This role, backuppc_server installs and configures a BackupPC server on a Debian GNU/Linux operating system. It initially worked on Debian Jessie, and is maintained up to Debian Buster. It probably can work on Ubuntu or other Debian-based systems, but it wasn't tested (PR and other contributions accepted).
It has a sister role BackupPC client to configure client hosts that will be backed up by the BackupPC server.
This role installs and configures backuppc debian package, including ther creation of an ssh key for the backuppc user, as well as passwords and e-mails for web backuppc users. Optionally, it can also (by default it does) configure Apache2 for https web access to BackupPC interface, using either a self-signed certificate, a certbot one (generated elsewhere), or your own one.
backuppc_client role configures clients' accounts in their BackupPC server, as well as server ssh access to the client, to perform backups. But clients can also be configured manually, or by any other mean.
backuppc debian package has changed its behaviour in buster, and now the web interface of BackupPC, morover its https authentication, is only available on localhost. Te role adopts this new security feature, and makes it configurable. With default values of the role you will need to find a way to acces from the host itsef, for instance with an ssh tunnel:
ssh -L 8443:localhost:443 bacuppc.domain.orgAnd then you access from a browser the URL https://localhost:8443/backuppc/
The role can now handle most useful backuppc parameters but, at this time, it is designed and developed to configure backups only via rsync transfer method, with its default transport ssh ('rsync' for XferMethod BackupPC parameter).
backuppc_srv_server_name: fqdn of the host where BackupPC server is to be installed (default: inventory_host variable's value)There is no reason to change the following variables, there are more to centralise values than to be modified. Note that they are note taken into account in debial packages configuration.
backuppc_srv_unix_user: BackupPC unix user in the server, from which are launched ssh backups to the client (default: backuppc)backuppc_srv_unix_group: BackupPC unix group in the server (default: www-data)backuppc_srv_user_home: Home directory of backuppc_srv_unix_user unix user previously defined (default: /var/lib/backuppc)backuppc_srv_ssh_key_bits: set length of ssh key pair (optional, default 2048)backuppc_srv_config_dir: backuppc package configuration directory (default: /etc/backuppc) These are the most important configuration variables of the role.
See file templates/etc/backuppc/config.pl.j2 and BackupPC documentation for variables' reoles explanation and possible values. Only most significant parameters are mentionned here.
The role's variables are named with the namespace prefix backuppc_srv_ followed by the BackupPC config.pl file parameter name. Note that half of the name is in snake_case and half in CamelCase.
The following parameters can be overwritten in a per client bases. See backuppc_client role
backuppc_srv_RsyncShareName: List of folders of the client to backup. An rsync will be performed by the server into the client. We advise you to always set your own value, but default value is:
/etc
/var
/home
/root
Note: as stated above, only rsync is considered as transfer method, so we don't mention `SmbShareName`, `TarShareName`, other similar parameters, and related. backuppc_srv_BackupFilesOnly: List of directories or files to include in backups. This can be set to a string, a list of strings, or, in the case of multiple shares, a dict of strings or lists. A dict is used to give a list of directories or files to backup for each share (the share name is the key). If a dict is used, a special key "*" means it applies to all shares that don't have a specific entry.
For instance, the following configuration parameters:
backuppc_RsyncShareName:
- /etc/gitlab
- /var/opt/gitlab
backuppc_srv_BackupFilesOnly:
# Configuration archives fo GitLab instance:
"/etc/gitlab":
- /gitlab.rb
- /gitlab-secrets.json
# Gotlab backup file
"/var/opt/gitlab":
- /backups/dump_backuppc_gitlab_backup.tarwill perform the backup of the three needed file of a GitLab instance. (dump_backuppc_gitlab_backup.tar is built by a script just before the dump, see backuppc_client role's documentation
backuppc_srv_RsyncShareName: List of directories or files to exclude from the backup. Syntax is similar than backuppc_srv_BackupFilesOnly.
backuppc_srv_FullPeriod: Minimum period in days between full backups (default 6.97, one week)
backuppc_srv_IncrPeriod: Minimum period in days between incremental backups (default 0.97, one day)
backuppc_srv_FullKeepCnt: Number of full backups to keep. A list of values, separated by commas, is admitted, in wich case it means the number of backups of periods of powers of 2: 1 week, 2 weeks, 4 weeks, etc. For insance: 4, 0, 4, 0, 0, 2 will keep 4 backups at 1 week interval, 4 backups at 16 weeks intervals (4 month) and 2 at an interval of 32 weeks (8 month, oldest backup 16 month). templates/etc/backuppc/config.pl.j2, lines 421 to 495.
backuppc_srv_BackupsDisable: Whether automatic and manual backup are disables. Default value: 0, backups are performed regularly. Other possible values are 1: automatic backup disable, manual backup ok, 2: no backup at all.
backuppc_srv_XferMethod: What transport method to use to backup each host. Possible values are smb,rsync, rsyncd, tar and archive but, as stated before, the role is yet only designed for rsync, which obviously is the default value.
