This commit is contained in:
parent
c0542212c4
commit
7ba85c2812
@ -38,71 +38,65 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
### 1. Préparer les partitions ZFS
|
||||
|
||||
??? example "Installer ZFS et créer les datasets"
|
||||
```{ .bash .copy }
|
||||
# Installer ZFS
|
||||
sudo apt install zfsutils-linux
|
||||
|
||||
```bash
|
||||
# Installer ZFS
|
||||
sudo apt install zfsutils-linux
|
||||
# Créer un pool sur disque dédié (ou en miroir)
|
||||
sudo zpool create tank /dev/sdb
|
||||
# sudo zpool create tank mirror /dev/sdb /dev/sdc
|
||||
|
||||
# Créer un pool sur disque dédié (ou en miroir)
|
||||
sudo zpool create tank /dev/sdb
|
||||
# sudo zpool create tank mirror /dev/sdb /dev/sdc
|
||||
# Créer les datasets
|
||||
sudo zfs create tank/www
|
||||
sudo zfs create tank/mysql
|
||||
sudo zfs create tank/data
|
||||
|
||||
# Créer les datasets
|
||||
sudo zfs create tank/www
|
||||
sudo zfs create tank/mysql
|
||||
sudo zfs create tank/data
|
||||
# Déf{ .ini .copy }r les points de montage
|
||||
sudo zfs set mountpoint=/var/www tank/www
|
||||
sudo zfs set mountpoint=/var/lib/mysql tank/mysql
|
||||
|
||||
# Définir les points de montage
|
||||
sudo zfs set mountpoint=/var/www tank/www
|
||||
sudo zfs set mountpoint=/var/lib/mysql tank/mysql
|
||||
|
||||
# Rendre les snapshots accessibles à Vykar
|
||||
sudo zfs set snapdir=visible tank/www
|
||||
sudo zfs set snapdir=visible tank/mysql
|
||||
sudo zfs set snapdir=visible tank/data
|
||||
```
|
||||
# Rendre les snapshots accessibles à Vykar
|
||||
sudo zfs set snapdir=visible tank/www
|
||||
sudo zfs set snapdir=visible tank/mysql
|
||||
sudo zfs set snapdir=visible tank/data
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 2. Installer vykar-server
|
||||
|
||||
??? example "Télécharger et installer le binaire"
|
||||
```{ .bash .copy }
|
||||
# Télécharger le binaire (adapter la version)
|
||||
wget https://github.com/borgbase/vykar/releases/download/v0.12.1/vykar-v0.12.1-x86_64-unknown-linux-gnu.tar.gz
|
||||
tar xzf vykar-v0.12.1-x86_64-unknown-linux-gnu.tar.gz
|
||||
sudo mv vykar-server /usr/local/bin/
|
||||
|
||||
```bash
|
||||
# Télécharger le binaire (adapter la version)
|
||||
wget https://github.com/borgbase/vykar/releases/download/v0.12.1/vykar-v0.12.1-x86_64-unknown-linux-gnu.tar.gz
|
||||
tar xzf vykar-v0.12.1-x86_64-unknown-linux-gnu.tar.gz
|
||||
sudo mv vykar-server /usr/local/bin/
|
||||
|
||||
# Créer l'utilisateur dédié
|
||||
sudo useradd -r -s /usr/sbin/nologin -d /var/lib/vykar vykar
|
||||
sudo mkdir -p /var/lib/vykar
|
||||
sudo chown vykar:vykar /var/lib/vykar
|
||||
```
|
||||
# Créer l'utilisateur dédié
|
||||
sudo useradd -r -s /usr/sbin/nologin -d /var/lib/vykar vykar
|
||||
sudo mkdir -p /var/lib/vykar
|
||||
sudo chown vykar:vykar /var/lib/vykar
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 3. Configurer les tokens et répertoires
|
||||
|
||||
??? example "Créer la structure et générer les tokens par serveur"
|
||||
```{ .bash .copy }
|
||||
# Créer les répertoires par serveur
|
||||
sudo mkdir -p /var/lib/vykar/serveur-prod-1
|
||||
sudo mkdir -p /var/lib/vykar/serveur-prod-2
|
||||
sudo mkdir -p /var/lib/vykar/serveur-staging
|
||||
sudo chown -R vykar:vykar /var/lib/vykar/
|
||||
|
||||
```bash
|
||||
# Créer les répertoires par serveur
|
||||
sudo mkdir -p /var/lib/vykar/serveur-prod-1
|
||||
sudo mkdir -p /var/lib/vykar/serveur-prod-2
|
||||
sudo mkdir -p /var/lib/vykar/serveur-staging
|
||||
sudo chown -R vykar:vykar /var/lib/vykar/
|
||||
|
||||
# Générer un token unique par serveur
|
