diff options
Diffstat (limited to 'manifests')
| -rw-r--r-- | manifests/client.pp | 38 | ||||
| -rw-r--r-- | manifests/dup.pp | 24 | ||||
| -rw-r--r-- | manifests/generate_sshkey.pp | 33 | ||||
| -rw-r--r-- | manifests/mysql.pp | 3 | ||||
| -rw-r--r-- | manifests/nagios_plugin/duplicity.pp | 45 | ||||
| -rw-r--r-- | manifests/pgsql.pp | 2 | ||||
| -rw-r--r-- | manifests/rdiff.pp | 19 | ||||
| -rw-r--r-- | manifests/rsync.pp | 87 | ||||
| -rw-r--r-- | manifests/server.pp | 80 |
9 files changed, 275 insertions, 56 deletions
diff --git a/manifests/client.pp b/manifests/client.pp index 287b02f..c41f6e7 100644 --- a/manifests/client.pp +++ b/manifests/client.pp @@ -46,8 +46,10 @@ class backupninja::client::defaults { class backupninja::client inherits backupninja::client::defaults { define key( - $user = false, $host = false, $installkey=false, $keyowner=false, - $keygroup=false, $keystore=false, $keytype=false) + $user = false, $host = false, $createkey=false, $installkey=false, + $keyowner=false, $keygroup=false, $keystore=false, $keystorefspath='', + $keytype=false, + $keydest=false, $keydestname=false ) { $real_user = $user ? { false => $name, @@ -78,9 +80,23 @@ class backupninja::client inherits backupninja::client::defaults { false => "${backupninja::client::defaults::real_keytype}", default => $keytype, } + $key_dest = $keydest ? { + false => "${backupninja::client::defaults::real_keydestination}", + default => $keydest, + } + $key_dest_name = $keydestname ? { + false => "id_$key_type", + default => $keydestname, + } + $key_dest_file = "${key_dest}/${key_dest_name}" - $key_dest = "${backupninja::client::defaults::real_keydestination}" - $key_dest_file = "$key_dest/id_$key_type" + if $createkey == true { + if $keystorefspath == false { + err("need to define a destination directory for sshkey creation!") + } + $ssh_keys = ssh_keygen("${keystorefspath}/${key_dest_name}") + } + case $install_key { true: { @@ -92,7 +108,7 @@ class backupninja::client inherits backupninja::client::defaults { } if !defined(File["$key_dest_file"]) { file { "$key_dest_file": - source => "${key_store}/${real_user}_id_${key_type}", + source => "${key_store}/${key_dest_name}", mode => 0400, owner => $key_owner, group => $key_group, require => File["$key_dest"], } @@ -109,7 +125,7 @@ class backupninja::client::maildir inherits backupninja::client::defaults { package { 'rsync': ensure => $rsync_ensure_version, } - } + } } class backupninja::client::rdiff_backup inherits backupninja::client::defaults { @@ -151,3 +167,13 @@ class backupninja::client::sys inherits backupninja::client::defaults { default: {} } } + +class backupninja::client::rsync inherits backupninja::client::defaults { + + if !defined(Package["rsync"]) { + if $rsync_ensure_version == '' { $rsync_ensure_version = 'installed' } + package { 'rsync': + ensure => $rsync_ensure_version, + } + } +} diff --git a/manifests/dup.pp b/manifests/dup.pp index 23da8cd..5ffce29 100644 --- a/manifests/dup.pp +++ b/manifests/dup.pp @@ -79,7 +79,10 @@ define backupninja::duplicity( $order = 90, $destuser = false, # configs to backupninja client $backupkeystore = false, + $backupkeystorefspath = '', $backupkeytype = "rsa", + $backupkeydest = false, + $backupkeydestname = false, # options to backupninja server sandbox $ssh_dir_manage = true, $ssh_dir = false, @@ -87,6 +90,7 @@ define backupninja::duplicity( $order = 90, $installuser = true, $backuptag = false, # key options + $createkey = false, $installkey = true ) { # the client with configs for this machine @@ -95,7 +99,7 @@ define