Wiki source code of Proxmox Backup server
Last modified by Kevin Wiki on 2024/05/21 21:23
Hide last authors
| author | version | line-number | content |
|---|---|---|---|
 |
1.1 | 1 | (% class="row" %) |
| 2 | ((( | ||
| 3 | (% class="col-xs-12 col-sm-8" %) | ||
| 4 | ((( | ||
| |
22.1 | 5 | (% class="wikigeneratedid" %) |
| |
24.1 | 6 | Following provides setup steps, configuration explanation and application instructions for backup server. This box both generates backups and syncs them to remote locations. View general backup explanation page [[Server backup>>doc:infra.Backup.WebHome]] for high-level information. |
| |
22.1 | 7 | |
| |
25.1 | 8 | (% class="wikigeneratedid" %) |
| 9 | Web GUI: [[https:~~/~~/clio.schleppe:8007/#pbsDashboard>>url:https://clio.schleppe:8007/#pbsDashboard]] | ||
| 10 | |||
| |
15.1 | 11 | = Backup Server configuration = |
| |
9.1 | 12 | |
| 13 | Backup server is setup with: | ||
| 14 | |||
| 15 | * zfs storage | ||
| 16 | * access control - api tokens | ||
| 17 | * datastore | ||
| 18 | ** sync jobs | ||
| 19 | ** prune jobs | ||
| 20 | ** verify jobs | ||
| 21 | ** permissions | ||
| 22 | * timings and simulator | ||
| 23 | |||
| |
14.1 | 24 | == ZFS storage array == |
| |
9.1 | 25 | |
| 26 | There are currently 2 x 8TB WD drives. Current pool status: | ||
| 27 | |||
| |
19.1 | 28 | ((( |
| 29 | {{code language="none"}} | ||
| 30 | kevin@clio:~$ sudo zpool status pergamum | ||
| 31 | pool: pergamum | ||
| 32 | state: ONLINE | ||
| 33 | scan: scrub repaired 0B in 09:52:23 with 0 errors on Sun Mar 10 10:16:24 2024 | ||
| |
9.1 | 34 | config: |
| |
19.1 | 35 | NAME STATE READ WRITE CKSUM |
| 36 | pergamum ONLINE 0 0 0 | ||
| 37 | raidz1-0 ONLINE 0 0 0 | ||
| 38 | scsi-0QEMU_QEMU_HARDDISK_drive-scsi2-part1 ONLINE 0 0 0 | ||
| 39 | sdc1 ONLINE 0 0 0 | ||
| 40 | errors: No known data errors | ||
| 41 | {{/code}} | ||
| 42 | ))) | ||
| |
9.1 | 43 | |
| 44 | |||
| |
14.1 | 45 | === Creating and expanding zfs pool === |
| |
9.1 | 46 | |
| |
19.1 | 47 | ((( |
| 48 | {{code language="none"}} | ||
| |
9.1 | 49 | zpool create pergamum raidz /dev/disk/by-partuuid/9fab17e5-df2d-2448-b5d4-10193c673a6b /dev/disk/by-partuuid/f801ed37-1d6c-ee40-8b85-6bfc49aba0fb -f |
| 50 | zfs set mountpoint=/mnt/pergamum pergamum | ||
| 51 | (zpool import -c /etc/zfs/zpool.cache -aN) | ||
| 52 | zpool export pergamum | ||
| |
19.1 | 53 | {{/code}} |
| 54 | ))) | ||
| |
10.1 | 55 | |
| 56 | |||
| |
19.1 | 57 | ((( |
| |
9.1 | 58 | have not tried yet, but adding another set of disks for an additional top-level virtual device to our existing RAID-Z pool: |
| |
19.1 | 59 | |
| 60 | {{code language="none"}} | ||
| |
9.1 | 61 | zpool add -n pergamum raidz DISK1 DISK2 |
| |
19.1 | 62 | {{/code}} |
| 63 | |||
| 64 | |||
| |
9.1 | 65 | ~> NOTE! `-n` is dry run, remove to commit. |
| |
19.1 | 66 | ))) |
| |
9.1 | 67 | |
| |
12.1 | 68 | |
| |
14.1 | 69 | == Access Control == |
| |
12.1 | 70 | |
| 71 | Each client host that wants to backup their contents to the backup server should have their unique API token for authentication. | ||
| 72 | |||
| 73 | API Token: | ||
