to back up. {{ backup_user }} must have read access to these dirs. Each directory will be synchronized to the backup server via a separate rsync command in the backup script.

backup_exclude_items:
  - .DS_Store
  - cache
  - tmp

Items to exclude from backups. Each item will be added as a new line in an excludes file used by the backup rsync command. Read this article for an explanation of how the --exclude option works.

backup_identifier: id_here
backup_remote_connection: [email protected]

Options to control where the backup is delivered. It's assumed you'll be routing backups to a backup server via SSH. SSH key management and authentication should be managed separately from this role.

backup_remote_base_path: "~/backups"

The full path on the remote backup server where backups will be stored (all backups for each server are inside a directory named by the backup_identifier).

backup_remote_host_name: ''
backup_remote_host_key: ''

Add the remote host key details to ensure the host key is present and there are no SSH connection errors based on the key authentication. Leave blank if you've disabled host key checking or if the host key is already added to the server via some other mechanism.

backup_remote_connection_ssh_options: ''

Add SSH connection options (e.g. -p [port]), as documented in the SSH command manual.

backup_mysql: false
backup_mysql_user: dbdump
backup_mysql_password: password
backup_mysql_credential_file: ''

Options for backing up MySQL (or MySQL-compatible) databases. Note the ansible_ssh_user used when running this role must be able to add MySQL users for this functionality to be managed by this role. Instead of creating a new MySQL user account you can provide an existing one using backup_mysql_credential_file an option file as documented in the End-User Guidelines for Password Security.

Dependencies

None.

Example Playbook

- hosts: servers

  vars:
    backup_identifier: "{{ inventory_hostname|replace('.', '') }}"
    backup_user: "backupuser"
    backup_remote_connection: [email protected]
    backup_hour: "1"
    backup_minute: "15"
    backup_mysql: false
    backup_directories:
      - /etc/myapp
      - /var/myapp/data
      - /home/myuser

  roles:
    - geerlingguy.backup

License

MIT / BSD

Author Information

This role was created in 2017 by Jeff Geerling, author of Ansible for DevOps.

ansible-role-backup's People

Contributors

Stargazers

Watchers

ansible-role-backup's Issues

Add backup server hostkey to known_hosts

Basically:

- name: Get hostkey for backup server.
  set_fact:
    backup_hostkey: "{{ lookup('pipe', 'ssh-keyscan -t rsa backup.example.com') }}"

- name: Add backup server to known hosts.
  known_hosts:
    name: backup.example.com
    state: present
    key: "{{ backup_hostkey }}"
  become: yes
  become_user: "{{ backup_user }}"

Allow additions to known_hosts file

It would be convenient if you could pass in one or more entries to be added to the server's known_hosts file; that way, the server could be assured that the first run of the backup.sh script doesn't get stalled waiting for someone to accept the remote host key (and it would be more secure to provide a known-good host key anyways!).

See Ansible's known_hosts module.

CI failing with 'nothing provides sshpass needed by ansible-2.9.27-1.el8.noarch'

fatal: [instance]: FAILED! => {"changed": false, "failures": [], "msg": "Depsolve Error occurred: \n Problem: conflicting requests\n  - nothing provides sshpass needed by ansible-2.9.27-1.el8.noarch", "rc": 1, "results": []}

See: https://github.com/geerlingguy/ansible-role-backup/runs/6438618874?check_suite_focus=true#step:5:281

Document variables and typical use case in README

For the past few years, I've used a private role very much like this one, and have a pretty standard set of variables I override per type of server/app... so I should document a typical use case and also all the default variables.

2 small issues with the backup.sh.2 template

First of all thanks for this role. I found that there are 2 issues with it though.

There's a whitespace after the = which causes the script to fail
The script doesn't create the database directory in the backup_path

I'll do a pull request fixing these. Perhaps you can merge it.

Thanks

Test runs failing with latest ansible - 'ansible_ssh_user' is undefined

Getting this in tests now:

{{ ansible_ssh_user }}: 'ansible_ssh_user' is undefined

Need to fix.

encryption of backup files

Would you be open to add encryption to the created backup archives, e.g.
$MYSQLDUMP $MYSQL_CREDENTIALS --single-transaction --quick --lock-tables=false $DB | gzip -f -6 | gpg --batch --no-use-agent --passphrase "{{ backup_passphrase }}" --symmetric --cipher-algo AES256 -o {{ backup_path }}/databases/$DB.sql.gz - 2>&1 | tee -a {{ backup_path }}
If so, would gpg the way to follow?

rsync seems to only keep the last synchronised folder

Hi,

I set the role with two folders to be synchronised through backup_directories. Checking the script outcome, I see that only the second folder's content is present in the target machine.
By fiddling the script, just deleting the --delete flag, the expected outcome (i.e. the content of both folders) is achieved.

Is this a bug?

Latest version of the role, rsync version 3.1.1 protocol version 31 on the sending machine.

Thank you,
Fabrizio

error message in tasks/main.yml

    backup_remote_host_name: '192.168.1.2'
    backup_remote_host_key: ['-----BEGIN RSA PRIVATE KEY-----
somekey
-----END RSA PRIVATE KEY-----']

When trying to run, it spits out the following error message, even without backup_remote_host_key it spits out this error:

fatal: [localhost]: FAILED! => {"msg": "The conditional check 'backup_remote_host_name' failed. The error was: error while evaluating conditional (backup_remote_host_name): float object has no element 1\n\nThe error appears to be in '/home/robert/.ansible/roles/geerlingguy.backup/tasks/main.yml': line 35, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Add backup remote host key to server.\n ^ here\n"}

Problem with Variables and backup_mysql_password in shell script

Hi Jeff,

i found an issue in the mysql backup shell script.
The variable $MYSQL_CREDENTIALS contains the mysql user and password. The password is written into the variable with quotation marks. I think this is a problem when the Variable call in a Commandline.

DATABASES=`$MYSQL $MYSQL_CREDENTIALS -e "SHOW DATABASES;" | grep -Ev '(Database|information_schema|performance_schema|mysql)'

The password can then not be interpreted.

That Comman line works for me.

$MYSQLDUMP {% if backup_mysql_credential_file != '' %} --defaults-extra-file={{ backup_mysql_credential_file }} {% else %} -u {{ backup_mysql_user }} -p'{{ backup_mysql_password }}' {% endif %} --single-transaction --quick --lock-tables=false {{backup_database_name}} | gzip -f -6 > {{ backup_path }}/databases/{{backup_database_name}}_$TIMESTAMP.sql.gz

By the way. I have expand the shell script with a little file versioning. Files that older 10 days will be delete:-)

find {{ backup_path }}/databases -mtime +10 -type f -delete
$RSYNC -aqz -e 'ssh {{ backup_remote_connection_ssh_options }}' {{ backup_path }}/databases $REMOTE:{{ backup_remote_base_path }}/{{ backup_identifier }} --delete

Beste Regards
Manuel

P.S. The Role is very usefull. Thank you!