Initial Backupper Unraid plugin
This commit is contained in:
Mikei386
@@ -0,0 +1,233 @@
|
||||
package restic
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"log/slog"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"github.com/backupper-unraid/backupper/internal/model"
|
||||
)
|
||||
|
||||
type SecretGetter interface{ Get(string) (string, error) }
|
||||
|
||||
type Runner struct {
|
||||
Binary string
|
||||
RuntimeDir string
|
||||
Secrets SecretGetter
|
||||
Log *slog.Logger
|
||||
}
|
||||
|
||||
type Summary struct {
|
||||
MessageType string `json:"message_type"`
|
||||
SnapshotID string `json:"snapshot_id"`
|
||||
DataAdded int64 `json:"data_added"`
|
||||
FilesNew int64 `json:"files_new"`
|
||||
}
|
||||
|
||||
func (r *Runner) Init(ctx context.Context, repo model.Repository) error {
|
||||
return r.run(ctx, repo, []string{"init"}, nil, nil)
|
||||
}
|
||||
|
||||
func (r *Runner) Backup(ctx context.Context, repo model.Repository, job model.Job, sources []string) (Summary, error) {
|
||||
args := []string{"backup", "--json", "--compression", job.Compression}
|
||||
for _, tag := range append([]string{"backupper", "job:" + job.ID}, job.Tags...) {
|
||||
args = append(args, "--tag", tag)
|
||||
}
|
||||
for _, exclude := range job.Excludes {
|
||||
args = append(args, "--exclude", exclude)
|
||||
}
|
||||
args = append(args, sources...)
|
||||
var summary Summary
|
||||
err := r.run(ctx, repo, args, func(line []byte) {
|
||||
var candidate Summary
|
||||
if json.Unmarshal(line, &candidate) == nil && candidate.MessageType == "summary" {
|
||||
summary = candidate
|
||||
}
|
||||
}, nil)
|
||||
return summary, err
|
||||
}
|
||||
|
||||
func (r *Runner) Forget(ctx context.Context, repo model.Repository, job model.Job) error {
|
||||
args := []string{"forget", "--tag", "job:" + job.ID, "--keep-daily", fmt.Sprint(job.Retention.Daily), "--keep-weekly", fmt.Sprint(job.Retention.Weekly), "--keep-monthly", fmt.Sprint(job.Retention.Monthly)}
|
||||
return r.run(ctx, repo, args, nil, nil)
|
||||
}
|
||||
|
||||
func (r *Runner) Check(ctx context.Context, repo model.Repository) error {
|
||||
return r.run(ctx, repo, []string{"check"}, nil, nil)
|
||||
}
|
||||
func (r *Runner) Prune(ctx context.Context, repo model.Repository) error {
|
||||
return r.run(ctx, repo, []string{"prune"}, nil, nil)
|
||||
}
|
||||
|
||||
func (r *Runner) Snapshots(ctx context.Context, repo model.Repository) ([]model.Snapshot, error) {
|
||||
var output []byte
|
||||
err := r.run(ctx, repo, []string{"snapshots", "--json"}, nil, &output)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
var snapshots []model.Snapshot
|
||||
if err := json.Unmarshal(output, &snapshots); err != nil {
|
||||
return nil, fmt.Errorf("decode snapshots: %w", err)
|
||||
}
|
||||
return snapshots, nil
|
||||
}
|
||||
|
||||
func (r *Runner) List(ctx context.Context, repo model.Repository, snapshot, path string) ([]map[string]any, error) {
|
||||
args := []string{"ls", snapshot, "--json"}
|
||||
if path != "" {
|
||||
args = append(args, path)
|
||||
}
|
||||
var output []byte
|
||||
if err := r.run(ctx, repo, args, nil, &output); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
items := []map[string]any{}
|
||||
scanner := bufio.NewScanner(strings.NewReader(string(output)))
|
||||
for scanner.Scan() {
|
||||
var item map[string]any
|
||||
if json.Unmarshal(scanner.Bytes(), &item) == nil && item["struct_type"] == "node" {
|
||||
items = append(items, item)
|
||||
}
|
||||
if len(items) >= 5000 {
|
||||
break
|
||||
}
|
||||
}
|
||||
return items, scanner.Err()
|
||||
}
|
||||
|
||||
func (r *Runner) Restore(ctx context.Context, repo model.Repository, task model.RestoreTask) error {
|
||||
args := []string{"restore", task.SnapshotID, "--target", task.Target}
|
||||
for _, include := range task.Includes {
|
||||
args = append(args, "--include", include)
|
||||
}
|
||||
return r.run(ctx, repo, args, nil, nil)
|
||||
}
|
||||
|
||||
func (r *Runner) run(ctx context.Context, repo model.Repository, args []string, onLine func([]byte), capture *[]byte) error {
|
||||
password, err := r.Secrets.Get(repo.PasswordRef)
|
||||
if err != nil {
|
||||
return fmt.Errorf("authentication: load repository password: %w", err)
|
||||
}
|
||||
secretDir := filepath.Join(r.RuntimeDir, "secrets")
|
||||
if err := os.MkdirAll(secretDir, 0700); err != nil {
|
||||
return err
|
||||
}
|
||||
f, err := os.CreateTemp(secretDir, "restic-password-*")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
passwordPath := f.Name()
|
||||
defer os.Remove(passwordPath)
|
||||
if err := f.Chmod(0600); err != nil {
|
||||
f.Close()
|
||||
return err
|
||||
}
|
||||
if _, err := io.WriteString(f, password); err != nil {
|
||||
f.Close()
|
||||
return err
|
||||
}
|
||||
if err := f.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
globalArgs := []string{"-r", repositoryLocation(repo)}
|
||||
credentialPath := ""
|
||||
if repo.Type == model.RepositorySFTP && repo.CredentialRef != "" {
|
||||
privateKey, err := r.Secrets.Get(repo.CredentialRef)
|
||||
if err != nil {
|
||||
return fmt.Errorf("authentication: load SFTP private key: %w", err)
|
||||
}
|
||||
keyFile, err := os.CreateTemp(secretDir, "sftp-key-*")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
credentialPath = keyFile.Name()
|
||||
defer os.Remove(credentialPath)
|
||||
if err := keyFile.Chmod(0600); err != nil {
|
||||
keyFile.Close()
|
||||
return err
|
||||
}
|
||||
if _, err := io.WriteString(keyFile, privateKey); err != nil {
|
||||
keyFile.Close()
|
||||
return err
|
||||
}
|
||||
if err := keyFile.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
knownHosts := repo.Options["knownHostsPath"]
|
||||
command := "ssh -i " + credentialPath + " -o IdentitiesOnly=yes -o UserKnownHostsFile=" + knownHosts + " -o StrictHostKeyChecking=yes"
|
||||
globalArgs = append(globalArgs, "-o", "sftp.command="+command)
|
||||
}
|
||||
fullArgs := append(globalArgs, args...)
