freedombone-backup-remote 16KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Backup to remote servers - the web of backups
  12. # License
  13. # =======
  14. #
  15. # Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
  16. #
  17. # This program is free software: you can redistribute it and/or modify
  18. # it under the terms of the GNU General Public License as published by
  19. # the Free Software Foundation, either version 3 of the License, or
  20. # (at your option) any later version.
  21. #
  22. # This program is distributed in the hope that it will be useful,
  23. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  24. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  25. # GNU General Public License for more details.
  26. #
  27. # You should have received a copy of the GNU General Public License
  28. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  29. PROJECT_NAME='freedombone'
  30. COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
  31. CONFIG_FILE=$HOME/${PROJECT_NAME}.cfg
  32. export TEXTDOMAIN=${PROJECT_NAME}-backup-remote
  33. export TEXTDOMAINDIR="/usr/share/locale"
  34. # Temporary location for data to be backed up to other servers
  35. SERVER_DIRECTORY=/root/remotebackup
  36. ADMIN_USERNAME=$(cat $COMPLETION_FILE | grep "Admin user" | awk -F ':' '{print $2}')
  37. ADMIN_NAME=$(getent passwd $ADMIN_USERNAME | cut -d: -f5 | cut -d, -f1)
  38. ADMIN_EMAIL_ADDRESS=${ADMIN_USERNAME}@${HOSTNAME}
  39. if [ ! -f /etc/ssl/private/backup.key ]; then
  40. echo $"Creating backup key"
  41. ${PROJECT_NAME}-addcert -h backup --dhkey 2048
  42. fi
  43. if [ ! -f /home/${ADMIN_USERNAME}/backup.list ]; then
  44. exit 1
  45. fi
  46. # MariaDB password
  47. DATABASE_PASSWORD=''
  48. if [ -f /root/dbpass ]; then
  49. DATABASE_PASSWORD=$(cat /root/dbpass)
  50. fi
  51. # local directory where the backup will be made
  52. if [ ! -d $SERVER_DIRECTORY ]; then
  53. mkdir $SERVER_DIRECTORY
  54. fi
  55. if [ ! -d $SERVER_DIRECTORY/backup ]; then
  56. mkdir -p $SERVER_DIRECTORY/backup
  57. fi
  58. function backup_directory_to_friend {
  59. BACKUP_KEY_EXISTS=$(gpg --list-keys "$ADMIN_NAME (backup key)")
  60. if [ ! "$?" = "0" ]; then
  61. echo $"Backup key could not be found"
  62. exit 43382
  63. fi
  64. ADMIN_BACKUP_KEY_ID=$(gpg --list-keys "$ADMIN_NAME (backup key)" | grep 'pub ' | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
  65. if [ ! -d $SERVER_DIRECTORY/backup/${2} ]; then
  66. mkdir -p $SERVER_DIRECTORY/backup/${2}
  67. fi
  68. obnam force-lock -r $SERVER_DIRECTORY/backup/${2} --encrypt-with $ADMIN_BACKUP_KEY_ID ${1}
  69. obnam backup -r $SERVER_DIRECTORY/backup/${2} --encrypt-with $ADMIN_BACKUP_KEY_ID ${1}
  70. obnam forget --keep=30d -r $SERVER_DIRECTORY/backup/${2} --encrypt-with $ADMIN_BACKUP_KEY_ID
  71. if [ ! "$?" = "0" ]; then
  72. if [[ ${1} == "/root/temp"* || ${1} == *"tempbackup" ]]; then
  73. shred -zu /root/temp${2}/*
  74. rm -rf /root/temp${2}
  75. fi
  76. # Send a warning email
  77. echo "Unable to backup ${2}" | mail -s "${PROJECT_NAME} backup to friends" $ADMIN_EMAIL_ADDRESS
  78. exit 853
  79. fi
  80. if [[ ${1} == "/root/temp"* || ${1} == *"tempbackup" ]]; then
  81. shred -zu /root/temp${2}/*
