Support remote borg repos

[Zoey2936]

I think supporting remote borg repos would be a good Idea, because then it would be possible to save the backups on another server/storage provider and with that the files would be also secured if the entire system crashes. Or the Disk of the backups dies. Or something else happens.
What's your opinion @szaimen ?

[szaimen]

I fear this is out of scope for AIO.

However you have multiple options to achieve this:

• Mount a network FS like SSHFS, SMB or NFS in the directory that you enter in AIO as backup directory
• Use rsync or rclone for syncing the borg backup archive that AIO creates locally to a remote target (make sure to lock the backup archive correctly before starting the sync; search for "aio-lockfile"; you can find a local example script here: https://github.com/nextcloud/all-in-one#sync-the-backup-regularly-to-another-drive)
• create your own backup solution using a script and borg, borgmatic or any other to backup tool for backing up to a remote target (make sure to stop and start the AIO containers correctly following https://github.com/nextcloud/all-in-one#how-to-enable-automatic-updates-without-creating-a-backup-beforehand)
• Additionally, there is the backup app for remote backups.

[FlattusBlastus]

For those who have pcloud: webdav.pcloud.com works. Mount it and cp your borg stuff.

[timdiels]

@szaimen Would you be open to a PR that allows setting BORG_REPO? It doesn't seem too difficult (other than overhead of writing tests, documentation and setting up a dev env...) or am I missing something?

Is your feature request related to a problem? Please describe.

I'd like to backup/restore via the UI, resist ransomware and store the backups remotely without storing a local (compressed) copy of the nextcloud data.

Describe the solution you'd like

Add a remote option to the official backups. To enable it:

• Point BORG_REPO to a remote server (via UI, either a new field or the existing DB path field)
• The borg container should create an ssh key on a volume, which it will use in the borg commands
• When failing to connect to borg (guaranteed the first time because the key pair needs to be authorized first), show the public key to the admin somewhere
• Admin manually grants access to the remote repo with the public key on e.g. borgbase
• Next backup run should work

At first glance, seems what needs to happen is:

• Allow admin to specify BORG_REPO; defaults to the old local behaviour for backwards compatibility
• Instead of passing a BORG_BACKUP_DIRECTORY arg to borg commands, use BORG_REPO env var which does not imply it's a directory unlike the other var.
• Remove assumptions that borg backups are in a local directory: seems mostly just the config file
• ...

Describe alternatives you've considered

https://github.com/nextcloud/all-in-one?tab=readme-ov-file#are-remote-borg-backups-supported

• Mount a network file system: Ransomware can encrypt the backups on the network storage.
• rclone: Ransomware and stores a local copy of the borg repo
• borg backup the local repo to borgbase: Stores a local compressed copy of the nextcloud data as at least 1 borg backup
• create your own solution: backups cannot be managed through the UI and others will have to reinvent my work

[asavageiv]

I think this would be a great direction to go

[timdiels]

I opened a PR for it #4804

[pktiuk]

I opened a PR for it #4804

That's great news. I can't wait for finishing and merging it.

[gbertolottiKS]

Hi!
We were finally able to automatically synchronize the backups created by Nextcloud AIO with Borg on BorgBase, effectively obtaining a remote copy that is always up-to-date 🎉🎉.

We have tried to document step by step everything that needs to be done, from creating an account on BorgBase to configuring the crontab.

We hope it will be useful, enjoy!

BorgBase account creation

Register at https://www.borgbase.com and select a plan from those offered. However, all of them allow you to exceed the GB allowance by paying an additional fee.

SSH key pair creation

In order to perform any operation on BorgBase remotely, you need to create an SSH key pair (which can also be used for SFTP operations).

Follow the official guide: https://docs.borgbase.com/faq/ssh/

⚠⚠⚠
Remember that a key pair must be generated for each server you want to connect, and for the user who will connect to the remote repository. As for Nextcloud backups, since they are created with root as owner, you must create a key pair for the root user
⚠⚠⚠

Creating repos on BorgBase

1. create a new repository by going to Repositories > New Repo
2. choose a name for the repo, the region, and the type (i.e. Borg)
3. under the Access tab, choose the root SSH key and set it in the Full Access field (required for SFTP)
4. under the Advanced tab, enable the SFTP flag

Manual import/export test

Import

Follow the official guide: https://docs.borgbase.com/setup/import/#import-existing-repository.