| 74 | |||
| 75 | * user: [[root@pam>>mailto:root@pam]] | ||
| 76 | * token name: CLIENT_NAME | ||
| 77 | * expire: never | ||
| 78 | * enabled: true | ||
| 79 | |||
| 80 | Permissions - Add a API Token Permission: | ||
| 81 | |||
| 82 | * path: /datastore/proxmox-backup/CLIENT_NAME | ||
| 83 | * api token: root@pam!CLIENT_NAME | ||
| 84 | * role: DatastoreBackup | ||
| 85 | * propagate: true | ||
| 86 | |||
| 87 | >Note! The path will not be define until after the Datastore namespace is define in the steps below | ||
| 88 | |||
| |
14.1 | 89 | == Proxmox datastore == |
| |
12.1 | 90 | |
| 91 | If none exists create the datastore. Ours point is named `proxmox-backup` and points to ZFS storage mounted at `/mnt/pergamum`. All references to `proxmox-backup` referes to what you named it as in the create step here. | ||
| 92 | |||
| |
14.1 | 93 | === Namespace === |
| |
12.1 | 94 | |
| 95 | Namespaces is what we will use in a datastore to separate permissions to each host. It's important to create these for the API tokens create in Access Control section above. | ||
| 96 | |||
| |
14.1 | 97 | === Prune & Garbage collect === |
| |
12.1 | 98 | |
| 99 | We don't require backups for every day of the year. Pruning lets you systematically delete older backups, retaining backups for the last given number of time intervals. There exists a fantastic simulator that can be used to experiment with different backup schedules and prune options: [[https:~~/~~/pbs.proxmox.com/docs/prune-simulator/>>https://pbs.proxmox.com/docs/prune-simulator/]]. The current configuration is: | ||
| 100 | |||
| 101 | * datastore: proxmox-backup | ||
| 102 | * namespace: root | ||
| 103 | * keep last: 4 | ||
| 104 | * keep: hourly: - | ||
| 105 | * keep daily: 6 | ||
| 106 | * keep weekly: 3 | ||
| 107 | * keep monthly: 6 | ||
| 108 | * keep yearly: 4 | ||
| 109 | * max_depth: full | ||
| 110 | * prune schedule: 0/6:00 | ||
| 111 | * enabled: true | ||
| 112 | |||
| |
14.1 | 113 | === Verify jobs === |
| |
12.1 | 114 | |
| 115 | Current configuration is: | ||
| 116 | |||
| 117 | * local datastore: proxmox-backup | ||
| 118 | * namespace: root | ||
| 119 | * max-depth: full | ||
| 120 | * schedule: daily | ||
| 121 | * skip verified: true | ||
| 122 | * re-verify after: 30 days | ||
| 123 | |||
| |
14.1 | 124 | === Permissions === |
| |
12.1 | 125 | |
| 126 | Permissions are explained in the Access Control section above, but it can be easier to configure permissions from the datastore. Navigate to the datastore Permission tab and add API Token Permission: | ||
| 127 | |||
| 128 | * path: /datastore/proxmox-backup/CLIENT_NAME | ||
| 129 | * API Token: root@pam!CLIENT_NAME | ||
| 130 | * Role: DatastoreBackup | ||
| 131 | * Propagate: true | ||
| 132 | |||
| |
8.1 | 133 | = Tailscale = |
| |
4.1 | 134 | |
| |
9.1 | 135 | Tailscale is used to create a network that uses wireguard to transparently between local and remote machines. To not require a third party a local instance of headscale is used as the tailscale login server. |
| |
8.1 | 136 | |
| |
20.1 | 137 | {{code language="bash"}} |
