borg backup puppet module

Overview
Usage
Reference
Contributing

Overview

Configure borg backups and gives you the option to store passphrase and keyfile needed for encrypted backups in a git repository. The content of the git repository is encrypted with gpg keys (configurable) for security.

Usage

For typical usage of this module you configure two nodes. One node to backup and another as the target where the backup should be stored. Below is a minimal configuration.

the node to backup (node-A)

In the nodes manifest:

include ::borgbackup

The hiera configuration for the node:

# the resource to use for ssh key generation and the parameters:
borgbackup::ssh_key_define: 'file'
borgbackup::ssh_key_res:
  '/etc/borgbackup/.ssh/id_rsa':
      owner: 'root'
      group: 'root'
      mode: '0700'
      content: 'key_data'

# specify the target node for the backup:
borgbackup::default_target: "borgbackup@node-target:/srv/borgbackup/%{::fqdn}"

# specify the ssh key to access node-target:
borgbackup::repos_defaults:
  env_vars:
    BORG_RSH: 'ssh -i /etc/borgbackup/.ssh/id_rsa'

To add an archive to the default borg repo (named $::fqdn) use

::borgbackup::archive{'my_archive':
  create_includes = ['/etc'],
}

the target node (node-target)

include ::borgbackup::server

The hiera configuration for the node:

# authorize the key generated on node-A for backup
borgbackup::server::authorized_keys:
  node-A:
    keys:
       - 'ssh-... .... borg backups'

Remark: the initialization of the borg backup repository fails until you configured the ssh key on node-target.

use a remote git repository

To store the generated passphrase and the keyfile in a secure and automated manner, you can use a git repository. Add the following hiera configuration to node-A to fetch and commit to remote gitrepo on node-git:

# the git repo to clone and commit
borgbackup::git::gitrepo: 'user@node-git:/path-to-repo'
# ssh private key to access the git repo. This key should only have  access to this repo !
borgbackup::git::gitrepo_sshkey: |
  -----BEGIN OPENSSH PRIVATE KEY-----
  ...
  -----END OPENSSH PRIVATE KEY-----

# add pgp public keys of users who should be able to decrypt the passphrase and the keyfile.
# to export use:
# gpg --export --armor --export-options no-export-attributes,export-minimal ID
borgbackup::git::gpg_keys:
  ID-of-user-1: |
    -----BEGIN PGP PUBLIC KEY BLOCK-----
    ...
  ID-of-user-2: |
    -----BEGIN PGP PUBLIC KEY BLOCK-----
    ...

Remark: if you add or delete gpg_keys, the repository should automatically reencrypt and push to the git repository.

Remark: ID-of-user should point to the main email of the pgp key. If you see runing reencrypt with each puppet run on the nodes, then the ID-of-user is probably wrong.

Reference

All classes and defines are documented with all parameters in the corresponding code file and in the REFERENCE document.

Contributing

Please report bugs and feature request using GitHub issue tracker.

For pull requests, it is very much appreciated to check your Puppet manifest with puppet-lint and the available spec tests in order to follow the recommended Puppet style guidelines from the Puppet Labs style guide.

Authors

This module is mainly written by Cirrax GmbH.

See the list of contributors for a list of all contributors.

chaosmaster/puppet-borgbackup