Deuxfleurs/infrastructure
Archived
24
2
Fork 2
Code Issues 22 Pull requests Projects 1 Releases Wiki Activity

Add consul backup with restic

Browse source
This commit is contained in:
Quentin 2022-01-27 16:56:02 +01:00
parent 3baa511fce
commit 84b26f347d
6 changed files with 17 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
app/backup/deploy/backup-daily.hcl
View file

@ -101,7 +101,7 @@ EOH
}
group "backup-consul" {
task "export-kv-store" {
task "consul-kv-export" {
driver = "docker"
lifecycle {
@ -111,11 +111,15 @@ EOH
config {
image = "consul:1.11.2"
network_mode = "host"
entrypoint = [ "/bin/sh", "-c" ]
NETWORK MODE HOST
args = [ "/bin/consul kv export > $NOMAD_ALLOC_DIR/consul.json" ]
}
env {
CONSUL_HTTP_ADDR = "http://consul.service.2.cluster.deuxfleurs.fr:8500"
}
resources {
cpu = 200
memory = 200
@ -129,22 +133,22 @@ EOH
}
}
task "upload-kv-store" {
task "restic-backup" {
driver = "docker"
config {
image = "restic/restic:0.12.1"
entrypoint = [ "/bin/sh", "-c" ]
args = [ "restic backup $NOMAD_ALLOC_DIR && restic forget --keep-within 1m1d --keep-within-weekly 3m --keep-within-monthly 1y ; restic prune --max-unused 50% --max-repack-size 2G ; restic check" ]
args = [ "restic backup $NOMAD_ALLOC_DIR/consul.json && restic forget --keep-within 1m1d --keep-within-weekly 3m --keep-within-monthly 1y ; restic prune --max-unused 50% --max-repack-size 2G ; restic check" ]
}
template {
data = <<EOH
AWS_ACCESS_KEY_ID={{ key "secrets/plume/backup_aws_access_key_id" }}
AWS_SECRET_ACCESS_KEY={{ key "secrets/plume/backup_aws_secret_access_key" }}
RESTIC_REPOSITORY={{ key "secrets/plume/backup_restic_repository" }}
RESTIC_PASSWORD={{ key "secrets/plume/backup_restic_password" }}
AWS_ACCESS_KEY_ID={{ key "secrets/backup/consul/backup_aws_access_key_id" }}
AWS_SECRET_ACCESS_KEY={{ key "secrets/backup/consul/backup_aws_secret_access_key" }}
RESTIC_REPOSITORY={{ key "secrets/backup/consul/backup_restic_repository" }}
RESTIC_PASSWORD={{ key "secrets/backup/consul/backup_restic_password" }}
EOH
destination = "secrets/env_vars"

1
app/backup/secrets/backup/consul/backup_aws_access_key_id Normal file
View file

@ -0,0 +1 @@
USER Backup AWS access key ID

1
app/backup/secrets/backup/consul/backup_aws_secret_access_key Normal file
View file

@ -0,0 +1 @@
USER Backup AWS secret access key

1
app/backup/secrets/backup/consul/backup_restic_password Normal file
View file

@ -0,0 +1 @@
USER Restic password to encrypt backups

1
app/backup/secrets/backup/consul/backup_restic_repository Normal file
View file

@ -0,0 +1 @@
USER Restic repository, eg. s3:https://s3.garage.tld

2
op_guide/backup_minio/README.md
View file

@ -86,7 +86,7 @@ mc admin policy set deuxfleurs $POLICY_NAME user=${NEW_ACCESS_KEY_ID}
Now it should display *only* your new bucket when running:
```bash
mc ls backup-user/
mc ls $NEW_ACCESS_KEY_ID
```
---