| 138 | curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null | ||
| 139 | curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/focal.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list | ||
| 140 | |||
| 141 | sudo apt-get update | ||
| 142 | sudo apt-get install tailscale | ||
| 143 | |||
| 144 | systemctl status tailscaled.service | ||
| |
21.1 | 145 | sudo tailscale up --login-server SUBDOMAIN.schleppe.cloud |
| |
20.1 | 146 | tailscale status |
| 147 | {{/code}} | ||
| 148 | |||
| |
21.1 | 149 | Connect to headscale login server: |
| 150 | |||
| 151 | {{code language="none"}} | ||
| 152 | $ sudo tailscale up --login-server https://SUBDOMAIN.schleppe.cloud | ||
| 153 | |||
| 154 | To authenticate, visit: | ||
| 155 | |||
| 156 | https://SUBDOMAIN.schleppe.cloud/register/nodekey:fe30125f6dc09b2ac387a3b06c3ebc2678f031d07bd87bb76d91cd1890226c9f | ||
| 157 | |||
| 158 | Success. | ||
| 159 | {{/code}} | ||
| 160 | |||
| 161 | View more info in the docs: [[https:~~/~~/earvingad.github.io/posts/headscale/>>https://earvingad.github.io/posts/headscale/]] | ||
| 162 | |||
| |
16.1 | 163 | = Jottacloud client = |
| |
8.1 | 164 | |
| |
16.1 | 165 | Cloud backup provider used is jottacloud. They provide a cli to easily add directories to sync to their cloud backup storage. |
| 166 | NOTE! This setup still uses user `kevin` and not the correct jottad user. | ||
| |
4.1 | 167 | |
| |
19.1 | 168 | ((( |
| 169 | {{code language="none"}} | ||
| 170 | # install jotta-cli | ||
| |
16.1 | 171 | sudo curl -fsSL https://repo.jotta.cloud/public.asc -o /usr/share/keyrings/jotta.gpg |
| 172 | echo "deb [signed-by=/usr/share/keyrings/jotta.gpg] https://repo.jotta.cloud/debian debian main" | sudo tee /etc/apt/sources.list.d/jotta-cli.list | ||
| 173 | sudo apt-get update | ||
| 174 | sudo apt-get install jotta-cli | ||
| |
1.1 | 175 | |
| |
16.1 | 176 | # configure runtime environment |
| 177 | sudo useradd -m jottad | ||
| |
19.1 | 178 | sudo usermod -a -G jottad backup |
| 179 | {{/code}} | ||
| 180 | ))) | ||
| |
1.1 | 181 | |
| |
17.1 | 182 | Create systemd file: `/usr/lib/systemd/user/jottad.service ` and enable with : |
| 183 | |||
| 184 | ((( | ||
| |
18.1 | 185 | |
| |
17.1 | 186 | |
| |
18.1 | 187 | {{code language="ini" layout="LINENUMBERS" title="/usr/lib/systemd/user/jottad.service"}} |
| |
17.1 | 188 | [Unit] |
| |
16.1 | 189 | Description=Jotta client daemon |
| |
1.1 | 190 | |
| |
16.1 | 191 | [Service] |
| 192 | Type=notify | ||
| 193 | # Group=backup | ||
| 194 | # UMask=0002 | ||
| |
1.1 | 195 | |
| |
16.1 | 196 | # EnvironmentFile=-%h/.config/jotta-cli/jotta-cli.env |
| 197 | ExecStart=/usr/bin/jottad stdoutlog datadir %h/.jottad/ | ||
| 198 | Restart=on-failure | ||
| |
1.1 | 199 | |
| |
16.1 | 200 | [Install] |
| |
17.1 | 201 | WantedBy=default.target |
| 202 | {{/code}} | ||
| 203 | ))) | ||
| |
1.1 | 204 | |
| |
16.1 | 205 | == Flaws == |
| |
1.1 | 206 | |
| |
16.1 | 207 | Since proxmox backup server uses chunks for deduplicating data a complete file list is required. This makes it impossible to download a single file representing a VM or LXC, all files must be downloaded and imported into proxmox backup server for reconstruction. |
