moving closer to podman systemd services for everything
This commit is contained in:
@@ -2,19 +2,24 @@
|
||||
|
||||
- [Truenas](#truenas)
|
||||
- [Bios settings](#bios-settings)
|
||||
- [Archiving](#archiving)
|
||||
- [Deleting snapshots](#deleting-snapshots)
|
||||
- [But First, ZFS on RPi](#but-first-zfs-on-rpi)
|
||||
- [Pi Setup](#pi-setup)
|
||||
- [Datasets, Snapshots, and Encryption](#datasets-snapshots-and-encryption)
|
||||
- [Periodic Snapshot Recommendations](#periodic-snapshot-recommendations)
|
||||
- [Hourly Snapshots](#hourly-snapshots)
|
||||
- [Daily Snapshots](#daily-snapshots)
|
||||
- [Replication Tasks](#replication-tasks)
|
||||
- [Source](#source)
|
||||
- [Destination](#destination)
|
||||
- [Manually Create Named Snapshots](#manually-create-named-snapshots)
|
||||
- [Migrating encrypted pools](#migrating-encrypted-pools)
|
||||
- [Migrating Properties](#migrating-properties)
|
||||
- [Backup Task Settings](#backup-task-settings)
|
||||
- [Create and Destroy zfs Datasets](#create-and-destroy-zfs-datasets)
|
||||
- [Create and send snapshots](#create-and-send-snapshots)
|
||||
- [Cleaning up old snapshots](#cleaning-up-old-snapshots)
|
||||
- [Creating and restoring snapshots](#creating-and-restoring-snapshots)
|
||||
- [Filesystem ACLs](#filesystem-acls)
|
||||
- [ISCSI Backup Volumes](#iscsi-backup-volumes)
|
||||
- [Create Backup ZVOL](#create-backup-zvol)
|
||||
- [Create Backup ISCSI Target](#create-backup-iscsi-target)
|
||||
- [VMs](#vms)
|
||||
- [Converting zvol to qcow2](#converting-zvol-to-qcow2)
|
||||
- [Converting qcow2 to zvol](#converting-qcow2-to-zvol)
|
||||
@@ -37,7 +42,11 @@
|
||||
- [ZFS Size Data](#zfs-size-data)
|
||||
- [ZFS Rename](#zfs-rename)
|
||||
- [ISCSI](#iscsi)
|
||||
- [Base Name](#base-name)
|
||||
- [ISCSI Base Name](#iscsi-base-name)
|
||||
- [Archiving](#archiving)
|
||||
- [Deleting snapshots](#deleting-snapshots)
|
||||
- [But First, ZFS on RPi](#but-first-zfs-on-rpi)
|
||||
- [Pi Setup](#pi-setup)
|
||||
|
||||
## Bios settings
|
||||
|
||||
@@ -48,120 +57,65 @@ You can check the bios version with `dmidecode -t bios -q`
|
||||
2. Turn off boosting
|
||||
3. Enable XMP
|
||||
|
||||
## Archiving
|
||||
|
||||
1. Create a recursive snapshot called "archive_pool_year_month_day"
|
||||
2. Create a replication task called "archive_pool_year_month_day"
|
||||
|
||||
- select all datasets you want to backup
|
||||
- fill in enc0/archives/archive-year-month-day_hour-minute
|
||||
- full filesystem replication
|
||||
- select "Matching naming schema"
|
||||
- Use `archive-%Y-%m-%d_%H-%M`
|
||||
- Deselect run automatically
|
||||
- Save and run
|
||||
|
||||
## Deleting snapshots
|
||||
|
||||
Sometimes you need to delete many snapshots from a certain dataset. The UI is terrible for this, so
|
||||
we need to use `zfs destroy`. xargs is the best way to do this since it allows parallel processing.
|
||||
|
||||
```bash
|
||||
# zfs list snapshots with:
|
||||
# -o name: only print the name
|
||||
# -S creation: sort by creation time
|
||||
# -H: don't display headers
|
||||
# -r: recurse through every child dataset
|
||||
zfs list -t snapshot enc0/archives -o name -S creation -H -r
|
||||
|
||||
# pipe it through xargs with:
|
||||
# -n 1: take only 1 argument from the pipe per command
|
||||
# -P 8: eight parallel processes
|
||||
# Also pass to zfs destroy:
|
||||
# -v: verbose
|
||||
# -n: dryrun
|
||||
zfs list -t snapshot enc0/archives -o name -S creation -H -r | xargs -n 1 -P 8 zfs destroy -v -n
|
||||
|
||||
# if that looks good you can remove the "-n"
|
||||
zfs list -t snapshot enc0/archives -o name -S creation -H -r | xargs -n 1 -P 8 zfs destroy -v
|
||||
```
|
||||
|
||||
## But First, ZFS on RPi
|
||||
|
||||
A really good backup server is an RPi running openzfs. See [the openzfs docs](https://openzfs.github.io/openzfs-docs/Getting%20Started/Ubuntu/Ubuntu%2020.04%20Root%20on%20ZFS%20for%20Raspberry%20Pi.html#step-2-setup-zfs) for more info.
