diff --git a/docs/backups.md b/docs/backups.md index 01ef57d6..bd418d58 100644 --- a/docs/backups.md +++ b/docs/backups.md @@ -12,7 +12,7 @@ The URL format for the primary one is while for the offsite one it's - ssh://@prio.ch-s012.rsync.net:22/~/backup/ + ssh://@zh1905.rsync.net:22/~/backup/ In the examples below, we'll just abbreviate the full address as ``. If you want to use one of the examples below, you'll have to fill in the diff --git a/docs/ssh-hostkeys.txt b/docs/ssh-hostkeys.txt index 10d4570b..955aef68 100644 --- a/docs/ssh-hostkeys.txt +++ b/docs/ssh-hostkeys.txt @@ -174,6 +174,17 @@ 256 MD5:dd:20:c1:f1:f2:fa:70:86:3a:e2:39:86:b1:01:2f:61 root@archlinux-packer (ED25519) 3072 MD5:b6:14:30:bd:fe:43:46:6a:20:a2:8b:b0:aa:d4:35:19 root@archlinux-packer (RSA) +# mailman3.archlinux.org +1024 SHA256:uYhlq19YzcZ8PEModMv2Y65xsiq1H+mjdwZ8PtbPET8 root@archlinux-packer (DSA) +256 SHA256:85YiWFreKiw2Pv/XaKTqs0J0VInFtyVahpDRx2O9/B4 root@archlinux-packer (ECDSA) +256 SHA256:b0mcOvNMzGrekDDtx83ZB1p5kN0meFek7zz1LbkfeHM root@archlinux-packer (ED25519) +3072 SHA256:5hC4XSzA+/CgpL6cLYt0UbHB4aUs/o0IPxSScZwoi4A root@archlinux-packer (RSA) + +1024 MD5:3b:20:ad:1e:65:d8:3a:2e:09:69:62:46:e6:d9:6a:3e root@archlinux-packer (DSA) +256 MD5:8d:ee:10:9b:05:56:b3:c7:4a:de:00:ad:95:c1:95:fa root@archlinux-packer (ECDSA) +256 MD5:25:a8:b9:3c:fe:74:e7:7f:39:03:8e:23:dc:20:eb:bf root@archlinux-packer (ED25519) +3072 MD5:20:a0:74:13:bd:97:59:11:75:a4:67:28:92:c3:40:35 root@archlinux-packer (RSA) + # man.archlinux.org 1024 SHA256:11C7Qa1GSNBBspSlber3Sp+LEMRpfr/VWkypfu6OnhA root@archlinux-packer (DSA) 256 SHA256:fL79NVaEiwXGfUhTXWLkue/D1seSADYbui+jwQ2dvW0 root@archlinux-packer (ECDSA) diff --git a/docs/ssh-known_hosts.txt b/docs/ssh-known_hosts.txt index 07691a65..373e8353 100644 --- a/docs/ssh-known_hosts.txt +++ b/docs/ssh-known_hosts.txt @@ -78,6 +78,11 @@ mail.archlinux.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzd mail.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICTOoGxsf23f6AjIHcQQuvbTOaeIt48Y0PiBj9qlJi1H mail.archlinux.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPrURadxte8UJiteGa6+Q+OjTAjhvGAQFkNSXj1pr4k03uxkU6l2v2LuTygk+4SZSCyUsKvNx/ljJeHBnuecQ8rRv19ZFqy/GQKB3oEmiNYMo2dYYlJWwTVBHatmghhB1j2y40yqdKWH2xQuXC3HtnS7fHG0g1Rc4R9KB4MQlcXkwnSEMpwpWBoO7sr0M4YTdwE+nSG9aNfyPbPGp3mX4ATz5X5hPJOlSFVDV6NuKrA+5qyt4jSKdeG5IuWeEnEJesYJEvShYdY9DvMCXnZykB0emzzk+5+Cp2lTPf9LOO3wNsTgHV/CwkoAoMgr9+ASefhBr3nxmmrs9T7nwuobGCGFUqQ2D8IKCmsWGVKXYERViz3x/gYUIlHgVJpoIXCFFqbdpWwxKR1aDMug2fFe699/FzuPdqrWPFdQMF2mPQ0w3AH/62KGp+PULE2HxrlCiY/gF2m8iJLgunxVKmi/c0ufgK9QilnKcPO+W4tcISa5MYt7MSTTLV9eVsgVjGhOU= +# mailman3.archlinux.org +mailman3.archlinux.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFIHctq5/hKXaU//Jkzifp71ePIzcxdlxE5SZz1e7AcNp0Cci9W8A8NPtP6DMUvv4ezdKp+A/Czcy49tQolI30s= +mailman3.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0FZBrH2DQQoGn85t+2PN8t8FmUst9PsEsmGekfFAc+ +mailman3.archlinux.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCqZnMXg8rPkeKh3w9U/rNMc9NXjLu5K7Azfs0o/rIm3Hm2thLJH4i6hVGpSIfCw77WzoW0kotAEMkX3WaO/MXqp7qWiEv5Xy/Y9p2YNYdCdkhDdDhmuHSlYT+acnSHVPSjdN3SaaxXoN1/GAb5jlRMItZncind3gU0G6Kpls6N9tHsbjNqOG9Yv6hAlYfyVn4Q20H1ABLCJSUgWNOXq5DrqOLddblajbg4gQ8u6tYSpKDkPyEA8vmOueoTcwzB7k+aZRJmR9CVh5tsYc6QyBlljkFY8xhwLxVRMAe7dPND7LsTbfO20zVlZ94rPkTN46lb9ekrVwlzLlFd0nnJ2iWFiBU9HKelsxj5r8OorZfRkpXa8QVW04smQxycgHutEmsDGob5OFYkAPrdbuE0vA8KOk02D8NWhFHcG2nR/zMohNEJQsoTIHx7xeagFrC4Xgn7M+nhCVIIpbAOkRFjHAr4j2fGHjLzxV3EPkLN08aIcK53uHZTo2YSHL+JoU936o8= + # man.archlinux.org man.archlinux.