backupninja::duplicity( $order = 90, case $desthost { false: { err("need to define a destination host for remote backups!") } } case $destdir { false: { err("need to define a destination directory for remote backups!") } } case $password { false: { err("a password is necessary either to unlock the GPG key, or for symmetric encryption!") } } - + # guarantees there's a configured backup space for this backup backupninja::server::sandbox { "${user}-${name}": user => $destuser, @@ -109,14 +113,18 @@ define backupninja::duplicity( $order = 90, backupkeys => $backupkeystore, keytype => $backupkeytype, } - + # the client's ssh key backupninja::client::key { "${destuser}-${name}": - user => $destuser, - host => $desthost, - installkey => $installkey, - keytype => $backupkeytype, - keystore => $backupkeystore, + user => $destuser, + host => $desthost, + createkey => $createkey, + installkey => $installkey, + keytype => $backupkeytype, + keystore => $backupkeystore, + keystorefspath => $backupkeystorefspath, + keydest => $backupkeydest, + keydestname => $backupkeydestname } # the backupninja rule for this duplicity backup @@ -129,4 +137,4 @@ define backupninja::duplicity( $order = 90, require => File["${backupninja::client::defaults::configdir}"] } } - + diff --git a/manifests/generate_sshkey.pp b/manifests/generate_sshkey.pp new file mode 100644 index 0000000..a3008e5 --- /dev/null +++ b/manifests/generate_sshkey.pp @@ -0,0 +1,33 @@ +define backupninja::generate_sshkey( + $ssh_key_basepath = '/etc/puppet/modules/keys/files/backupkeys', +){ + + # generate backupninja ssh keypair + $ssh_key_name = "backup_${::hostname}_id_rsa" + $ssh_keys = ssh_keygen("${ssh_key_basepath}/${ssh_key_name}") + $public = split($ssh_keys[1],' ') + $public_type = $public[0] + $public_key = $public[1] + + file { '/root/.ssh': + ensure => directory, + owner => 'root', + group => 'root', + mode => '0600'; + } + + # install ssh keypair on client + file { "/root/.ssh/$ssh_key_name": + content => $ssh_keys[0], + owner => root, + group => 0, + mode => '0600'; + } + + file { "/root/.ssh/$ssh_key_name.pub": + content => $public_key, + owner => root, + group => 0, + mode => '0666'; + } +} diff --git a/manifests/mysql.pp b/manifests/mysql.pp index f968cf9..8e33e8e 100644 --- a/manifests/mysql.pp +++ b/manifests/mysql.pp @@ -18,7 +18,8 @@ define backupninja::mysql( $order = 10, $ensure = present, $user = false, $dbusername = false, $dbpassword = false, $dbhost = 'localhost', $databases = 'all', $backupdir = false, $hotcopy = false, $sqldump = false, $compress = false, $configfile = true, - $vsname = false, $nodata = false) + $vsname = false, $sqldumpoptions = '--lock-tables --complete-insert --add-drop-table --quick --quote-names', + $nodata = false) { $real_configfile = $configfile ? { diff --git a/manifests/nagios_plugin/duplicity.pp b/manifests/nagios_plugin/duplicity.pp new file mode 100644 index 0000000..7dbd263 --- /dev/null +++ b/manifests/nagios_plugin/duplicity.pp @@ -0,0 +1,45 @@ +class backupninja::nagios_plugin::duplicity { + case $::operatingsystem { + 'Debian': { package { 'python-argparse': ensure => installed, } } + 'Ubuntu': { package { 'python-argh': ensure => installed, } } + default: { + notify {'Backupninja-Duplicity Nagios check needs python-argparse to be installed !':} } + } + + file { '/usr/lib/nagios/plugins/check_backupninja_duplicity.py': + source => 'puppet:///modules/backupninja/nagios_plugins/duplicity/check_backupninja_duplicity.py', + mode => '0755', + owner => 'nagios', + group => 'nagios', + } + + # deploy helper script + file { '/usr/lib/nagios/plugins/backupninja_duplicity_freshness.sh': + source => 'puppet:///modules/backupninja/nagios_plugins/duplicity/backupninja_duplicity_freshness.sh', + mode => '0755', + owner => 'nagios', + group => 'nagios', + } + + nagios::nrpe::command { 'check_backupninja_duplicity': + command_line => "sudo ${::nagios::nrpe::nagios_plugin_dir}/check_backupninja_duplicity.py" + } + sudo::spec {'nrpe_check_backupninja_duplicity': + ensure => present, + users => 'nagios', + hosts => 'ALL', + commands => "NOPASSWD: ${::nagios::nrpe::nagios_plugin_dir}/check_backupninja_duplicity.py"; + } + + nagios::service { "Backupninja Duplicity $::fqdn": + use_nrpe => true, + check_command => 'check_backupninja_duplicity', + nrpe_timeout => '60', + # check only twice a day + normal_check_interval => '720', + # recheck every hour + retry_check_interval => '60', + } + + +} diff --git a/manifests/pgsql.pp b/manifests/pgsql.pp index 19fd46b..07fab32 100644 --- a/manifests/pgsql.pp +++ b/manifests/pgsql.pp @@ -14,7 +14,7 @@ # and compress take true/false rather than yes/no. # define backupninja::pgsql( - $order = 10, $ensure = present, $databases = 'all', $backupdir = "/var/backup/postgres", $compress = true, $vsname = false) + $order = 10, $ensure = present, $databases = 'all', $backupdir = "/var/backups/postgres", $compress = true, $vsname = false) { include backupninja::client::defaults diff --git a/manifests/rdiff.pp b/manifests/rdiff.pp index 587c02d..6c692c7 100644 --- a/manifests/rdiff.pp +++ b/manifests/rdiff.pp @@ -16,7 +16,8 @@ # directories. # define backupninja::rdiff( - $order = 90, $ensure = present, $user = false, $home = false, $host = false, + $order = 90, $ensure = present, $user = false, + $home = "/home/${user}-${name}", $host = false, $type = 'local', $exclude = [ "/home/*/.gnupg", "/home/*/.local/share/Trash", "/home/*/.Trash", "/home/*/.thumbnails", "/home/*/.beagle", "/home/*/.aMule", @@ -25,27 +26,23 @@ define backupninja::rdiff( "/home", "/usr/local/*bin", "/var/lib/dpkg/status*" ], $vsinclude = false, $keep = 30, $sshoptions = false, $options = '--force', $ssh_dir_manage = true, $ssh_dir = false, $authorized_keys_file = false, $installuser = true, $installkey = true, $key = false, - $backuptag = false, $home = false, $backupkeytype = "rsa", $backupkeystore = false, $extras = false, $nagios2_description = 'backups') + $backuptag = false, $backupkeytype = "rsa", $backupkeystore = false, $extras = false, $nagios2_description = 'backups') { include backupninja::client::rdiff_backup + $directory = "$home/rdiff-backup/" + case $type { 'remote': { case $host { false: { err("need to define a host for remote backups!") } } $real_backuptag = $backuptag ? { - false => "backupninja-$host", + false => "backupninja-$fqdn", default => $backuptag } - $real_home = $home ? { - false => "/home/${user}-${name}", - default => $home, - } - $directory = "$real_home/rdiff-backup/" - backupninja::server::sandbox { - "${user}-${name}": user => $user, host => $fqdn, dir => $real_home, + "${user}-${name}": user => $user, host => $fqdn, dir => $home, manage_ssh_dir => $ssh_dir_manage, ssh_dir => $ssh_dir, key => $key, authorized_keys_file => $authorized_keys_file, installuser => $installuser, backuptag => $real_backuptag, keytype => $backupkeytype, backupkeys => $backupkeystore, @@ -61,6 +58,8 @@ define backupninja::rdiff( } } } + + file { "${backupninja::client::defaults::configdir}/${order}_${name}.rdiff": ensure => $ensure, content => template('backupninja/rdiff.conf.erb'), diff --git a/manifests/rsync.pp b/manifests/rsync.pp new