blob: 653cbcbb9a357e82d87513ba7b2331e141472e27 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
# Changelog
All notable changes to this project will be documented in this file.
## [Unreleased]
<!-- TODO: High level overview of new major release -->
### Breaking Changes
#### Decryption keys file format changed
**Am I affected?**
You have a `decryption_keys.yml` file with entries from previous versions.
**What changed?**
Keys now include the repository name to support multiple repos per host.
Old format:
```yaml
my-host: BORG_KEY_abc123...
```
New format:
```yaml
my-host_repo-name: BORG_KEY_abc123...
```
Generally a harmless change, just leads to duplicate keys with old and new
format.
**Migration:**
1. Run the role with the new version (new keys created automatically)
2. Verify backups work correctly
3. Remove old hostname-only entries from `decryption_keys.yml`
---
#### Backup script block markers changed
**Am I affected?**
Yes.
**What changed?**
Block markers in the backup script now include repository name to support
multiple repos per host.
Old:
```bash
## BEGIN ANSIBLE MANAGED BLOCK for server: backup-server
```
New:
```bash
## BEGIN ANSIBLE MANAGED BLOCK for backup-server/my-repo
```
**Migration:**
<!-- TODO: We want to auto-migrate this -->
Delete the script and re-run the role:
```bash
rm /usr/local/bin/run_borg_backup
# Then run your playbook
```
---
#### Default backup argument
**Am I affected?**
You are using the default value of `borg_backup_argument`.
**What will change?**
Default will change from `{{ borg_server_host_url }}` to
`{{ borg_server_host_url }}-{{ borg_repo_name }}`.
**Migration:**
<!-- TODO: Consider if we want to migrate this automatically aswell -->
Systemd unit names will change. Manually migrate:
```bash
# Stop old units
systemctl stop borg_backup@OLD-VALUE.timer
systemctl disable borg_backup@OLD-VALUE.timer
# Run role to create new units
# Then enable new units
systemctl enable borg_backup@NEW-VALUE.timer
systemctl start borg_backup@NEW-VALUE.timer
```
### Added
- Multi-instance backup support (multiple repositories per client host)
- Non-root backup user support via `borg_client_user` variable
- Configurable SSH key type (`borg_ssh_key_type`) with support for
ed25519, rsa, and ecdsa
- Per-repo SSH key support (`borg_ssh_key_per_repo`) for independent keys per repository
- Storage quota support (`borg_storage_quota`) to limit repository size on server
- Comprehensive test suite including disaster recovery scenarios
- Negative security tests for cross-host repository isolation
- Appendix-only repository mode (`borg_mode_append_only`)
|