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPhnsStoFw6rbVpE1S1vsXNk8de1SyMag1C+v0DWVSuNYzTylYg4322WbYzw45z2XhxrF6XmCSDMvgxvFwnfLQA= man.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHzjkN+igIxSIv5N9+ANNoo6knPa51Tj5TAXs4EQ8lY2 @@ -168,11 +173,9 @@ wiki.archlinux.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzd wiki.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFxxvRi7khrt6mUQGiXX35O1MBrrDeEmvaAnWo9ql/7 wiki.archlinux.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZQmj2D2B66bBHzze7+LEITju0rmtJT2rYsV/1GGpEPg6q6GAkUnIgRpyYxRn+UKRO9akDFXLv7W02h86cfbxOjeHufGMy/Y7NCPl2OSP9VauavJ3c3v/n80nmntU/Ji/U/p/roP0z+/OPgdWymFm0n33cl+XhmNOUumYQ7Y3z7EzrvCFZo2gt1EYChXb5Pd32rkd9tiwr3O0/M7TEiUxODzoD1dum+TJafUttC20V/4Sj8HztPx2BzhRugXfeEDbVlYvMXMMYgxbbhXLZyuE/dCaYpRvuekouAob7voIRSUaNqFXBLcGgo0udRI0mnKLgTb5bMprrRZ1zXIBU77H3gWyfHqe2I20arhXivtsHLEOZi0hc2/ni15WqkNS8G23n/+hJ+H16bjVb6t+8opErY4mL8T+F6OkxmNo8d0ztwUdxHEa+fvNPQ8UO6W4CN6kNVB9JE4f8j9FeHQq8rtlzo0wjUof4D7PhDn2WYA1l9RDiuRUxlGS4waStmttM3dE= -# prio.ch-s012.rsync.net -prio.ch-s012.rsync.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO5lfML3qjBiDXi4yh3xPoXPHqIOeLNp66P3Unrl+8g3 - +# zh1905.rsync.net +zh1905.rsync.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtclizeBy1Uo3D86HpgD3LONGVH0CJ0NT+YfZlldAJd # u236610.your-storagebox.de [u236610.your-storagebox.de]:23,[2a01:4f8:b16:3000::68]:23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs - diff --git a/group_vars/all/vault_rsync.net.yml b/group_vars/all/vault_rsync.net.yml index b83cdb88..8281603f 100644 --- a/group_vars/all/vault_rsync.net.yml +++ b/group_vars/all/vault_rsync.net.yml @@ -1,10 +1,13 @@ $ANSIBLE_VAULT;1.1;AES256 -35646362653234383130323436333666656264303737633935336264313539353030376261313636 -3339346461323430653162643938303562666664386235660a333561373038373839653430643666 -35633566393330346136646664343065663039386135363461646136303435313430333561313833 -3630313034303638640a646364373062326464653937313430393332643335633166666663376630 -65383530363163303064336235633831353666323536376636616530363539346261333435326635 -38663061643961633536633165646534613933383336393463393233323339306139653462653566 -33653632633733633432393538356461663963366638653937636237616564326365336464343665 -35313237333636646538353665393437373536383161623833653638356133356131376165653238 -3332 +61636661646538643333653838373262333039643437666165333332663337373733363135333639 +6233383866323934306362373036363836623432353363380a393039626130633562646165636635 +63616463616233313135336430343961656333613530633161313365613434306361316564666535 +3361353438326434330a613361633764393833383364303664646535346462386437333437393263 +34633734313762376564386364636131313233376165626533396332303665323131616339383432 +61306439363730356337363266646662333437376133636434313365373839636263326264343439 +39626433376462623532663632336234646339623237366133623230613430356435323030326138 +34643861396563346230626332313835616337346536373463393432316430656464396534393233 +34656634386337356565333634346664323339643466313337333030623939616364626433353834 +38383739646433633666633936393234633038376535366137346363383830396266316164313765 +34633839343734383533393165613234383635633062356166633038396635336332363832363063 +63626666656332646438 diff --git a/host_vars/prio.ch-s012.rsync.net b/host_vars/prio.ch-s012.rsync.net deleted file mode 100644 index 8d1a689e..00000000 --- a/host_vars/prio.ch-s012.rsync.net +++ /dev/null @@ -1,3 +0,0 @@ ---- -ansible_ssh_user: "{{ rsync_net_username }}" -known_host: "prio.ch-s012.rsync.