|
||||
cmd := exec.CommandContext(ctx, r.Binary, fullArgs...)
|
||||
cmd.Env = []string{"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "HOME=/root", "RESTIC_PASSWORD_FILE=" + passwordPath}
|
||||
stdout, err := cmd.StdoutPipe()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
stderr, err := cmd.StderrPipe()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if err := cmd.Start(); err != nil {
|
||||
return classify(err)
|
||||
}
|
||||
var captured []byte
|
||||
done := make(chan struct{})
|
||||
go func() {
|
||||
scanner := bufio.NewScanner(stdout)
|
||||
scanner.Buffer(make([]byte, 64*1024), 2*1024*1024)
|
||||
for scanner.Scan() {
|
||||
line := append([]byte(nil), scanner.Bytes()...)
|
||||
if capture != nil {
|
||||
captured = append(captured, line...)
|
||||
captured = append(captured, '\n')
|
||||
}
|
||||
if onLine != nil {
|
||||
onLine(line)
|
||||
}
|
||||
}
|
||||
close(done)
|
||||
}()
|
||||
errBytes, _ := io.ReadAll(io.LimitReader(stderr, 1024*1024))
|
||||
err = cmd.Wait()
|
||||
<-done
|
||||
if capture != nil {
|
||||
*capture = captured
|
||||
}
|
||||
if err != nil {
|
||||
message := redact(string(errBytes), repo)
|
||||
if errors.Is(ctx.Err(), context.Canceled) {
|
||||
return fmt.Errorf("cancelled: %w", ctx.Err())
|
||||
}
|
||||
return fmt.Errorf("restic: %s: %w", strings.TrimSpace(message), err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func repositoryLocation(repo model.Repository) string {
|
||||
if repo.Type == model.RepositorySFTP && !strings.HasPrefix(repo.Location, "sftp:") {
|
||||
return "sftp:" + repo.Location
|
||||
}
|
||||
return repo.Location
|
||||
}
|
||||
|
||||
func redact(value string, repo model.Repository) string {
|
||||
value = strings.ReplaceAll(value, repo.Location, "[repository]")
|
||||
return value
|
||||
}
|
||||
|
||||
func classify(err error) error {
|
||||
if errors.Is(err, exec.ErrNotFound) {
|
||||
return fmt.Errorf("environment: restic binary not found: %w", err)
|
||||
}
|
||||
return err
|
||||
}
|
||||
@@ -0,0 +1,47 @@
|
||||
package restic
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/backupper-unraid/backupper/internal/model"
|
||||
)
|
||||
|
||||
type fakeSecrets map[string]string
|
||||
|
||||
func (s fakeSecrets) Get(id string) (string, error) { return s[id], nil }
|
||||
|
||||
func TestBackupUsesPasswordFileAndStructuredArguments(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
argsPath := filepath.Join(dir, "args")
|
||||
passwordPath := filepath.Join(dir, "password")
|
||||
script := filepath.Join(dir, "restic")
|
||||
body := fmt.Sprintf("#!/bin/sh\nprintf '%%s\\n' \"$@\" > '%s'\ncat \"$RESTIC_PASSWORD_FILE\" > '%s'\nprintf '%%s\\n' '{\"message_type\":\"summary\",\"snapshot_id\":\"abc123\",\"data_added\":42,\"files_new\":3}'\n", argsPath, passwordPath)
|
||||
if err := os.WriteFile(script, []byte(body), 0700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
runner := &Runner{Binary: script, RuntimeDir: dir, Secrets: fakeSecrets{"password": "top-secret"}}
|
||||
repo := model.Repository{Type: model.RepositoryLocal, Location: "/repo path", PasswordRef: "password"}
|
||||
job := model.Job{ID: "job", Compression: "auto", Tags: []string{"daily"}, Excludes: []string{"*.tmp"}}
|
||||
summary, err := runner.Backup(context.Background(), repo, job, []string{"/source path"})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if summary.SnapshotID != "abc123" || summary.DataAdded != 42 {
|
||||
t.Fatalf("unexpected summary: %+v", summary)
|
||||
}
|
||||
args, _ := os.ReadFile(argsPath)
|
||||
for _, expected := range []string{"/repo path", "backup", "--json", "/source path"} {
|
||||
if !strings.Contains(string(args), expected) {
|
||||
t.Fatalf("arguments missing %q: %s", expected, args)
|
||||
}
|
||||
}
|
||||
password, _ := os.ReadFile(passwordPath)
|
||||
if string(password) != "top-secret" {
|
||||
t.Fatal("password file was not provided")
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user