How I Handle Backups

The normal rule is 3-2-1 - 3 backups, 2 onsite, 1 offsite. However I do 2 offsite only. I may do a third offsite, but not sure just yet.

I use Scaleway’s C14 Cold Storage. I used OVH Archive, but the upload speeds were super slow.

In proxmox I edited the /etc/vzdump.conf and added script: /path/to/my/perl/script.pl at the bottom. When I run vzdump from the ui or proxmox kicks off a backup cron the script will get ran.

Originally I was using a simple python script to backup vms to the cloud, but since I changed to this perl script.

#!/usr/bin/perl -w

# from https://gitlab.com/mikeramsey/proxmox-vzdump-hook-script.pl/-/blob/master/vzdump-hook-script.pl

# example hook script for vzdump (--script option)

use strict;

print "HOOK: " . join (' ', @ARGV) . "\n";

my $phase = shift;

my $GPGKey = "REDACTED";

if ($phase eq 'job-start' ||

    $phase eq 'job-end'  ||

    $phase eq 'job-abort') {

    my $dumpdir = $ENV{DUMPDIR};

    my $storeid = $ENV{STOREID};

    print "HOOK-ENV: dumpdir=$dumpdir;storeid=$storeid\n";

} elsif ($phase eq 'backup-start' ||

     $phase eq 'backup-end' ||

     $phase eq 'backup-abort' ||

     $phase eq 'log-end' ||

     $phase eq 'pre-stop' ||

     $phase eq 'pre-restart' ||

     $phase eq 'post-restart') {

    my $mode = shift; # stop/suspend/snapshot

    my $vmid = shift;

    my $vmtype = $ENV{VMTYPE}; # lxc/qemu

    my $dumpdir = $ENV{DUMPDIR};

    my $storeid = $ENV{STOREID};

    my $hostname = $ENV{HOSTNAME};

    my $target = $ENV{TARGET};

    my $logfile = $ENV{LOGFILE};

    print "HOOK-ENV: vmtype=$vmtype;dumpdir=$dumpdir;storeid=$storeid;hostname=$hostname;target=$target;logfile=$logfile\n";

    if ($phase eq 'backup-end') {

        # encrypt the backup using gpg

        print "encrypting $target";

        system ("gpg -r $GPGKey -e $target") == 0 ||

            die "encrypting $target failed";

        # upload to c14 cold

        print "Uploading ${target}.gpg to c14-cold-fr";

        system ("rclone copy --config /root/.config/rclone/rclone.conf -P ${target}.gpg c14-cold-fr:/REDACTED/MYDIR") == 0 ||

            die "uploading $target to c14-cold-fr failed";

         # upload to c14 cold

        print "Uploading ${target}.gpg to c14-cold-nl";

        system ("rclone copy --config /root/.config/rclone/rclone.conf -P ${target}.gpg c14-cold-nl:/REDACTED --transfers 16 --buffer-size 512") == 0 ||

            die "uploading $target to c14-cold-nl failed";

        print "Deleting ${target}.gpg";

        system ("rm ${target}.gpg") == 0 ||

            die "deleting ${target}.gpg failed";

        # print "Deleting $target and ${target}.gpg";

        # system ("rm $target ${target}.gpg") == 0 ||

        #     die "deleting $target ${target}.gpg failed";

    }

} else {

    die "got unknown phase '$phase'";

}

exit (0);

Here’s the rclone config that I use.

[c14-cold-fr]

type = s3

provider = Other

env_auth = false

access_key_id = REDACTED

secret_access_key = REDACTED

region = fr-par

endpoint = https://s3.fr-par.scw.cloud

location_constraint = fr-par

acl = private

bucket_acl = private

chunk_size = 25M

upload_concurrency = 100

storage_class = GLACIER

[c14-cold-nl]

type = s3

provider = Other

env_auth = false

access_key_id = REDACTED

secret_access_key = REDACTED

region = nl-ams

endpoint = https://s3.nl-ams.scw.cloud

location_constraint = nl-ams

acl = private

bucket_acl = private

chunk_size = 25M

upload_concurrency = 100

storage_class = GLACIER

Instead of letting rclone handle the encryption (tbh I’m not familiar with it) I just run a gpg command to encrypt the backup.

until next time