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO5lfML3qjBiDXi4yh3xPoXPHqIOeLNp66P3Unrl+8g3" diff --git a/host_vars/zh1905.rsync.net b/host_vars/zh1905.rsync.net new file mode 100644 index 00000000..701b0364 --- /dev/null +++ b/host_vars/zh1905.rsync.net @@ -0,0 +1,3 @@ +--- +ansible_ssh_user: "{{ rsync_net_username }}" +known_host: "zh1905.rsync.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtclizeBy1Uo3D86HpgD3LONGVH0CJ0NT+YfZlldAJd" diff --git a/hosts b/hosts index 8bc6deda..7da796f7 100644 --- a/hosts +++ b/hosts @@ -3,7 +3,7 @@ secure-runner1.archlinux.org gemini.archlinux.org [rsync_net] -prio.ch-s012.rsync.net +zh1905.rsync.net [hetzner_storageboxes] u236610.your-storagebox.de @@ -47,7 +47,7 @@ md.archlinux.org lists.archlinux.org [borg_hosts] -prio.ch-s012.rsync.net +zh1905.rsync.net u236610.your-storagebox.de [public_html] diff --git a/misc/borg.sh b/misc/borg.sh index ce569bf0..7c54c833 100755 --- a/misc/borg.sh +++ b/misc/borg.sh @@ -3,13 +3,19 @@ set -eu shopt -s extglob -OFFSITE_HOST=ch-s012.rsync.net +OFFSITE_HOST=rsync.net ROOT_DIR=$(dirname "${0}")/.. decrypted_gpg=$(mktemp arch-infrastructure-borg-XXXXXXXXX) trap "rm -f \"${decrypted_gpg}\"" EXIT [[ "$*" =~ $OFFSITE_HOST ]] && is_offsite=true || is_offsite=false +# Use borg1 as the borg executable on offsite +remote_path=borg +if $is_offsite; then + remote_path=borg1 +fi + # Find matching key matching_key="" for gpgkey in "$ROOT_DIR"/borg-keys/!(*-offsite.gpg); do @@ -28,6 +34,6 @@ if [[ -z "$matching_key" ]]; then fi gpg --batch --yes --decrypt -aq --output "$decrypted_gpg" "$ROOT_DIR/borg-keys/$matching_key.gpg" -BORG_KEY_FILE="$decrypted_gpg" borg "$@" +BORG_KEY_FILE="$decrypted_gpg" borg --remote-path=$remote_path "$@" rm "$decrypted_gpg" diff --git a/playbooks/rsync.net.yml b/playbooks/rsync.net.yml index 1bedc253..e23e606a 100644 --- a/playbooks/rsync.net.yml +++ b/playbooks/rsync.net.yml @@ -1,7 +1,7 @@ --- - name: setup rsync.net account - hosts: prio.ch-s012.rsync.net + hosts: zh1905.rsync.net gather_facts: false roles: - { role: rsync_net, backup_dir: "backup", backup_clients: "{{ groups['borg_clients'] }}", tags: ["borg"] } diff --git a/playbooks/tasks/sync-ssh-hostkeys.yml b/playbooks/tasks/sync-ssh-hostkeys.yml index 32f4c059..1a143fab 100644 --- a/playbooks/tasks/sync-ssh-hostkeys.yml +++ b/playbooks/tasks/sync-ssh-hostkeys.yml @@ -34,12 +34,12 @@ - name: manually append rsync.net host keys lineinfile: path: "{{ playbook_dir }}/../../docs/ssh-known_hosts.txt" - line: "{% for host in query('inventory_hostnames', 'rsync_net') | sort %}# {{ host }}\n{{ hostvars[host].known_host }}\n\n{% endfor %}" + line: "{% for host in query('inventory_hostnames', 'rsync_net') | sort %}# {{ host }}\n{{ hostvars[host].known_host }}\n{% endfor %}" delegate_to: localhost - name: manually append Hetzner Storageboxes host keys lineinfile: path: "{{ playbook_dir }}/../../docs/ssh-known_hosts.txt" - line: "{% for host in query('inventory_hostnames', 'hetzner_storageboxes') | sort %}# {{ host }}\n{{ hostvars[host].known_host }}\n\n{% endfor %}" + line: "{% for host in query('inventory_hostnames', 'hetzner_storageboxes') | sort %}# {{ host }}\n{{ hostvars[host].known_host }}\n{% endfor %}" delegate_to: localhost - name: upload known_hosts to all nodes diff --git a/roles/borg_client/defaults/main.yml b/roles/borg_client/defaults/main.yml index cbd80fa4..b4b29e40 100644 --- a/roles/borg_client/defaults/main.yml +++ b/roles/borg_client/defaults/main.yml @@ -3,6 +3,8 @@ backup_hosts: - host: "ssh://u236610.your-storagebox.de:23" dir: "~/repo" suffix: "" - - host: "ssh://{{ rsync_net_username }}@prio.ch-s012.rsync.net:22" + borg_cmd: "borg" + - host: "ssh://{{ rsync_net_username }}@zh1905.rsync.net:22" dir: "~/backup/{{ inventory_hostname }}" suffix: "-offsite" + borg_cmd: "borg --remote-path=borg1" diff --git a/roles/borg_client/tasks/main.yml b/roles/borg_client/tasks/main.yml index f356207d..26ff147b 100644 --- a/roles/borg_client/tasks/main.yml +++ b/roles/borg_client/tasks/main.yml @@ -3,7 +3,7 @@ pacman: name=borg state=present - name: check if borg repository already exists - command: borg list {{ item['host'] }}/{{ item['dir'] }} + command: "{{ item['borg_cmd'] }} list {{ item['host'] }}/{{ item['dir'] }}" environment: BORG_RELOCATED_REPO_ACCESS_IS_OK: "yes" register: borg_list @@ -12,7 +12,7 @@ changed_when: borg_list.stdout | length > 0 - name: init borg repository - command: borg init -e keyfile {{ item['host'] }}/{{ item['dir'] }} + command: "{{ item['borg_cmd'] }} init -e keyfile {{ item['host'] }}/{{ item['dir'] }}" when: borg_list is failed environment: BORG_PASSPHRASE: "" diff --git a/roles/borg_client/templates/borg-backup.sh.j2 b/roles/borg_client/templates/borg-backup.sh.j2 index 27128144..8b51328c 100644 --- a/roles/borg_client/templates/borg-backup.sh.j2 +++ b/roles/borg_client/templates/borg-backup.sh.j2 @@ -74,7 +74,7 @@ else backup_mountdir="$src" fi -borg create -v --stats -C zstd \ +{{ item['borg_cmd'] }} create -v --stats -C zstd \ -e /proc \ -e /sys \ -e /dev \ @@ -94,4 +94,4 @@ borg create -v --stats -C zstd \ -e "$backup_mountdir/var/lib/archbuilddest" \ -e "$backup_mountdir/var/lib/docker" \ {{ item['host'] }}/{{ item['dir'] }}::$(date "+%Y%m%d-%H%M%S") "$backup_mountdir" -borg prune -v {{ item['host'] }}/{{ item['dir'] }} --keep-daily=7 --keep-weekly=4 --keep-monthly=6 +{{ item['borg_cmd'] }} prune -v {{ item['host'] }}/{{ item['dir'] }} --keep-daily=7 --keep-weekly=4 --keep-monthly=6 diff --git a/roles/borg_client/templates/borg.j2 b/roles/borg_client/templates/borg.j2 index 7f95c59f..a8014f70 100644 --- a/roles/borg_client/templates/borg.j2 +++ b/roles/borg_client/templates/borg.j2 @@ -1,3 +1,3 @@ #!/bin/bash -BORG_REPO="{{ item['host'] }}/{{ item['dir'] }}" exec /usr/bin/borg "$@" +BORG_REPO="{{ item['host'] }}/{{ item['dir'] }}" exec /usr/bin/{{ item['borg_cmd'] }} "$@" diff --git a/roles/rsync_net/templates/authorized_keys.j2 b/roles/rsync_net/templates/authorized_keys.j2 index 038383da..2f5e8e66 100644 --- a/roles/rsync_net/templates/authorized_keys.j2 +++ b/roles/rsync_net/templates/authorized_keys.j2 @@ -13,5 +13,5 @@ # Client machines keys {% for client_key in client_ssh_keys.results %} -command="borg serve --restrict-to-path {{ backup_dir }}/{{ client_key['item'] }}",restrict {{ client_key['stdout'] }} +command="borg1 serve --restrict-to-path {{ backup_dir }}/{{ client_key['item'] }}",restrict {{ client_key['stdout'] }} {% endfor %}