|
||||
|
||||
### Pi Setup
|
||||
|
||||
Add the vault ssh CA key to your pi.
|
||||
|
||||
```bash
|
||||
curl -o /etc/ssh/trusted-user-ca-keys.pem https://vault.ducoterra.net/v1/ssh-client-signer/public_key
|
||||
|
||||
echo "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem" >> /etc/ssh/sshd_config
|
||||
|
||||
service ssh restart
|
||||
```
|
||||
|
||||
Create a pi user.
|
||||
|
||||
```bash
|
||||
adduser pi
|
||||
usermod -a -G sudo pi
|
||||
```
|
||||
|
||||
SSH to the pi as the "pi" user. Delete the ubuntu user.
|
||||
|
||||
```bash
|
||||
killall -u ubuntu
|
||||
userdel -r ubuntu
|
||||
```
|
||||
|
||||
Disable SSH password authentication
|
||||
|
||||
```bash
|
||||
sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config
|
||||
service ssh restart
|
||||
```
|
||||
|
||||
Change the hostname.
|
||||
|
||||
```bash
|
||||
echo pi-nas > /etc/hostname
|
||||
```
|
||||
|
||||
Upgrade and restart the pi.
|
||||
|
||||
```bash
|
||||
apt update && apt upgrade -y && apt autoremove -y
|
||||
reboot
|
||||
```
|
||||
|
||||
Install ZFS.
|
||||
|
||||
```bash
|
||||
apt install -y pv zfs-initramfs
|
||||
```
|
||||
|
||||
Find the disks you want to use to create your pool
|
||||
|
||||
```bash
|
||||
fdisk -l
|
||||
```
|
||||
|
||||
Create a pool.
|
||||
|
||||
```bash
|
||||
mkdir -p /mnt/backup
|
||||
zpool create \
|
||||
-o ashift=12 \
|
||||
-O acltype=posixacl -O canmount=off -O compression=lz4 \
|
||||
-O dnodesize=auto -O normalization=formD -O relatime=on \
|
||||
-O xattr=sa -O mountpoint=/mnt/backup \
|
||||
backup ${DISK}
|
||||
```
|
||||
|
||||
## Datasets, Snapshots, and Encryption
|
||||
|
||||
### Periodic Snapshot Recommendations
|
||||
|
||||
#### Hourly Snapshots
|
||||
|
||||
- Lifetime: `1 day`
|
||||
- Naming Schema: `hourly-%Y-%m-%d_%H-%M`
|
||||
- Schedule: `Hourly`
|
||||
- Begin: `00:00:00`
|
||||
- End: `23:59:00`
|
||||
- Disallow taking empty snapshots
|
||||
- Enabled
|
||||
- Recursive
|
||||
|
||||
Assuming 100 datasets: 100 datasets x 24 hours = 2400 snapshots
|
||||
|
||||
Disallowing empty snapshots will help keep that number down.
|
||||
|
||||
#### Daily Snapshots
|
||||
|
||||
- Lifetime: `1 week`
|
||||
- Naming Schema: `daily-%Y-%m-%d_%H-%M`
|
||||
- Schedule: `Daily`
|
||||
- Allow taking empty snapshots
|
||||
- Enabled
|
||||
- Recursive
|
||||
|
||||
Assuming 100 datasets: 100 datasets x 7 days = 700 snapshots
|
||||
|
||||
### Replication Tasks
|
||||
|
||||
Before configuring, create a dataset that you'll be replicating to.
|
||||
|
||||
Use advanced settings.
