Debian系统下如何实现基于OpenVPN隧道的Rsync定时备份？

Got it, let's walk through setting up this automated rsync backup over your OpenVPN tunnel step by step—since you've already nailed the manual initial backup, we just need to lock in the automation to keep your RAID0-based production server safe.

First, we need to make sure the OpenVPN tunnel is up and running when the backup runs, no manual input required:

• On your production server, verify your OpenVPN client config (e.g., /etc/openvpn/client/backup-vpn.conf) uses certificate-based auth without needing a manual password prompt. Double-check file permissions for your keys: chmod 600 /etc/openvpn/client/your-vpn-private.key to keep them secure.
• Test starting the VPN daemon manually: openvpn --config /etc/openvpn/client/backup-vpn.conf --daemon. Confirm the tunnel is active with ip a (look for a tun0 or similar interface).
• To add robustness, we’ll include a VPN health check in the backup script later—so if the tunnel drops, the script will try to restart it before proceeding.

Rsync needs to connect to your backup server without interactive password prompts. Here’s how to configure SSH key auth:

• Generate a dedicated SSH key for backups on the production server:

  ssh-keygen -t ed25519 -N "" -f ~/.ssh/backup_rsa
  

  Hit enter through all prompts to create a key without a passphrase (critical for cron automation).
• Copy the public key to your Debian backup server (use its VPN internal IP, e.g., 10.8.0.2):

  ssh-copy-id -i ~/.ssh/backup_rsa.pub backup-user@10.8.0.2
  

• Test the connection to confirm no password is needed: ssh -i ~/.ssh/backup_rsa backup-user@10.8.0.2.

Create a reusable script (e.g., /usr/local/bin/prod_backup.sh) with all the logic to check the VPN, run rsync, and log activity. Here’s a ready-to-use version:

#!/bin/bash

# Configuration - adjust these to match your setup
BACKUP_USER="backup-user"
BACKUP_VPN_IP="10.8.0.2"
SOURCE_PATHS="/var/www/nextcloud/ /var/lib/mysql/"  # Space-separated directories to back up
BACKUP_DEST="/mnt/backup-storage/production/"
VPN_CONFIG="/etc/openvpn/client/backup-vpn.conf"
LOG_FILE="/var/log/prod_backup.log"

# Helper function for timestamped logs
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$LOG_FILE"
}

# Check if VPN is connected
log "Checking OpenVPN tunnel status..."
if ! ping -c 2 "$BACKUP_VPN_IP" > /dev/null 2>&1; then
    log "VPN tunnel down. Attempting to restart..."
    openvpn --config "$VPN_CONFIG" --daemon
    sleep 10  # Give time for the tunnel to establish
    if ! ping -c 2 "$BACKUP_VPN_IP" > /dev/null 2>&1; then
        log "Failed to establish VPN connection. Aborting backup."
        exit 1
    fi
    log "VPN tunnel re-established successfully."
fi

# Optional: Put Nextcloud in maintenance mode to avoid file conflicts
log "Enabling Nextcloud maintenance mode..."
sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --on

# Run rsync backup
log "Starting rsync backup to $BACKUP_USER@$BACKUP_VPN_IP:$BACKUP_DEST"
rsync -avz --delete --exclude="*.tmp" -e "ssh -i ~/.ssh/backup_rsa" "$SOURCE_PATHS" "$BACKUP_USER@$BACKUP_VPN_IP:$BACKUP_DEST"

# Check rsync exit code
if [ $? -eq 0 ]; then
    log "Backup completed successfully!"
else
    log "Backup failed with exit code $?."
fi

# Disable Nextcloud maintenance mode
log "Disabling Nextcloud maintenance mode..."
sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off

# Optional: Close VPN if you don't need it running continuously
# log "Closing OpenVPN tunnel..."
# pkill openvpn

• Make the script executable: chmod +x /usr/local/bin/prod_backup.sh
• Test it manually first to catch any issues: /usr/local/bin/prod_backup.sh
• Check the log file afterward to confirm success: cat /var/log/prod_backup.log

Now set up a cron job to run the backup automatically. Open the crontab editor:

crontab -e

Add a line to schedule the backup—for example, to run every day at 2 AM:

0 2 * * * /usr/local/bin/prod_backup.sh

• If you prefer weekly backups (e.g., every Sunday at 3 AM), use:

  0 3 * * 0 /usr/local/bin/prod_backup.sh
  

Save and exit the editor—cron will automatically apply the new schedule. Verify your cron jobs with crontab -l.

• Monitor Backup Logs: Add email alerts to the script for failure cases. Install mailutils on your production server, then add a line like echo "Backup failed on $(date)" | mail -s "Production Backup Failure" your-email@example.com in the failure block.
• Validate Backups: Periodically restore a small subset of files to your backup server to ensure the data is intact—RAID0 gives zero redundancy, so your backup is your safety net.
• Backup Server Health: Regularly check the RAID status and disk health on your Debian backup machine with tools like mdadm --detail /dev/md0 and smartctl -a /dev/sda.

内容的提问来源于stack exchange，提问作者Michael Konz