||||
openssl rand -hex 32 # → token serveur-prod-1
|
||||
openssl rand -hex 32 # → token serveur-prod-2
|
||||
openssl rand -hex 32 # → token serveur-staging
|
||||
```
|
||||
# Générer un token unique par serveur
|
||||
openssl rand -hex 32 # → token serveur-prod-1
|
||||
openssl rand -hex 32 # → token serveur-prod-2
|
||||
openssl rand -hex 32 # → token serveur-staging
|
||||
```
|
||||
|
||||
??? example "Fichiers d'environnement — `/etc/vykar/*.env`"
|
||||
|
||||
```bash
|
||||
```{ .bash .copy }
|
||||
# /etc/vykar/serveur-prod-1.env
|
||||
sudo tee /etc/vykar/serveur-prod-1.env << 'EOF'
|
||||
VYKAR_TOKEN=token-prod-1-xxxxxxxxxxxxxxxx
|
||||
@ -134,7 +128,7 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
??? example "Template systemd — `/etc/systemd/system/vykar-server@.service`"
|
||||
|
||||
```ini
|
||||
```{ .ini .copy }
|
||||
sudo tee /etc/systemd/system/vykar-server@.service << 'EOF'
|
||||
[Unit]
|
||||
Description=Vykar backup server - %i
|
||||
@ -162,72 +156,68 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
EOF
|
||||
```
|
||||
|
||||
??? example "Activer les instances"
|
||||
|
||||
```bash
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable --now vykar-server@serveur-prod-1
|
||||
sudo systemctl enable --now vykar-server@serveur-prod-2
|
||||
sudo systemctl enable --now vykar-server@serveur-staging
|
||||
```
|
||||
```{ .bash .copy }
|
||||
sudo systemctl daemon-reload
|
||||
sudo systemctl enable --now vykar-server@serveur-prod-1
|
||||
sudo systemctl enable --now vykar-server@serveur-prod-2
|
||||
sudo systemctl enable --now vykar-server@serveur-staging
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 5. Reverse proxy TLS
|
||||
|
||||
??? example "Configuration Nginx — `/etc/nginx/sites-available/vykar`"
|
||||
```{ .conf .copy }
|
||||
# Serveur prod-1
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name backup-prod-1.example.com;
|
||||
|
||||
```nginx
|
||||
# Serveur prod-1
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name backup-prod-1.example.com;
|
||||
ssl_certificate /etc/letsencrypt/live/backup-prod-1.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/backup-prod-1.example.com/privkey.pem;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/backup-prod-1.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/backup-prod-1.example.com/privkey.pem;
|
||||
client_max_body_size 600m;
|
||||
proxy_request_buffering off;
|
||||
proxy_read_timeout 300s;
|
||||
|
||||
client_max_body_size 600m;
|
||||
proxy_request_buffering off;
|
||||
proxy_read_timeout 300s;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8585;
|
||||
}
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8585;
|
||||
}
|
||||
}
|
||||
|
||||
# Serveur prod-2
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name backup-prod-2.example.com;
|
||||
# Serveur prod-2
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name backup-prod-2.example.com;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/backup-prod-2.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/backup-prod-2.example.com/privkey.pem;
|
||||
ssl_certificate /etc/letsencrypt/live/backup-prod-2.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/backup-prod-2.example.com/privkey.pem;
|
||||
|
||||
client_max_body_size 600m;
|
||||
proxy_request_buffering off;
|
||||
proxy_read_timeout 300s;
|
||||
client_max_body_size 600m;
|
||||
proxy_request_buffering off;
|
||||
proxy_read_timeout 300s;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8586;
|
||||
}
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8586;
|
||||
}
|
||||
}
|
||||
|
||||
# Serveur staging
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name backup-staging.example.com;
|
||||
# Serveur staging
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name backup-staging.example.com;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/backup-staging.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/backup-staging.example.com/privkey.pem;
|
||||
ssl_certificate /etc/letsencrypt/live/backup-staging.example.com/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/backup-staging.example.com/privkey.pem;
|
||||
|
||||
client_max_body_size 600m;
|
||||
proxy_request_buffering off;
|
||||
client_max_body_size 600m;
|
||||
proxy_request_buffering off;
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8587;
|
||||
}
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8587;
|
||||
}
|
||||
```
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
@ -235,16 +225,14 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
### 1. Installer Vykar
|
||||
|
||||
??? example "Télécharger et installer le client"
|
||||
```{ .bash .copy }
|
||||
wget https://github.com/borgbase/vykar/releases/download/v0.12.1/vykar-v0.12.1-x86_64-unknown-linux-gnu.tar.gz
|
||||
tar xzf vykar-v0.12.1-x86_64-unknown-linux-gnu.tar.gz
|
||||
sudo mv vykar /usr/local/bin/
|
||||
|
||||
```bash
|
||||
wget https://github.com/borgbase/vykar/releases/download/v0.12.1/vykar-v0.12.1-x86_64-unknown-linux-gnu.tar.gz
|
||||
tar xzf vykar-v0.12.1-x86_64-unknown-linux-gnu.tar.gz
|
||||
sudo mv vykar /usr/local/bin/
|
||||
|
||||
# Permissions de lecture sans root complet (optionnel)
|
||||
sudo setcap cap_dac_read_search+ep /usr/local/bin/vykar
|
||||
```
|
||||
# Permissions de lecture sans root complet (optionnel)
|
||||
sudo setcap cap_dac_read_search+ep /usr/local/bin/vykar
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
@ -252,7 +240,7 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
??? example "Fichier de configuration — `/etc/vykar/vykar.yaml`"
|
||||
|
||||
```yaml
|
||||
```{ .yaml .copy }
|
||||
repositories:
|
||||
- label: "backup-principal"
|
||||
url: "https://backup.example.com"
|
||||
@ -338,18 +326,16 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
### 3. Initialisation et premier backup
|
||||
|
||||
??? example "Initialiser le dépôt et lancer le premier backup"
|
||||
```{ .bash .copy }
|
||||
# Initialiser le dépôt distant (une seule fois)
|
||||
vykar { .ini .copy }t --config /etc/vykar/vykar.yaml
|
||||
|
||||
```bash
|
||||
# Initialiser le dépôt distant (une seule fois)
|
||||
vykar init --config /etc/vykar/vykar.yaml
|
||||
# Tester le premier backup manuellement
|
||||
vykar backup --config /etc/vykar/vykar.yaml
|
||||
|
||||
# Tester le premier backup manuellement
|
||||
vykar backup --config /etc/vykar/vykar.yaml
|
||||
|
||||
# Vérifier les snapshots créés
|
||||
vykar list --config /etc/vykar/vykar.yaml
|
||||
```
|
||||
# Vérifier les snapshots créés
|
||||
vykar list --config /etc/vykar/vykar.yaml
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
@ -357,7 +343,7 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
??? example "Service — `/etc/systemd/system/vykar-backup.service`"
|
||||
|
||||
```ini
|
||||
```{ .ini .copy }
|
||||
[Unit]
|
||||
Description=Vykar Backup
|
||||
After=network-online.target
|
||||
@ -372,7 +358,7 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
??? example "Timer — `/etc/systemd/system/vykar-backup.timer`"
|
||||
|
||||
```ini
|
||||
```{ .ini .copy }