| |
1.1 | 208 | |
| |
16.1 | 209 | It also seems like there are a LOT of files shifting - being added and deleted. Making the diff uploaded to jottacloud huge. |
| 210 | |||
| |
26.1 | 211 | = Syncthing = |
| 212 | |||
| 213 | TODO | ||
| 214 | |||
| |
16.1 | 215 | = Client Configuration = |
| 216 | |||
| 217 | Configure Backup on the Datacenter or PVE host level in the proxmox web GUI. If a backup storage is already added input the following preferences: | ||
| 218 | |||
| 219 | * selection mode: include selected VMs | ||
| |
27.1 | 220 | * send email to: EMAIL_ADDRESS |
| |
16.1 | 221 | * email: on failure only |
| 222 | * mode: snapshot | ||
| 223 | * enabled: true | ||
| 224 | * job comment: ~{~{guestname}}, ~{~{node}}, ~{~{vmid}} | ||
| |
28.1 | 225 | |
| 226 | = Debugging/issues live here = | ||
| 227 | |||
| 228 | == Permission denied anything for certain backups == | ||
| 229 | |||
| 230 | When trying to restore a VM I noticed that it was very outdated. Before doing anything I got a `Permission denied (os error 13)` error message. I checked the permissions of the storage mount in proxmox cluster, generated new API key, removed and re-added the storage to node getting permission denied, and what gave it away I also got it when running the CLI command from proxmox-backup-server host. | ||
| 231 | |||
| 232 | {{code language="bash"}} | ||
| 233 | kevin@clio:~$ sudo proxmox-backup-client snapshot forget -ns apollo -repository proxmox-backup 'vm/201/2023-07-31T01:31:18Z' | ||
| 234 | [sudo] password for kevin: | ||
| 235 | Password for "root@pam": ***************** | ||
| 236 | fingerprint: **:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:** | ||
| 237 | Are you sure you want to continue connecting? (y/n): y | ||
| 238 | storing login ticket failed: $XDG_RUNTIME_DIR must be set | ||
| 239 | Error: removing backup snapshot "/mnt/pergamum/proxmox-backup/ns/apollo/vm/201/2023-07-31T01:31:18Z" failed - Permission denied (os error 13) | ||
| 240 | |||
| 241 | kevin@clio:~$ ls -l "/mnt/pergamum/proxmox-backup/ns/apollo/vm/201/2023-07-31T01:31:18Z" | ||
| 242 | total 263 | ||
| 243 | -rw-r--r-- 1 root root 667 Feb 17 01:16 client.log.blob | ||
| 244 | -rw-r--r-- 1 root root 167936 Feb 17 01:16 drive-scsi0.img.fidx | ||
| 245 | -rw-r--r-- 1 root root 539 Feb 17 01:16 index.json.blob | ||
| 246 | -rw-r--r-- 1 root root 342 Feb 17 01:16 qemu-server.conf.blob | ||
| 247 | {{/code}} | ||
| 248 | |||
| |
29.1 | 249 | Aha! The owner of everything in these folders should be {{code language="none"}}backup:backup{{/code}}. |
| |
28.1 | 250 | |
| 251 | **Resolve using:** | ||
| 252 | |||
| 253 | {{code language="bash"}} | ||
| 254 | kevin@clio:~$ sudo chown -R backup:backup /mnt/pergamum/proxmox-backup/ns/apollo/* | ||
| 255 | {{/code}} | ||
| 256 | |||
| 257 | |||
| |
1.1 | 258 | ))) |
| 259 | |||
| 260 | |||
| 261 | (% class="col-xs-12 col-sm-4" %) | ||
| 262 | ((( | ||
| 263 | {{box title="**Contents**"}} | ||
| 264 | {{toc/}} | ||
| 265 | {{/box}} | ||
| 266 | ))) | ||
| 267 | ))) |