trellis-backup-role

This role is designed to work with Trellis.

It sets up automatic backups using duply.

What it does:

• Installs duplicity and duply
• For each configured wordpress_site, it creates two duply profiles:
  • One for the database
  • One for uploads

Note: It does not back up website code. If you want to restore, first deploy your website on a new server, then restore the database and uploads.

Getting Started

Add the role and its requirements to the galaxy.yml file in Trellis:

- name: backup
  src: xilonz.trellis_backup
  version: 2.1.7

Run ansible-galaxy install -r galaxy.yml to install the new roles.

Next, add the roles to the server.yml:

roles:
  ... other Trellis roles ...
  - { role: backup, tags: [backup] }

Role Variables

The role reads from the wordpress_sites dictionary in Trellis.

Example:

wordpress_sites:
  example.com:
    site_hosts:
      - canonical: example.com
        redirects:
          - www.example.com
    local_path: ../site # path to local Bedrock site directory (relative to Ansible root)
    repo: [email protected]:example/example.com.git # replace with your Git repo URL
    repo_subtree_path: site # relative path to your Bedrock/WP directory in your repo
    branch: master
    multisite:
      enabled: false
    ssl:
      enabled: false
      provider: letsencrypt
    cache:
      enabled: false
+   backup:
+     enabled: true
+     auto: true
+     target: scp://[email protected]/example.com_backups # any location that duplicity supports
+     schedule: '0 4 * * *' # cron time for backups (change this value)
+     purge: false # set to true to enable automatic cleanup of old backups
+     max_age: 1M # time frame for keeping old backups. Used for the "purge" command.
+     full_max_age: 1M # forces a full backup if the last full backup reaches this age.
+     max_full_backups: 1 # number of full backups to keep
+     post_actions: # optional
+     - "curl -L http://your-custom-endpoint" # commands to run after backup is done

You can set enabled: true and auto: false to install duply profiles without scheduling backups. This way, you can restore your production database on staging. You will have the same duply profiles in both environments, but only the production server will create backups.

Read all duplicity URL formats (and potential targets).

vault.yml

Put your backup target credentials in vault.yml (this could be S3 keys, FTP credentials, or nothing if backing up locally). You can also include your credentials in the target URL, but using vault.yml is safer.

example.com:
  env:
    backup_target_user: user
    backup_target_pass: password

Provisioning the Server

Run trellis provision --tags backup environment or ansible-playbook server.yml -e env=environment --tags backup to execute this role.

Restore

Once the profiles are installed, you can easily back up and restore from the server. Replace website_name with your site’s name from wordpress_sites.yml, using underscores instead of dots (example_com). You can check your duply profiles names with ls /etc/duply.

sudo duply website_name_database restore
sudo duply website_name_uploads restore

Changes in 2.0

• Removed dependency on paramiko
• You no longer need to list Stouts.backup role in the server.yml playbook, as it is automatically included in the tasks.
• A recent version of Trellis is necessary as this role uses the Mysql auth_socket plugin to connect to the database.

SCP Support Known Issues

To use an SCP target, you need to have paramiko installed on your server.

Paramiko's automatic installation was removed in 2.0. If you need it, you must install it manually or add it to Trellis tasks. There’s a known issue where paramiko may crash due to the SendEnv setting in the ssh_config created by Trellis.

S3 Support

There is a known issue when uploading to S3 buckets that only accept V4 signatures. To upload successfully, add the following to the backup: key in your wordpress_sites.yml:

wordpress_sites:
  example.com:
    backup:
      ...
+     params:
+       - 'export S3_USE_SIGV4="True"'

License

MIT

Authors

This role was primarily developed by Jill Royer and is currently maintained by Arjan Steenbergen.

This role requires the ansible-backup role by La France insoumise. It should be installed automatically by ansible.