|
||||
[Unit]
|
||||
Description=Vykar Backup quotidien
|
||||
|
||||
@ -386,7 +372,7 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
??? example "Activer le timer"
|
||||
|
||||
```bash
|
||||
```{. bash .copy }
|
||||
sudo systemctl enable --now vykar-backup.timer
|
||||
|
||||
# Vérifier le timer
|
||||
@ -397,48 +383,48 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
## Commandes utiles
|
||||
|
||||
??? tip "Lister et inspecter les snapshots"
|
||||
- tip "Lister et inspecter les snapshots
|
||||
|
||||
```bash
|
||||
# Lister les snapshots
|
||||
vykar list
|
||||
```{ .bash .copy }
|
||||
# Lister les snapshots
|
||||
vykar list
|
||||
|
||||
# Inspecter le contenu d'un snapshot
|
||||
vykar snapshot list latest
|
||||
vykar snapshot list a1b2c3d4
|
||||
# Inspecter le contenu d'un snapshot
|
||||
vykar snapshot list latest
|
||||
vykar snapshot list a1b2c3d4
|
||||
|
||||
# Chercher un fichier dans les 7 derniers jours
|
||||
vykar snapshot find --name '*.conf' --since 7d
|
||||
```
|
||||
# Chercher un fichier dans les 7 derniers jours
|
||||
vykar snapshot find --name '*.conf' --since 7d
|
||||
```
|
||||
|
||||
??? tip "Restaurer et monter"
|
||||
- Restaurer et monter
|
||||
|
||||
```bash
|
||||
# Restaurer le dernier snapshot
|
||||
vykar restore latest /tmp/restauration
|
||||
```{ .bash .copy }
|
||||
# Restaurer le dernier snapshot
|
||||
vykar restore latest /tmp/restauration
|
||||
|
||||
# Restaurer un snapshot précis
|
||||
vykar restore a1b2c3d4 /tmp/restauration
|
||||
# Restaurer un snapshot précis
|
||||
vykar restore a1b2c3d4 /tmp/restauration
|
||||
|
||||
# Monter un snapshot en lecture seule (WebDAV)
|
||||
vykar mount latest /mnt/snapshot
|
||||
umount /mnt/snapshot
|
||||
```
|
||||
# Monter un snapshot en lecture seule (WebDAV)
|
||||
vykar mount latest /mnt/snapshot
|
||||
umount /mnt/snapshot
|
||||
```
|
||||
|
||||
??? tip "Vérifier l'intégrité et libérer de l'espace"
|
||||
- Vérifier l'intégrité et libérer de l'espace
|
||||
|
||||
```bash
|
||||
# Vérifier l'intégrité du dépôt
|
||||
vykar check
|
||||
vykar check --verify-data # plus complet, plus long
|
||||
```{ .bash .copy }
|
||||
# Vérifier l'intégrité du dépôt
|
||||
vykar check
|
||||
vykar check --verify-data # plus complet, plus long
|
||||
|
||||
# Libérer l'espace manuellement
|
||||
vykar prune
|
||||
vykar compact
|
||||
# Libérer l'espace manuellement
|
||||
vykar prune
|
||||
vykar compact
|
||||
|
||||
# Santé du serveur REST
|
||||
curl https://backup.example.com/health
|
||||
```
|
||||
# Santé du serveur REST
|
||||
curl https://backup.example.com/health
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
@ -456,7 +442,7 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
## Annexes
|
||||
|
||||
??? example "Stack applicative à sauvegarder — `docker-compose.yml`"
|
||||
??? example "Stack applicative à sauvegarder — `compose.yml`"
|
||||
|
||||
```yaml
|
||||
services:
|
||||
@ -546,7 +532,7 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
??? example "Configuration msmtp — `/etc/msmtprc`"
|
||||
|
||||
```bash
|
||||
```{. bash .copy }
|
||||
# Installer msmtp
|
||||
sudo apt install msmtp msmtp-mta
|
||||
|
||||
@ -576,7 +562,7 @@ Sauvegarde chiffrée, dédupliquée et basée sur des snapshots ZFS vers un serv
|
||||
|
||||
??? example "Restauration des données"
|
||||
|
||||
```bash
|
||||
```{. bash .copy }
|
||||
# PostgreSQL
|
||||
vykar restore latest /tmp/restauration
|
||||
docker exec -i mon-postgres \
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user
