diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 78 |
1 files changed, 68 insertions, 10 deletions
@@ -115,10 +115,15 @@ variable. You can use placeholders such as `{hostname}` for the backups, see: This can increase security but comes at the cost of not being able to clean up old backups from the client. +`borg_storage_quota` limits the storage space used by the repository on the +Borg server. Format: `N` (bytes), `NK` (kilobytes), `NM` (megabytes), `NG` +(gigabytes), `NT` (terabytes). Empty string means no quota. + ```yaml borg_repo_name: "{{ inventory_hostname }}" borg_backup_name_format: "{hostname}-{now:%Y-%m-%dT%H:%M:%S}" -borg_mode_append_only: false # Server side append only config +borg_mode_append_only: false +borg_storage_quota: "" # e.g., "100G" for 100 gigabytes ``` We use zstd compression by default, but you can change it to any of the @@ -286,14 +291,15 @@ This creates: ## Important Behaviors and Limitations -### Consistent `--append-only` Setting Required +### Consistent `--append-only` and `--storage-quota` Settings Required -All repositories for a given host must use the same `borg_mode_append_only` -setting. The role will fail with an error if you attempt to configure -repositories with conflicting `--append-only` settings for the same host. +All repositories for a given host must use the same `borg_mode_append_only` and +`borg_storage_quota` settings when sharing a single SSH key. The role will fail +with an error if you attempt to configure repositories with conflicting settings +for the same host. -This is because the SSH `authorized_keys` entry uses a single `--append-only` -flag that applies to all repositories accessible via that key. +This is because the SSH `authorized_keys` entry uses a single `--append-only` and +`--storage-quota` flag that applies to all repositories accessible via that key. ```yaml # This will FAIL - conflicting append-only settings @@ -309,10 +315,62 @@ roles: borg_mode_append_only: true # ERROR: inconsistent ``` -### Single SSH Key per Host\*\* +```yaml +# This will FAIL - conflicting storage quota settings +roles: + - role: kliwniloc.borgbackup + vars: + borg_repo_name: configs + borg_storage_quota: 10G # ERROR: inconsistent + + - role: kliwniloc.borgbackup + vars: + borg_repo_name: home-data + borg_storage_quota: 50G # ERROR: inconsistent +``` + +### Per-Repo SSH Keys for Independent Settings + +To use different `--append-only` or `--storage-quota` settings per repository, +enable `borg_ssh_key_per_repo: true`. This generates a unique SSH keypair for +each `(server, repo)` combination, allowing each repository to have its own +`authorized_keys` entry with independent settings. + +```yaml +- name: Configure repos with independent settings using per-repo SSH keys + hosts: borg-client + vars: + borg_server_host: borg-server + borg_server_host_ssh_key: ssh-rsa AAAAAAAA... + borg_ssh_key_per_repo: true + + roles: + - role: kliwniloc.borgbackup + vars: + borg_repo_name: configs + borg_backup_argument: configs + borg_mode_append_only: true + borg_storage_quota: 10G + borg_included_dirs: + - /etc + + - role: kliwniloc.borgbackup + vars: + borg_repo_name: home-data + borg_backup_argument: home-data + borg_mode_append_only: false # OK: different key + borg_storage_quota: 50G # OK: different key + borg_included_dirs: + - /home +``` + +This creates: -The role generates one SSH keypair per client host. All repositories for that -host share the same SSH key for authentication to the Borg server. +- Two separate SSH keypairs: `id_ed25519_borgbackup_borg_server_configs` and + `id_ed25519_borgbackup_borg_server_home_data` +- Two separate `authorized_keys` entries with independent restrictions so that + each repository can have its own `--append-only` and `--storage-quota` + settings ### Decryption Keys Storage Format |