backuppc_srv_EMailFromUserName: Name to use as the "from" name for email (Default: backuppc_srv_unix_user variable value),backuppc_srv_EMailAdminUserName: Destination address to an administrative user who will receive a nightly email with warnings and errors (Default: backuppc_srv_unix_user variable value),backuppc_srv_EMailUserDestDomain: Destination domain name for email sent to users (Default value: '', empty string)Can be overridden in the per-client config.pl
backuppc_srv_CgiAdminUserGroup: Linux group of admin users through the CGI (Default: backuppc_srv_unix_user variable value),backuppc_srv_CgiAdminUsers: List of users who are also admin users through the CGI (Default: backuppc_srv_unix_user variable value),backuppc_srv_CgiURL: URL of the BackupPC_Admin CGI script. Used for email messages (Default value: 'https://{{ backuppc_srv_server_name }}/backuppc/index.cgi')backuppc_srv_language: Web interface's language. Default 'en', English,backuppc_srv_Date_Format: date format of the web interface. 1: US-style, 2: full format, 0. International format (role's default value) See also README of backuppc-client role for detailed client variables.
backuppc_srv_web_users: List of web user accounts data for BackupPC (Default value is empty). It is a list of dicts, each one defing a user account with the following parameters:
name: the username of the account, to be enterd in the web interface password: the password itself, which value should be set froma vault: '{{ vault_secret }}'htpasswd_hash: the hash-code of the password, generated by the user herself. mail: (optional) the e-mail of the user, where will be sent the reports of backuppc about the managed hosts. the e-mail will be configured in the /etc/alias file of the host for effective mail delivery. We prefer this design than the backuppc_srv_EMailUserDestDomain mechanism of BackupPC, that uses a signe domain for all users. Usernames and their password hashcode will be configured in the /etc/backuppc/htpasswd/ of the host.
An htpasswd hash code for a user and a password can be obtaind running:
htpasswd -n user htpasswd utility is installed in linux with apache2-utils debian package.
In backuppc_client role, you will be able to configure these users in backuppc_server_web_main_user and backuppc_server_web_other_users variables.
backuppc_srv_configure_apache: Flag, whether to configure apache2 or not (Default: true),backuppc_srv_disable_apache_default_site: Flag to disable the default Apache2 VirtualHost (apache site) (Default: true),backuppc_srv_apache_email: e-mail configured in Apache2 VirtualHosts (Default value: 'webmaster@{{ ansible_fqdn }}'The role can user either valide certificates generated elsewhere by Certbot, or the ssl-certs package's self-signed certificate.
Configuration of SSLCertificateFile and SSLCertificateKeyFile for
backuppc_srv_apache_require_ssl: Flag to force https when accessing /backuppc CGI alias (Default: true)
backuppc_srv_apache_ssl_certbot: A flag to choose the certificates to configure in Apache VHost (Default value: false):
/etc/letsencrypt/live/{{ backuppc_srv_server_name }}.Previous flag defines the variables backuppc_srv_apache_ssl_cert_file and backuppc_srv_apache_ssl_cert_key_file used for Apache configuration of ssl certificates. You can overwrithe these variables with custom values, in which case porevious flag will be unuseful.
backuppc_srv_apache_access_control: a flag to configure Require directives hereafter (default: true)backuppc_srv_apache_Require: the value of Apache Require directive to restrict accss if the previous flag is set. By default, access is restricted to local host (you must access your BackupPC with an ssh tunnel). You can for example limit the access to your IPv4 and IPv6 network with:
backuppc_srv_apache_Require: "ip 172.30 2001:db8:3::/48"We suggest you however to install a firweall that protects your backup server from the wide Internet. If not, at least turn the configuration backuppc_srv_apache_local to true, and access the web interface with an ssh tunnel.
This role does now a basic but complete installation of Apache, with htpasswd authentication.
It also configures emails in the /etc/aliases, that should be handled by any MTA (that should be configured with the ability to send mails elsewhere)
This role generates a backuppc SSH public key. The backuppc_client role deploys it on each client.
- name: Configuration of my BackupPC server
hosts: backup.mydomain.org
remote_user: deploy
become: yes
vars:
backuppc_srv_server_name: backup.mydomain.org
backuppc_srv_RsyncShareName:
- /
backuppc_srv_FullKeepCnt: 4, 0, 4, 0, 0, 2
backuppc_srv_apache_ssl_certbot: false
backuppc_srv_web_users:
- name: backuppc
password: '{{ vault_secret }}'
mail: me@domain.org
- name: user
htpasswd_hash: 'user2:$apr1$70okuQfp$/PB1pKZ0YXi6cTGL/yHXs1'
mail: me@domain.org
- role: udelarinterior.backuppc_serverwill install ando configure BackupPC and Apache2 in backup.mydomain.org host, with default self-signed ceertificates.
GPLv3
Original role Emilien M enhanced by Víctor Torterola and Daniel Viñar