feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.

2026-10-25 20:18:00 +01:00
1 parent 7d1f639508
commit fe45272f7c
@@ -1,3 +1,36 @@
+vpn-router (0.20.0-1) unstable; urgency=medium
+
+  feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.
+
+  * The backup section of vpn-router.json switches on backups and sets
+    the schedule (hourly, daily or weekly), the target (local or pbs),
+    the folder, the retention of local archives, whether the metrics
+    database is included, the rclone remote and mode, and the Proxmox
+    Backup Server repository, token secret, fingerprint, namespace and
+    key file.
+  * A backup holds /etc/vpn-router, /etc/wireguard, the ufw rules, the
+    Router Manager's settings, PSK files outside /etc/vpn-router, the
+    user directory as slapcat writes it and, optionally, the database as
+    pg_dump writes it, copied while the configuration and the users are
+    locked.
+  * Local backups are tar archives compressed with zstd. Archives the
+    retention settings no longer keep are deleted by the rules of Proxmox
+    Backup Server's prune, and rclone can sync or copy the archives to a
+    remote of /etc/vpn-router/rclone.conf.
+  * Backups to a Proxmox Backup Server are made with
+    proxmox-backup-client-static, which the package suggests; the server
+    keeps them.
+  * vpn-router-backup runs a backup, lists the backups and restores a
+    local archive or a snapshot; vpn-router-backup.timer runs it on the
+    schedule.
+  * /backup of the status web service shows and changes the backup
+    settings, shows the last run, the local archives and the next run,
+    and starts a backup.
+  * The package depends on zstd and suggests rclone and
+    proxmox-backup-client-static.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Wed, 28 Oct 2026 10:00:00 +0100
+
 vpn-router (0.19.1-3) unstable; urgency=medium

  update: ADR-24 names Ubuntu's apt-daily timer, not a cron job, as what updates the package lists.
@@ -31,14 +31,19 @@ Depends: ${misc:Depends},
         openvpn-auth-ldap,
         iproute2,
         systemd-resolved,
-         caddy
+         caddy,
+         zstd
+Suggests: rclone,
+          proxmox-backup-client-static
 Description: Linux VPN router with IPSec, road-warrior, OpenVPN and WireGuard support
 Configures a Linux host or virtual machine as a VPN router: site-to-site
 IKEv2 IPSec (strongSwan swanctl), optional road-warrior access using EAP-TLS,
 optional OpenVPN with a certificate and a password per user, kept in a local
 LDAP directory, optional WireGuard, and the routing, NAT, MSS clamping and
 firewall rules a router needs. It keeps metrics of the router in PostgreSQL
- and serves them for an OpenTelemetry Collector. Nothing in the package is
+ and serves them for an OpenTelemetry Collector, and makes scheduled backups
+ to a local folder, copied to the cloud with rclone, or to a Proxmox Backup
+ Server. Nothing in the package is
 specific to a cloud provider.
 .
 Settings live in /etc/vpn-router/vpn-router.json, which is created on first
@@ -7,11 +7,13 @@ src/usr/lib/vpn-router/vpnrouter_users.py             usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_auth.py              usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_metrics.py           usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_status.py            usr/lib/vpn-router/
+src/usr/lib/vpn-router/vpnrouter_backup.py            usr/lib/vpn-router/
 src/usr/lib/vpn-router/openvpn-same-user              usr/lib/vpn-router/
 src/usr/sbin/vpn-router-user                          usr/sbin/
 src/usr/sbin/vpn-router-group                         usr/sbin/
 src/usr/sbin/vpn-router-token                         usr/sbin/
 src/usr/sbin/vpn-config-edit                          usr/sbin/
+src/usr/sbin/vpn-router-backup                        usr/sbin/
 src/usr/lib/vpn-router/simple-ca                      usr/lib/vpn-router/
 src/usr/lib/vpn-router/configure                      usr/lib/vpn-router/
 src/usr/lib/vpn-router/docker-rules                   usr/lib/vpn-router/
@@ -53,8 +53,12 @@ case "$1" in
              /etc/vpn-router/vpn-router.json \
              /etc/vpn-router/web.key \
              /etc/vpn-router/metrics.secret \
-              /var/lib/vpn-router/setup.done
-        rmdir --ignore-fail-on-non-empty /var/lib/vpn-router 2>/dev/null || true
+              /etc/systemd/system/vpn-router-backup.timer.d/schedule.conf \
+              /var/lib/vpn-router/setup.done \
+              /var/lib/vpn-router/backup.json
+        rmdir --ignore-fail-on-non-empty /etc/systemd/system/vpn-router-backup.timer.d 2>/dev/null || true
+        rm -rf /var/lib/vpn-router/backup/staging /var/lib/vpn-router/backup/restore
+        rmdir --ignore-fail-on-non-empty /var/lib/vpn-router/backup /var/lib/vpn-router 2>/dev/null || true

        # The refresh tokens' database and role, when the package created them.
        if [ -f /etc/vpn-router/database.secret ] && command -v psql >/dev/null 2>&1; then
@@ -64,8 +68,9 @@ case "$1" in
        rm -f /etc/vpn-router/database.secret

        # Key material and users are not package state: /etc/vpn-router/pki,
-        # /etc/vpn-router/ldap, the user directory in slapd, the WireGuard key
-        # pair and everything under /etc/swanctl are left in place.
+        # /etc/vpn-router/ldap, /etc/vpn-router/rclone.conf, the user directory
+        # in slapd, the WireGuard key pair, everything under /etc/swanctl, the
+        # backups and what a restore replaced are left in place.
        rmdir --ignore-fail-on-non-empty /etc/vpn-router 2>/dev/null || true
        ;;
 esac
@@ -17,10 +17,11 @@ case "$1" in
        fi

        # vpn-router-setup enabled wg-quick@wg0, openvpn-server@vpn-router,
-        # caddy and vpn-router-metrics, so the package takes them down again.
-        # Use the debhelper wrappers rather than systemctl, so the script
-        # behaves on a machine without systemd.
-        for unit in wg-quick@wg0.service openvpn-server@vpn-router.service caddy.service vpn-router-metrics.service; do
+        # caddy, vpn-router-metrics and the backup timer, so the package takes
+        # them down again. Use the debhelper wrappers rather than systemctl, so
+        # the script behaves on a machine without systemd.
+        for unit in wg-quick@wg0.service openvpn-server@vpn-router.service caddy.service vpn-router-metrics.service \
+                vpn-router-backup.timer; do
            if command -v deb-systemd-invoke >/dev/null 2>&1; then
                deb-systemd-invoke stop "$unit" >/dev/null 2>&1 || true
            fi
@@ -8,3 +8,4 @@ override_dh_installsystemd:
 	dh_installsystemd --name=vpn-router-web --no-start
 	dh_installsystemd --name=vpn-router-metrics --no-enable --no-start
 	dh_installsystemd --name=vpn-router-bootstrap --no-enable --no-start
+	dh_installsystemd --name=vpn-router-backup --no-enable --no-start
@@ -0,0 +1,11 @@
+[Unit]
+Description=VPN Router backup
+Documentation=file:/usr/share/doc/vpn-router/README.md
+After=network-online.target slapd.service postgresql.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/vpn-router-backup run
+Nice=10
+IOSchedulingClass=idle
@@ -0,0 +1,10 @@
+[Unit]
+Description=VPN Router backup schedule
+Documentation=file:/usr/share/doc/vpn-router/README.md
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+
+[Install]
+WantedBy=timers.target