Two clarifications:

• remember to perform the operations by connecting from the terminal on the source machine as root user (in the case of Nextcloud AIO this is necessary because the backups are created by the root user)
• the command to be used must have the following format:

sftp <user-name>@<user-name>.repo.borgbase.com:repo

where <user-name> is the name of the user associated with the repo

Export

Follow the official guide: https://docs.borgbase.com/setup/import/#export-existing-repository.

RClone installation and configuration

The following guide refers to Ubuntu servers; for other OS follow the official guide: https://rclone.org/install/

1. install with the command: sudo apt install rclone.
2. check the success of the operation: rclone --version
3. start the configuration by running the command: rclone config.

Leave the default for all options, apart from the following info:

• name: set the name you want of this configuration, e.g. "borgbase"
• type = sftp
• host: host you connect to via SSH/SFTP
• user: user you connect with via SSH/SFTP
• key_file = ~/.ssh/id_ed25519 (unless another path was specified when creating the keys)

Example:

Test sync upload to BorgBase

Follow the command specified in the official guide: https://docs.borgbase.com/setup/import/#using-rclone .

In particular, the command must have the following format:

rclone sync -v <local-path-borg-backup> <config-rclone-name>:repo

where <local-path-borg-backup> is the path where the folder of the Borg backup made by Nextcloud is located; the folder is configurable from the Nextcloud AIO interface. <config-rclone-name> is the name assigned when configuring rclone

Example:

rclone sync -v /mnt/backup/borg/ borgbase:repo

Scheduled job creation

The following steps have been adapted from the following documentation: https://github.com/nextcloud/all-in-one#sync-the-backup-regularly-to-another-drive

Create scripts

• create a shell file called e.g. backup-script.sh under e.g. the /root folder
• write in it (using e.g. the text editor Nano) the following script template

* /bin/bash

# Change all the variables below to suit your needs:
SOURCE_DIRECTORY="/mnt/backup/borg"
RCLONE_CONFIG="borgbase"
TARGET_DIRECTORY="repo"

########################################
# DO NOT modify any of the following! #
########################################

if [ "$EUID" -ne 0 ]; then 
    echo "run as root"
    output 1
fi

if ! [ -d "$SOURCE_DIRECTORY" ]; then
    echo "The root directory does not exist".
    exit 1
fi

if [ -z "$(ls -A "$SOURCE_DIRECTORY/")" ]; then
    echo "The source directory is empty, which is not allowed".
    exit 1
fi

if [ -f "$SOURCE_DIRECTORY/lock.roster" ]; then
    echo "Unable to execute the script as the backup archive is currently modified. Please try again later".
    exit 1
fi

if [ -f "$SOURCE_DIRECTORY/aio-lockfile" ]; then
    echo "Cannot continue because aio-lockfile already exists".
    exit 1
fi

touch "$SOURCE_DIRECTORY/aio-lockfile".


if ! rclone sync --human-readable --exclude aio-lockfile "$SOURCE_DIRECTORY/" "$RCLONE_CONFIG:$TARGET_DIRECTORY"; then
    echo "Failed to synchronise the backup repository with the target directory".
    rm "$SOURCE_DIRECTORY/aio-lockfile"
    exit 1
fi

rm "$SOURCE_DIRECTORY/aio-lockfile"

if docker ps --format "{{.Names}}" | grep "^nextcloud-aio-nextcloud$"; then
    docker exec -en nextcloud-aio-nextcloud bash /notify.sh "Rclone backup successful!". "Synchronised the backup repository successfully".
else
    echo "Synchronised the backup repository successfully".
fi

where SOURCE_DIRECTORY is the path where Nextcloud backups are saved (this is configurable from the AIO interface), and RCLONE_CONFIG is the name of the previously defined RClone configuration

• Give the correct permissions to the file with the commands:

sudo chown root:root /root/backup-script.sh

sudo chmod 700 /root/backup-script.sh

Set crontab

• Open the cronjob: sudo crontab -u root -e
• set the desired schedule; for example, if you want to run it every day at 11pm, run:

0 23 * * * /root/backup-script.sh

---

CC @szaimen for your amazing work! If you think it would be useful, we can somehow make this guide more 'official'.

[szaimen]

Wow @gbertolottiKS , thanks a lot, this looks great! :)

Feel free to create a wiki article out of this: https://github.com/nextcloud/all-in-one/discussions/new?category=wiki. I would then add a link to it directly from the readme :)

[gbertolottiKS]

Done! #2247
Let me know if it's okay

[szaimen]

Thanks! :)

[szaimen]

This is now implemented with v10.0.0 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel