1
Fork 0
mirror of https://github.com/Steffo99/backup-duplicity.git synced 2024-10-15 21:57:26 +00:00
Backup solution for Docker volumes based on Duplicity
Find a file
2024-06-05 09:19:04 +02:00
.github/workflows v0.1.0 2023-03-14 19:32:14 +01:00
.idea Fix ignored files 2023-05-17 21:56:00 +02:00
.media Add icon to README 2024-06-05 09:09:23 +02:00
exampledata Create exampledata dir for the example 2023-06-18 20:50:16 +02:00
.gitignore Change example file names and gitignore them 2023-06-18 20:49:25 +02:00
.gitmodules v0.1.0 2023-03-14 19:32:14 +01:00
backup.sh Split backup and restore 2023-05-17 14:36:47 +02:00
docker-backup-duplicity.iml Fix idea modules 2023-05-17 14:33:50 +02:00
Dockerfile Use /usr/lib/duplicity as home 2023-05-17 21:56:20 +02:00
entrypoint.sh Indent entrypoint 2024-06-05 09:13:15 +02:00
gdrive.docker-compose.yml Create exampledata dir for the example 2023-06-18 20:50:16 +02:00
LICENSE.txt Add license 2024-06-05 09:19:04 +02:00
README.md Update blockquotes to new format 2024-06-05 09:17:32 +02:00
restore.sh Split backup and restore 2023-05-17 14:36:47 +02:00

Docker Duplicity Backup

Backup solution for Docker volumes based on Duplicity

Usage

Warning

The following instructions might be outdated, let me know if something doesn't work!

Note

The following instructions assume Google Drive is used as a storage backend; refer to duplicity's man page to find out how to configure different backends!

Backup

  1. Create a new volume in Docker with the name duplicity_credentials:

    # docker volume create duplicity_credentials
    
  2. Create a new file in the host system with the name /root/secrets/backup/passphrase.txt, and enter in it a secure passphrase to use to encrypt files:

    # echo 'CorrectHorseBatteryStaple' >> /root/secrets/backup/passphrase.txt
    
  3. Obtain Desktop Application OAuth credentials from the Google Cloud Console.

  4. Create a new file in the host system with the name /root/secrets/backup/client_config.yml, and enter the following content in it:

    # edit /root/secrets/backup/client_config.yml
    
    client_config_backend: settings
    client_config:
        client_id: "YOUR_GOOGLE_CLIENT_ID_GOES_HERE"
        client_secret: "YOUR_GOOGLE_CLIENT_SECRET_GOES_HERE"
    save_credentials: True
    save_credentials_backend: file
    save_credentials_file: "/var/lib/duplicity/credentials"
    get_refresh_token: True
    
  5. Add the following keys to the compose.yml file of the project you want to backup:

    # edit ./compose.yml
    
    1. Connect the previously created duplicity_credentials volume to the project:

      volumes:
          duplicity_credentials:
              external: true
      
    2. Setup the two previously created files as Docker secrets:

      secrets:
          duplicity_passphrase:
              file: "/root/secrets/duplicity/passphrase.txt"
          google_client_config:
              file: "/root/secrets/duplicity/client_config.yml"
      
    3. Add the following service:

      services:
          duplicity:
              image: "ghcr.io/steffo99/backup-duplicity:latest"
              restart: unless-stopped
              secrets:
                  - google_client_config
                  - duplicity_passphrase
              volumes:
                  - "duplicity_credentials:/var/lib/duplicity" 
                  # Mount whatever you want to backup in subdirectories of /mnt
                  - ".:/mnt/compose"  # Backup the current directory?
                  - "data:/mnt/data"  # Backup a named volume?
              environment:
                  MODE: "backup"  # Change this to "restore" to restore the latest backup
                  DUPLICITY_TARGET_URL: "pydrive://YOUR_GOOGLE_CLIENT_ID_GOES_HERE/Duplicity/this"  # Change this to the Drive directory you want to backup files to https://man.archlinux.org/man/duplicity.1.en#URL_FORMAT
                  # Don't touch these, they allow the program to read the secrets
                  DUPLICITY_PASSPHRASE_FILE: "/run/secrets/duplicity_passphrase"
                  GOOGLE_DRIVE_SETTINGS: "/run/secrets/google_client_config"
      
  6. Log in to Google Drive and perform an initial backup with:

    # docker compose run -i --entrypoint=/bin/sh duplicity /etc/periodic/daily/backup.sh
    
  7. Properly start the container with:

    # docker compose up -d && docker compose logs -f
    

Restore

  1. Create a new volume in Docker with the name duplicity_credentials:

    # docker volume create duplicity_credentials
    
  2. Create a new file in the host system with the name /root/secrets/backup/passphrase.txt, and enter in it a secure passphrase to use to encrypt files:

    # echo 'CorrectHorseBatteryStaple' >> /root/secrets/backup/passphrase.txt
    
  3. Obtain Desktop Application OAuth credentials from the Google Cloud Console.

  4. Create a new file in the host system with the name /root/secrets/backup/client_config.yml, and enter the following content in it:

    # edit /root/secrets/backup/client_config.yml
    
    client_config_backend: settings
    client_config:
        client_id: "YOUR_GOOGLE_CLIENT_ID_GOES_HERE"
        client_secret: "YOUR_GOOGLE_CLIENT_SECRET_GOES_HERE"
    save_credentials: True
    save_credentials_backend: file
    save_credentials_file: "/var/lib/duplicity/credentials"
    get_refresh_token: True
    
  5. Add the following keys to the compose.yml file of the project you want to backup:

    # edit ./compose.yml
    
    1. Connect the previously created duplicity_credentials volume to the project:

      volumes:
          duplicity_credentials:
              external: true
      
    2. Setup the two previously created files as Docker secrets:

      secrets:
          duplicity_passphrase:
              file: "/root/secrets/duplicity/passphrase.txt"
          google_client_config:
              file: "/root/secrets/duplicity/client_config.yml"
      
    3. Add the following service:

      services:
          duplicity:
              image: "ghcr.io/steffo99/backup-duplicity:latest"
              restart: no
              secrets:
                  - google_client_config
                  - duplicity_passphrase
              volumes:
                  - "duplicity_credentials:/var/lib/duplicity" 
                  # Mount whatever you want to backup in subdirectories of /mnt
                  - ".:/mnt/compose"  # Backup the current directory?
                  - "data:/mnt/data"  # Backup a named volume?
              environment:
                  MODE: "restore"  # Change this to "restore" to restore the latest backup
                  DUPLICITY_TARGET_URL: "pydrive://YOUR_GOOGLE_CLIENT_ID_GOES_HERE/Duplicity/this"  # Change this to the Drive directory you want to backup files to https://man.archlinux.org/man/duplicity.1.en#URL_FORMAT
                  # Don't touch these, they allow the program to read the secrets
                  DUPLICITY_PASSPHRASE_FILE: "/run/secrets/duplicity_passphrase"
                  GOOGLE_DRIVE_SETTINGS: "/run/secrets/google_client_config"
      
  6. Log in to Google Drive and perform the restore with:

    # docker compose run -i --entrypoint=/bin/sh duplicity /usr/lib/backup-duplicity/restore.sh