file mode 100644 index 0000000..1c82889 --- /dev/null +++ b/manifests/rsync.pp @@ -0,0 +1,87 @@ +# Run rsync as part of a backupninja run. +# Based on backupninja::rdiff + +define backupninja::rsync( + $order = 90, $ensure = present, $user = false, $home = false, $host = false, + $ssh_dir_manage = true, $ssh_dir = false, $authorized_keys_file = false, + $installuser = true, $installkey = true, $key = false, $backuptag = false, + $home = false, $backupkeytype = "rsa", $backupkeystore = false, $extras = false, + $nagios2_description = 'backups', $subfolder = 'rsync', + + $log = false, $partition = false, $fscheck = false, $read_only = false, + $mountpoint = false, $backupdir = false, $format = false, $days = false, + $keepdaily = false, $keepweekly = false, $keepmonthly = false, $lockfile = false, + $nicelevel = 0, $enable_mv_timestamp_bug = false, $tmp = false, $multiconnection = false, + + $exclude_vserver = false, + $exclude = [ "/home/*/.gnupg", "/home/*/.local/share/Trash", "/home/*/.Trash", + "/home/*/.thumbnails", "/home/*/.beagle", "/home/*/.aMule", + "/home/*/gtk-gnutella-downloads" ], + $include = [ "/var/spool/cron/crontabs", "/var/backups", "/etc", "/root", + "/home", "/usr/local/*bin", "/var/lib/dpkg/status*" ], + + $testconnect = false, $protocol = false, $ssh = false, $port = false, + $bandwidthlimit = false, $remote_rsync = false, $id_file = false, + $batch = false, $batchbase = false, $numericids = false, $compress = false, + $fakesuper = false, + + $initscripts = false, $service = false, + + $rm = false, $cp = false, $touch = false, $mv = false, $fsck = false) +{ + include backupninja::client::rsync + + # Right now just local origin with remote destination is supported. + $from = 'local' + $dest = 'remote' + + case $dest { + 'remote': { + case $host { false: { err("need to define a host for remote backups!") } } + + $real_backuptag = $backuptag ? { + false => "backupninja-$fqdn", + default => $backuptag, + } + + $real_home = $home ? { + false => "/home/${user}-${name}", + default => $home, + } + + $directory = "${real_home}/${subfolder}/" + + backupninja::server::sandbox { "${user}-${name}": + user => $user, + host => $host, + dir => $real_home, + manage_ssh_dir => $ssh_dir_manage, + ssh_dir => $ssh_dir, + key => $key, + authorized_keys_file => $authorized_keys_file, + installuser => $installuser, + backuptag => $real_backuptag, + keytype => $backupkeytype, + backupkeys => $backupkeystore, + nagios2_description => $nagios2_description + } + + backupninja::client::key { "${user}-${name}": + user => $user, + host => $host, + installkey => $installkey, + keytype => $backupkeytype, + keystore => $backupkeystore, + } + } + } + + file { "${backupninja::client::defaults::configdir}/${order}_${name}.rsync": + ensure => $ensure, + content => template('backupninja/rsync.conf.erb'), + owner => root, + group => root, + mode => 0600, + require => File["${backupninja::client::defaults::configdir}"] + } +} diff --git a/manifests/server.pp b/manifests/server.pp index a0bcbf2..f702056 100644 --- a/manifests/server.pp +++ b/manifests/server.pp @@ -1,3 +1,10 @@ +# this define realizes all needed resources for a hosted backup +define backupninja_server_realize($host) { + User <<| tag == "backupninja-$host" |>> + File <<| tag == "backupninja-$host" |>> + Ssh_authorized_key <<| tag == "backupninja-$host" |>> +} + class backupninja::server { $real_backupdir = $backupdir ? { @@ -12,6 +19,10 @@ class backupninja::server { '' => $fqdn, default => $backupserver_tag } + $real_backupdir_ensure = $backupdir_ensure ? { + '' => "directory", + default => $backupdir_ensure, + } group { "backupninjas": ensure => "present", @@ -19,21 +30,21 @@ class backupninja::server { } file { "$real_backupdir": - ensure => "directory", - mode => 0710, owner => root, group => "backupninjas" + ensure => "$real_backupdir_ensure", + mode => 0710, owner => root, group => "backupninjas", + require => $real_backupdir_ensure ? { + 'directory' => undef, + default => File["$real_backupdir_ensure"], + } } - if $nagios_server { + if $use_nagios { - if !defined(Package["nsca"]) { - package { "nsca": - ensure => installed; - } - } + include nagios::nsca::client file { "/usr/local/bin/checkbackups": ensure => "present", - source => "puppet://$servername/backupninja/checkbackups.pl", + source => "puppet:///modules/backupninja/checkbackups.pl", mode => 0755, owner => root, group => root, } @@ -46,9 +57,8 @@ class backupninja::server { } } - User <<| tag == "backupninja-$real_backupserver_tag" |>> - File <<| tag == "backupninja-$real_backupserver_tag" |>> - Ssh_authorized_key <<| tag == "backupninja-$real_backupserver_tag" |>> + # collect all resources from hosted backups + Backupninja_server_realize <<| tag == "$real_backupserver_tag" |>> if !defined(Package["rsync"]) { if $rsync_ensure_version == '' { $rsync_ensure_version = 'installed' } @@ -91,7 +101,7 @@ class backupninja::server { default => $authorized_keys_file, } $real_backuptag = $backuptag ? { - false => "backupninja-$real_host", + false => "backupninja-$fqdn", default => $backuptag, } @@ -100,11 +110,19 @@ class backupninja::server { default => $nagios2_description, } - if $nagios_server { + if $use_nagios { # configure a passive service check for backups - nagios2::passive_service { "backups-${name}": nagios2_host_name => $real_host, nagios2_description => $real_nagios2_description, servicegroups => "backups" } + nagios::service::passive { $nagios2_description: } } + if !defined(Backupninja_server_realize["${fqdn}@${real_host}"]) { + # this defines just maps that $real_host host backups for $fdqn + @@backupninja_server_realize { "${fqdn}@${real_host}": + host => $fqdn, + tag => $real_host, + } + } + if !defined(File["$real_dir"]) { @@file { "$real_dir": ensure => directory, @@ -139,15 +157,17 @@ class backupninja::server { } } default: { - @@ssh_authorized_key{ $real_user: - type => $keytype, - key => $key, - user => $real_user, - target => "${real_ssh_dir}/${real_authorized_keys_file}", - tag => "$real_backuptag", - require => User[$real_user], - } - } + if !defined(Ssh_autorized_key["$real_user"]) { + @@ssh_authorized_key{ "$real_user": + type => $keytype, + key => $key, + user => $real_user, + target => "${real_ssh_dir}/${real_authorized_keys_file}", + tag => "$real_backuptag", + require => User[$real_user], + } + } + } } case $uid { false: { @@ -155,12 +175,12 @@ class backupninja::server { @@user { "$real_user": ensure => "present", gid => "$gid", - comment => "$name backup sandbox", + comment => "$real_user backup sandbox", home => "$real_dir", managehome => true, - shell => "/bin/sh", + shell => "/bin/bash", password => '*', - require => Group['backupninjas'], + require => Group['backupninjas'], tag => "$real_backuptag" } } @@ -171,12 +191,12 @@ class backupninja::server { ensure => "present", uid => "$uid", gid => "$gid", - comment => "$name backup sandbox", + comment => "$real_user backup sandbox", home => "$real_dir", managehome => true, - shell => "/bin/sh", + shell => "/bin/bash", password => '*', - require => Group['backupninjas'], + require => Group['backupninjas'], tag => "$real_backuptag" } } |