  82. rm -rf /root/temp${2}
  83. fi
  84. }
  85. function backup_database_to_friend {
  86. if [ ${#DATABASE_PASSWORD} -lt 2 ]; then
  87. echo $"No MariaDB password was given"
  88. exit 5783
  89. fi
  90. if [ ! -d $SERVER_DIRECTORY/backup/${1} ]; then
  91. mkdir -p $SERVER_DIRECTORY/backup/${1}
  92. fi
  93. if [ ! -d $SERVER_DIRECTORY/backup/${1}data ]; then
  94. mkdir -p $SERVER_DIRECTORY/backup/${1}data
  95. fi
  96. if [ ! -d /root/temp${1}data ]; then
  97. mkdir -p /root/temp${1}data
  98. fi
  99. echo "Obtaining ${1} database backup"
  100. mysqldump --password=$DATABASE_PASSWORD ${1} > /root/temp${1}data/${1}.sql
  101. if [ ! -s /root/temp${1}data/${1}.sql ]; then
  102. echo $"${1} database could not be saved"
  103. shred -zu /root/temp${1}data/*
  104. rm -rf /root/temp${1}data
  105. # Send a warning email
  106. echo $"Unable to export ${1} database" | mail -s $"${PROJECT_NAME} backup to friends" $ADMIN_EMAIL_ADDRESS
  107. exit 5738
  108. fi
  109. }
  110. # configuration files
  111. echo $"Backing up ${PROJECT_NAME} configuration files"
  112. if [ ! -d /root/tempbackupconfig ]; then
  113. mkdir -p /root/tempbackupconfig
  114. fi
  115. cp -f $CONFIG_FILE /root/tempbackupconfig
  116. cp -f $COMPLETION_FILE /root/tempbackupconfig
  117. backup_directory_to_friend /root/tempbackupconfig config
  118. # Backup user files
  119. for d in /home/*/ ; do
  120. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  121. if [[ $USERNAME != "git" ]]; then
  122. # personal settings
  123. if [ -d /home/$USERNAME/personal ]; then
  124. echo $"Backing up personal settings for $USERNAME"
  125. backup_directory_to_friend /home/$USERNAME/personal personal/$USERNAME
  126. fi
  127. # gpg keys
  128. if [ -d /home/$USERNAME/.gnupg ]; then
  129. echo $"Backing up gpg keys for $USERNAME"
  130. backup_directory_to_friend /home/$USERNAME/.gnupg gnupg/$USERNAME
  131. fi
  132. # ssh keys
  133. if [ -d /home/$USERNAME/.ssh ]; then
  134. echo $"Backing up ssh keys for $USERNAME"
  135. backup_directory_to_friend /home/$USERNAME/.ssh ssh/$USERNAME
  136. fi
  137. # config files
  138. if [ -d /home/$USERNAME/.config ]; then
  139. echo $"Backing up config files for $USERNAME"
  140. backup_directory_to_friend /home/$USERNAME/.config config/$USERNAME
  141. fi
  142. # mutt settings
  143. if [ -f /home/$USERNAME/.muttrc ]; then
  144. echo $"Backing up Mutt settings for $USERNAME"
  145. if [ ! -d /home/$USERNAME/tempbackup ]; then
  146. mkdir -p /home/$USERNAME/tempbackup
  147. fi
  148. cp /home/$USERNAME/.muttrc /home/$USERNAME/tempbackup
  149. if [ -f /etc/Muttrc ]; then
  150. cp /etc/Muttrc /home/$USERNAME/tempbackup
  151. fi
  152. backup_directory_to_friend /home/$USERNAME/tempbackup mutt/$USERNAME
  153. fi
  154. # procmail settings
  155. if [ -f /home/$USERNAME/.procmailrc ]; then
  156. echo $"Backing up procmail settings for $USERNAME"
  157. if [ ! -d /home/$USERNAME/tempbackup ]; then
  158. mkdir -p /home/$USERNAME/tempbackup
  159. fi
  160. cp /home/$USERNAME/.procmailrc /home/$USERNAME/tempbackup
  161. backup_directory_to_friend /home/$USERNAME/tempbackup procmail/$USERNAME
  162. fi
  163. # spamassassin settings
  164. if [ -d /home/$USERNAME/.spamassassin ]; then
  165. echo $"Backing up spamassassin settings for $USERNAME"
  166. backup_directory_to_friend /home/$USERNAME/.spamassassin spamassassin/$USERNAME
  167. fi
  168. # email
  169. if [ -d /home/$USERNAME/Maildir ]; then
  170. echo $"Creating an email archive"
  171. if [ ! -d /root/backupemail/$USERNAME ]; then
  172. mkdir -p /root/backupemail/$USERNAME
  173. fi
  174. tar -czvf /root/backupemail/$USERNAME/maildir.tar.gz /home/$USERNAME/Maildir
  175. echo $"Backing up emails for $USERNAME"
  176. backup_directory_to_friend /root/backupemail/$USERNAME mail/$USERNAME
  177. fi
  178. fi
  179. done
  180. # Backup Let's Encrypt
  181. if [ -d /etc/letsencrypt ]; then
  182. echo $"Backing up Lets Encrypt settings"
  183. backup_directory_to_friend /etc/letsencrypt letsencrypt
  184. fi
  185. # Backup gnusocial
  186. if grep -q "GNU Social domain" $COMPLETION_FILE; then
  187. MICROBLOG_DOMAIN_NAME=$(cat $COMPLETION_FILE | grep "GNU Social domain" | awk -F ':' '{print $2}')
  188. if [ -d /var/www/${MICROBLOG_DOMAIN_NAME} ]; then
  189. backup_database_to_friend gnusocial
  190. backup_directory_to_friend /root/tempgnusocialdata gnusocialdata
  191. echo $"Backing up GNU social installation"
  192. backup_directory_to_friend /var/www/${MICROBLOG_DOMAIN_NAME}/htdocs gnusocial
  193. else
  194. echo $"GNU Social domain specified but not found in /var/www/${MICROBLOG_DOMAIN_NAME}"
  195. exit 6327
  196. fi
  197. fi
  198. # backup hubzilla
  199. if grep -q "Hubzilla domain" $COMPLETION_FILE; then
  200. HUBZILLA_DOMAIN_NAME=$(cat $COMPLETION_FILE | grep "Hubzilla domain" | awk -F ':' '{print $2}')
  201. if [ -d /var/www/${HUBZILLA_DOMAIN_NAME} ]; then
  202. backup_database_to_friend hubzilla
  203. backup_directory_to_friend /root/temphubzilladata hubzilladata
  204. echo "Backing up Hubzilla installation"
  205. backup_directory_to_friend /var/www/${HUBZILLA_DOMAIN_NAME}/htdocs hubzilla
  206. else
  207. echo $"Hubzilla domain specified but not found in /var/www/${HUBZILLA_DOMAIN_NAME}"
  208. exit 2578
  209. fi
  210. fi
  211. # backup owncloud
  212. if [ -d /etc/owncloud ]; then
  213. backup_database_to_friend owncloud
  214. backup_directory_to_friend /root/tempownclouddata ownclouddata
  215. echo $"Backing up Owncloud data"
  216. backup_directory_to_friend /var/lib/owncloud owncloud
  217. backup_directory_to_friend /etc/owncloud owncloud2
  218. fi
  219. # backup gogs
  220. if [ -d /home/git/go/src/github.com/gogits ]; then
  221. backup_database_to_friend gogs
  222. backup_directory_to_friend /root/tempgogsdata gogsdata
  223. echo $"Obtaining Gogs settings backup"
  224. backup_directory_to_friend /home/git/go/src/github.com/gogits/gogs/custom gogs
  225. echo $"Obtaining Gogs repos backup"
  226. mv /home/git/gogs-repositories/*.git /home/git/gogs-repositories/bob
  227. backup_directory_to_friend /home/git/gogs-repositories gogsrepos
  228. echo $"Obtaining Gogs authorized_keys backup"
  229. backup_directory_to_friend /home/git/.ssh gogsssh
  230. fi
  231. if [ -d /etc/dokuwiki ]; then
  232. echo $"Backing up wiki"
  233. backup_directory_to_friend /var/lib/dokuwiki wiki
  234. backup_directory_to_friend /etc/dokuwiki wiki2
  235. fi
  236. # Backup blog
  237. if grep -q "Blog domain" $COMPLETION_FILE; then
  238. FULLBLOG_DOMAIN_NAME=$(cat $COMPLETION_FILE | grep "Blog domain" | awk -F ':' '{print $2}')
  239. if [ -d /var/www/${FULLBLOG_DOMAIN_NAME} ]; then
  240. echo $"Backing up blog"
  241. backup_directory_to_friend /var/www/${FULLBLOG_DOMAIN_NAME}/htdocs blog
  242. else
  243. echo $"Blog domain specified but not found in /var/www/${FULLBLOG_DOMAIN_NAME}"
  244. exit 2578
  245. fi
  246. fi
  247. # Backup certificates
  248. if [ -d /etc/ssl ]; then
  249. echo $"Backing up certificates"
  250. backup_directory_to_friend /etc/ssl ssl
  251. fi
  252. # Backup the public mailing list
  253. if [ -d /var/spool/mlmmj ]; then
  254. echo $"Backing up the public mailing list"
  255. backup_directory_to_friend /var/spool/mlmmj mailinglist
  256. fi
  257. # Backup xmpp settings
  258. if [ -d /var/lib/prosody ]; then
  259. echo $"Backing up the XMPP settings"
  260. backup_directory_to_friend /var/lib/prosody xmpp
  261. fi
  262. # Backup web sites
  263. if [ -d /etc/nginx ]; then
  264. echo $"Backing up web settings"
  265. backup_directory_to_friend /etc/nginx/sites-available web
  266. fi
  267. # Backup admin user README file
  268. if [ -f /home/$ADMIN_USERNAME/README ]; then
  269. echo $"Backing up README"
  270. if [ ! -d /home/$ADMIN_USERNAME/tempbackup ]; then
  271. mkdir -p /home/$ADMIN_USERNAME/tempbackup
  272. fi
  273. cp -f /home/$ADMIN_USERNAME/README /home/$ADMIN_USERNAME/tempbackup
  274. backup_directory_to_friend /home/$ADMIN_USERNAME/tempbackup readme
  275. fi
  276. # Backup IPFS
  277. if [ -d /home/$ADMIN_USERNAME/.ipfs ]; then
  278. echo $"Backing up IPFS"
  279. backup_directory_to_friend /home/$ADMIN_USERNAME/.ipfs ipfs
  280. fi
  281. # Backup DLNA cache
  282. if [ -d /var/cache/minidlna ]; then
  283. echo $"Backing up DLNA cache"
  284. backup_directory_to_friend /var/cache/minidlna dlna
  285. fi
  286. # Backup VoIP settings
  287. if [ -f /etc/mumble-server.ini ]; then
  288. echo $"Backing up VoIP settings"
  289. if [ ! -d /root/tempvoipbackup ]; then
  290. mkdir -p /root/tempvoipbackup
  291. fi
  292. cp -f /etc/mumble-server.ini /root/tempvoipbackup
  293. cp -f /var/lib/mumble-server/mumble-server.sqlite /root/tempvoipbackup
  294. cp -f /etc/sipwitch.conf /root/tempvoipbackup
  295. backup_directory_to_friend /root/tempvoipbackup voip
  296. fi
  297. # Backup Tox node settings
  298. if [ -d /var/lib/tox-bootstrapd ]; then
  299. echo "Backing up Tox node settings"
  300. if [ -d /var/lib/tox-bootstrapd/Maildir ]; then
  301. rm -rf /var/lib/tox-bootstrapd/Maildir
  302. fi
  303. cp /etc/tox-bootstrapd.conf /var/lib/tox-bootstrapd
  304. backup_directory_to_friend /var/lib/tox-bootstrapd tox
  305. fi
  306. # MariaDB settings
  307. if [ ${#DATABASE_PASSWORD} -gt 1 ]; then
  308. if [ ! -d /root/tempmariadb ]; then
  309. mkdir /root/tempmariadb
  310. fi
  311. mysqldump --password=$DATABASE_PASSWORD mysql user > /root/tempmariadb/mysql.sql
  312. if [ ! -s /root/tempmariadb/mysql.sql ]; then
  313. echo $"Unable to backup MariaDB settings"
  314. rm -rf /root/tempmariadb
  315. # Send a warning email
  316. echo $"Unable to export database settings" | mail -s "${PROJECT_NAME} backup to friends" $ADMIN_EMAIL_ADDRESS