|
||||
|
||||
- Transport `LOCAL`
|
||||
|
||||
#### Source
|
||||
|
||||
- Recursive
|
||||
- Include Dataset Properties
|
||||
- Periodic Snapshot Tasks: Select your `daily` task
|
||||
- Run automatically
|
||||
|
||||
#### Destination
|
||||
|
||||
- Read-only Policy: `SET`
|
||||
- Snapshot Retention Policy: `Custom`
|
||||
- Lifetime: `1 month`
|
||||
- Naming Schema: `daily-%Y-%m-%d_%H-%M`
|
||||
|
||||
Assuming 100 datasets: 100 datasets x 30 days = 3000 snapshots
|
||||
|
||||
#### Manually Create Named Snapshots
|
||||
|
||||
1. Datasets -> Select dataset -> Create Snapshot -> Naming Schema (daily)
|
||||
2. Start replication from Data Protection
|
||||
|
||||
### Migrating encrypted pools
|
||||
|
||||
Since you can't use `-R` to send encrypted datasets recursively you'll need to use more creative tactics. Here's my recommendation:
|
||||
@@ -201,16 +155,6 @@ If you need to migrate your dataset comments you can use the following bash to a
|
||||
for i in $(zfs list -H -d 1 -o name backup/nvme/k3os-private); do read -r name desc < <(zfs list -H -o name,org.freenas:description $i) && pvc=$(echo "$name" | awk -F "/" '{print $NF}') && zfs set org.freenas:description=$desc enc1/k3os-private/$pvc; done
|
||||
```
|
||||
|
||||
### Backup Task Settings
|
||||
|
||||
| Key | Value |
|
||||
| ------------------------------------ | --------------------- |
|
||||
| Destination Dataset Read-only Policy | SET |
|
||||
| Recursive | true |
|
||||
| Snapshot Retention Policy | Same as Source |
|
||||
| Include Dataset Properties | true |
|
||||
| Periodic Snapshot Tasks | <daily-snapshot-task> |
|
||||
|
||||
### Create and Destroy zfs Datasets
|
||||
|
||||
```bash
|
||||
@@ -269,7 +213,7 @@ zfs list -t snap -r $POOL | wc -l
|
||||
zfs list -t snap -r -H -o name $POOL > $SNAPSHOTS_FILE
|
||||
|
||||
# Check the file
|
||||
cat $SNAPSHOTS_FILE | less
|
||||
cat $SNAPSHOTS_FILE | less
|
||||
|
||||
# Dry run
|
||||
for SNAPSHOT in $(cat $SNAPSHOTS_FILE); do echo "zfs destroy -v $SNAPSHOT"; done | less
|
||||
@@ -303,6 +247,35 @@ Dataset -> Dataset details (edit) -> Advanced Options -> ACL Type (inherit)
|
||||
setfacl -b -R /mnt/enc0/smb/media
|
||||
```
|
||||
|
||||
## ISCSI Backup Volumes
|
||||
|
||||
### Create Backup ZVOL
|
||||
|
||||
1. Create a new dataset called "iscsi" and then a dataset under that called "backups"
|
||||
1. Set sync to always
|
||||
2. Disable compression
|
||||
3. Enable Sparse
|
||||
2. Create a new dataset under backups with the same name as your server hostname
|
||||
3. Set the size to something reasonable (Note you may need to "force size")
|
||||
|
||||
### Create Backup ISCSI Target
|
||||
|
||||
1. In System -> Services -> ISCSI set the Base Name following [these rules](#iscsi-base-name)
|
||||
2. In Shared -> ISCSI -> Authorized Access -> Create a new authorized access
|
||||
1. Group ID arbitrary - just pick a number you haven't used
|
||||
2. User: The connecting machine's ISCSI Base Name
|
||||
3. Secret: A 16 character password with no special characters
|
||||
3. Wizard -> Create New
|
||||
1. Extent Name: `backup-<hostname>`
|
||||
2. Extent Type: `Device`
|
||||
3. Extent Device: The ZVOL you just created
|
||||
4. Extent Sharing Platform: `Modern OS`
|
||||
5. Protocol Options Portal: Either create new (0.0.0.0 and ::) or select your existing portal
|
||||
6. Protocol Options Initiators: The base name of the connecting machine following [these rules](#iscsi-base-name)
|
||||
4. Targets -> Select the backup-<hostname> target -> Edit
|
||||
1. Authentication Method: `CHAP`
|
||||
2. Authentication Group Number: The group number you created above
|
||||
|
||||
## VMs
|
||||
|
||||
1. Force UEFI installation
|
||||
@@ -568,10 +541,123 @@ zfs rename enc0/something enc0/something_else
|
||||
|
||||
## ISCSI
|
||||
|
||||
### Base Name
|
||||
### ISCSI Base Name
|
||||
|
||||
<https://datatracker.ietf.org/doc/html/rfc3721.html#section-1.1>
|
||||
|
||||
| iqn | . | year-month of domain registration | . | reversed domain | : | unique string
|
||||
|
||||
iqn.2022-01.com.reeselink:driveripper
|
||||
|
||||
|
||||
## Archiving
|
||||
|
||||
1. Create a recursive snapshot called "archive_pool_year_month_day"
|
||||
2. Create a replication task called "archive_pool_year_month_day"
|
||||
|
||||
- select all datasets you want to backup
|
||||
- fill in enc0/archives/archive-year-month-day_hour-minute
|
||||
- full filesystem replication
|
||||
- select "Matching naming schema"
|
||||
- Use `archive-%Y-%m-%d_%H-%M`
|
||||
- Deselect run automatically
|
||||
- Save and run
|
||||
|
||||
## Deleting snapshots
|
||||
|
||||
Sometimes you need to delete many snapshots from a certain dataset. The UI is terrible for this, so
|
||||
we need to use `zfs destroy`. xargs is the best way to do this since it allows parallel processing.
|
||||
|
||||
```bash
|
||||
# zfs list snapshots with:
|
||||
# -o name: only print the name
|
||||
# -S creation: sort by creation time
|
||||
# -H: don't display headers
|
||||
# -r: recurse through every child dataset
|
||||
zfs list -t snapshot enc0/archives -o name -S creation -H -r
|
||||
|
||||
# pipe it through xargs with:
|
||||
# -n 1: take only 1 argument from the pipe per command
|
||||
# -P 8: eight parallel processes
|
||||
# Also pass to zfs destroy:
|
||||
# -v: verbose
|
||||
# -n: dryrun
|
||||
zfs list -t snapshot enc0/archives -o name -S creation -H -r | xargs -n 1 -P 8 zfs destroy -v -n
|
||||
|
||||
# if that looks good you can remove the "-n"
|
||||
zfs list -t snapshot enc0/archives -o name -S creation -H -r | xargs -n 1 -P 8 zfs destroy -v
|
||||
```
|
||||
|
||||
## But First, ZFS on RPi
|
||||
|
||||
A really good backup server is an RPi running openzfs. See [the openzfs docs](https://openzfs.github.io/openzfs-docs/Getting%20Started/Ubuntu/Ubuntu%2020.04%20Root%20on%20ZFS%20for%20Raspberry%20Pi.html#step-2-setup-zfs) for more info.
|
||||
|
||||
### Pi Setup
|
||||
|
||||
Add the vault ssh CA key to your pi.
|
||||
|
||||
```bash
|
||||
curl -o /etc/ssh/trusted-user-ca-keys.pem https://vault.ducoterra.net/v1/ssh-client-signer/public_key
|
||||
|
||||
echo "TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem" >> /etc/ssh/sshd_config
|
||||
|
||||
service ssh restart
|
||||
```
|
||||
|
||||
Create a pi user.
|
||||
|
||||
```bash
|
||||
adduser pi
|
||||
usermod -a -G sudo pi
|
||||
```
|
||||
|
||||
SSH to the pi as the "pi" user. Delete the ubuntu user.
|
||||
|
||||
```bash
|
||||
killall -u ubuntu
|
||||
userdel -r ubuntu
|
||||
```
|
||||
|
||||
Disable SSH password authentication
|
||||
|
||||
```bash
|
||||
sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config
|
||||
service ssh restart
|
||||
```
|
||||
|
||||
Change the hostname.
|
||||
|
||||
```bash
|
||||
echo pi-nas > /etc/hostname
|
||||
```
|
||||
|
||||
Upgrade and restart the pi.
|
||||
|
||||
```bash
|
||||
apt update && apt upgrade -y && apt autoremove -y
|
||||
reboot
|
||||
```
|
||||
|
||||
Install ZFS.
|
||||
|
||||
```bash
|
||||
apt install -y pv zfs-initramfs
|
||||
```
|
||||
|
||||
Find the disks you want to use to create your pool
|
||||
|
||||
```bash
|
||||
fdisk -l
|
||||
```
|
||||
|
||||
Create a pool.
|
||||
|
||||
```bash
|
||||
mkdir -p /mnt/backup
|
||||
zpool create \
|
||||
-o ashift=12 \
|
||||
-O acltype=posixacl -O canmount=off -O compression=lz4 \
|
||||
-O dnodesize=auto -O normalization=formD -O relatime=on \
|
||||
-O xattr=sa -O mountpoint=/mnt/backup \
|
||||
backup ${DISK}
|
||||
```
|
||||
Reference in New Issue
Block a user