X-Git-Url: https://piware.de/gitweb/?p=bin.git;a=blobdiff_plain;f=backup;h=7a424862cc100015608c6cee15d85a5e0d62c5ae;hp=0518410024d7f5c2cd18c076bc970a08982bf49d;hb=HEAD;hpb=abd08d10c37904bfff0c8c53f225380c2bd37d03

diff --git a/backup b/backup
index 0518410..f1bef09 100755
--- a/backup
+++ b/backup
@@ -1,7 +1,14 @@
 #!/bin/sh
 set -eu
 cd $HOME
-LOG=.cache/duplicity/log
+LOG=.cache/backup/log
+PATH=$PATH:/sbin:/usr/sbin
+RESTIC="restic --password-file $HOME/.config/backup-passphrase --repo sftp:piware.de:backup/restic"
+
+fail() {
+    notify-send -i /usr/share/icons/Adwaita/48x48/status/network-error-symbolic.symbolic.png -u critical -t 180000 "${1:-BACKUP FAILED!}"
+    exit 1
+}
 
 # do backup every day
 if [ -e "$LOG" ] && [ $(( `date +%s` - `stat -c %Y $LOG` )) -lt 86300 ]; then
@@ -9,20 +16,34 @@ if [ -e "$LOG" ] && [ $(( `date +%s` - `stat -c %Y $LOG` )) -lt 86300 ]; then
 fi
 
 # figure out $DISPLAY when running from cron
-if [ -z "${DISPLAY:-}" ]; then
-    socket="/run/user/`id -u`/X11-display"
-    if [ -L "$socket" ]; then
-        socket=$(readlink "$socket")
-        export DISPLAY=:${socket##*/X}
-    fi
-fi
+export DISPLAY="${DISPLAY:-:0}"
 
-if ! ip route | grep -q '^default.*wlan'; then
+if ! ip route show default | grep -Eq 'dev (enp|wl)'; then
     notify-send "Backup skipped, not on WLAN"
     exit 0
 fi
 
+# figure out ssh agent when running from cron
+if [ -z "${SSH_AUTH_SOCK:-}" ]; then
+    ssh_socket=$(ls /run/user/`id -u`/keyring*/ssh 2>/dev/null)
+    if [ -S "$ssh_socket" ]; then
+        export SSH_AUTH_SOCK="$ssh_socket"
+    fi
+fi
+
 notify-send "Backup started"
 mkdir -p $(dirname $LOG)
-env PASSPHRASE="$(cat ~/.backup-passphrase)" duplicity --full-if-older-than 1M --exclude-globbing-filelist .duplicity-ignore . rsync://piware.de/backup/donald >> $LOG || { notify-send "BACKUP FAILED!"; exit 1; }
+
+$RESTIC backup --exclude-file=$HOME/.config/backup-ignore $HOME >> $LOG 2>&1 || fail
+# TODO: forget --prune policy: https://restic.readthedocs.io/en/stable/060_forget.html
 notify-send "Backup finished successfully"
+
+scp .config/backup-passphrase piware.de:.cache/
+ssh piware.de chmod u+w .cache/backup-passphrase
+trap "ssh piware.de shred -u .cache/backup-passphrase" EXIT INT QUIT PIPE
+
+ssh piware.de restic --password-file .cache/backup-passphrase --repo backup/restic forget --prune --keep-within-hourly 24h --keep-within-daily 7d --keep-within-weekly 30d --keep-within-monthly 12m
+notify-send "Backup pruned successfully"
+
+ssh piware.de restic --password-file .cache/backup-passphrase --repo backup/restic check || fail "BACKUP CHECK FAILED!"
+notify-send "Backup checked successfully"