d27e93d220
Daily SQLite backup to the NetBackup SMB share plus restore/import/export helpers. SMB credentials moved out of the scripts into ~/.smbcredentials (mode 600) and are passed to smbclient via -A instead of -U "user%pass". This keeps the password out of version control and out of the process list, where -U exposes it to any local user through ps.
66 lines
2.4 KiB
Bash
Executable File
66 lines
2.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# Vaultwarden daily backup to SMB share via smbclient
|
|
|
|
VAULT_DATA="/var/lib/docker/volumes/caddy_vaultwarden_data/_data"
|
|
BACKUP_DIR="/tmp/vaultwarden-backup"
|
|
TIMESTAMP=$(date +%Y-%m-%d_%H-%M-%S)
|
|
BACKUP_FILE="${BACKUP_DIR}/vaultwarden-${TIMESTAMP}.db"
|
|
SMB_HOST="192.168.123.2"
|
|
SMB_SHARE="NetBackup"
|
|
SMB_DIR="Vault"
|
|
KEEP_DAYS=60
|
|
|
|
# SMB credentials are stored in an external file (mode 600) rather than inline
|
|
# here, so the password never lands in version control or in the process list.
|
|
# See vaultwarden-backup-helpers/README.md for setup.
|
|
SMB_CRED_FILE="${SMB_CRED_FILE:-$HOME/.smbcredentials}"
|
|
|
|
if [ ! -r "$SMB_CRED_FILE" ]; then
|
|
echo "$(date): ERROR - SMB credentials file not readable: ${SMB_CRED_FILE}"
|
|
echo "$(date): Create it with: printf 'username = %s\\npassword = %s\\n' <user> <pass> | install -m 600 /dev/stdin ${SMB_CRED_FILE}"
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$BACKUP_DIR"
|
|
|
|
echo "$(date): Starting vaultwarden backup..."
|
|
sudo sqlite3 "${VAULT_DATA}/db.sqlite3" ".backup '${BACKUP_FILE}'"
|
|
sudo chown "$(id -u):$(id -g)" "$BACKUP_FILE"
|
|
|
|
if [ -f "$BACKUP_FILE" ] && [ -s "$BACKUP_FILE" ]; then
|
|
SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
|
|
echo "$(date): Backup created ($SIZE), uploading to SMB..."
|
|
|
|
smbclient "//${SMB_HOST}/${SMB_SHARE}" -A "$SMB_CRED_FILE" \
|
|
-c "cd ${SMB_DIR}; put ${BACKUP_FILE} vaultwarden-${TIMESTAMP}.db"
|
|
|
|
if [ $? -eq 0 ]; then
|
|
echo "$(date): Backup finished successfully."
|
|
else
|
|
echo "$(date): ERROR - SMB upload failed!"
|
|
exit 1
|
|
fi
|
|
|
|
rm -f "$BACKUP_FILE"
|
|
else
|
|
echo "$(date): ERROR - sqlite3 backup failed or file is empty!"
|
|
rm -f "$BACKUP_FILE"
|
|
exit 1
|
|
fi
|
|
|
|
# Clean up old backups (older than KEEP_DAYS)
|
|
echo "$(date): Cleaning up backups older than ${KEEP_DAYS} days..."
|
|
sudo mkdir -p /mnt/netbackup
|
|
if ! mountpoint -q /mnt/netbackup; then
|
|
sudo mount -t cifs "//${SMB_HOST}/${SMB_SHARE}" /mnt/netbackup \
|
|
-o credentials=/root/.smbcredentials,iocharset=utf8,vers=3.0,uid=$(id -u),gid=$(id -g),file_mode=0666,dir_mode=0777 2>/dev/null
|
|
fi
|
|
|
|
if mountpoint -q /mnt/netbackup; then
|
|
DELETED=$(find "/mnt/netbackup/${SMB_DIR}" -name "vaultwarden-*.db" -mtime +${KEEP_DAYS} -type f -print -delete 2>/dev/null | wc -l)
|
|
sudo umount /mnt/netbackup 2>/dev/null
|
|
echo "$(date): Deleted ${DELETED} old backup(s)."
|
|
else
|
|
echo "$(date): WARNING - Could not mount SMB for cleanup, skipping."
|
|
fi
|