  317. exit 653
  318. fi
  319. echo "$DATABASE_PASSWORD" > /root/tempmariadb/db
  320. chmod 400 /root/tempmariadb/db
  321. backup_directory_to_friend /root/tempmariadb mariadb
  322. fi
  323. # For each remote server
  324. while read remote_server
  325. do
  326. # Get the server and its password
  327. # Format is:
  328. # username@domain:/home/username <port number> <ssh password>
  329. REMOTE_SERVER=$(echo "${remote_server}" | awk -F ' ' '{print $1}')
  330. if [ $REMOTE_SERVER ]; then
  331. REMOTE_DOMAIN=$(echo "${remote_server}" | awk -F ':' '{print $1}' | awk -F '@' '{print $2}')
  332. REMOTE_SSH_PORT=$(echo "${remote_server}" | awk -F ' ' '{print $2}')
  333. REMOTE_PASSWORD=$(echo "${remote_server}" | awk -F ' ' '{print $3}')
  334. NOW=$(date +"%Y-%m-%d %H:%M:%S")
  335. echo "$NOW Starting backup to $REMOTE_SERVER" >> /var/log/remotebackups.log
  336. # Social key management
  337. for d in /home/*/ ; do
  338. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  339. if [[ $USERNAME != "git" ]]; then
  340. if [ -d /home/$USERNAME/.gnupg_fragments ]; then
  341. if [ $REMOTE_DOMAIN ]; then
  342. cd /home/$USERNAME/.gnupg_fragments
  343. no_of_shares=$(ls -afq keyshare.asc.* | wc -l)
  344. if (( no_of_shares > 0 )); then
  345. # Pick a share index based on the domain name
  346. # This ensures that the same share is always given to the same domain
  347. sharenumstr=$(md5sum <<< "$REMOTE_DOMAIN")
  348. share_index=$(echo $((0x${sharenumstr%% *} % ${no_of_shares})) | tr -d -)
  349. # get the share filename
  350. share_files=(/home/$USERNAME/.gnupg_fragments/keyshare.asc.*)
  351. share_filename=${share_files[share_index]}
  352. # create a temp directory containing the share
  353. mkdir -p /home/$USERNAME/tempkey/.gnupg_fragments_$USERNAME
  354. cp $share_filename /home/$USERNAME/tempkey/.gnupg_fragments_$USERNAME/
  355. # copy the fragments directory to the remote server
  356. /usr/bin/sshpass -p $REMOTE_PASSWORD scp -r -P $REMOTE_SSH_PORT /home/$USERNAME/tempkey/.gnupg_fragments_$USERNAME $REMOTE_SERVER
  357. if [ ! "$?" = "0" ]; then
  358. # Send a warning email
  359. echo "Key share to $REMOTE_SERVER failed" | mail -s "${PROJECT_NAME} social key management" $MY_EMAIL_ADDRESS
  360. fi
  361. # remove the temp file/directory
  362. shred -zu /home/$USERNAME/tempkey/.gnupg_fragments_$USERNAME/*
  363. rm -rf /home/$USERNAME/tempkey
  364. # Send a confirmation email
  365. echo "Key shared to $REMOTE_SERVER" | mail -s "${PROJECT_NAME} social key management" $MY_EMAIL_ADDRESS
  366. fi
  367. fi
  368. fi
  369. fi
  370. done
  371. rsync -ratlzv --rsh="/usr/bin/sshpass -p $REMOTE_PASSWORD ssh -p $REMOTE_SSH_PORT -o StrictHostKeyChecking=no" $SERVER_DIRECTORY/backup $REMOTE_SERVER
  372. if [ ! "$?" = "0" ]; then
  373. echo "$NOW Backup to $REMOTE_SERVER failed" >> /var/log/remotebackups.log
  374. # Send a warning email
  375. echo "Backup to $REMOTE_SERVER failed" | mail -s "${PROJECT_NAME} backup to friends" $ADMIN_EMAIL_ADDRESS
  376. else
  377. echo "$NOW Backed up to $REMOTE_SERVER" >> /var/log/remotebackups.log
  378. fi
  379. fi
  380. done < /home/${ADMIN_USERNAME}/backup.list
  381. exit 0