Suggestions for the Proxmox VE Host Backup script (encryption and restore options)

[pucaleco]

Hi @tteck
Thank you for an amazing set of scripts to manage the Proxmox VE (to you and all the contributors)

I'm not a developer/programmer so I wouldn't want to try to do a pull request to modify the code (I don't even know what's the correct ettiquete to suggest a change in a github repository hehehe, but doing my best)
I was wondering if you would consider to extend the functionality of the Host backup script.

Manually selecting some /etc files seems cumbersome and honestly, compressing a copy of the entire folder leads to a very little backup size in Proxmox as far as I've seen.
I'm thinking here of something like a complete OS HD failure, and a quick way to recover from that (instal PVE, restore this set of files).
I've defaulted to backup all /etc
I added /var/lib/pve-cluster/config.db, and /root/.ssh to the list of files pre-selected to be backed up.
Added a prompt to password protect the file.

I'm attaching a proposed approach to do this based on your script.

I think this version could also be easily modified so that the script allows to automate creating a config file based on the selected parameters and a cron job.

Is sharing the code here ok?, if I need to share it elswhere, please let me know. Always willing to learn :)

[tteck]

Sharing code is good, downloads not.

[pucaleco]

Let's see:

#!/usr/bin/env bash

# >>>THIS IS NOT THE OFFICIAL HELPER-SCRIPT, this is a proposed feature inclusion. For the official one, please refer to tteck's code at https://github.com
# Copyright (c) 2021-2024 tteck
# Author: tteck (tteckster)
# License: MIT
# https://github.com/tteck/Proxmox/raw/main/LICENSE

function header_info {
  clear
  cat <<"EOF"
   __ __         __    ___           __
  / // /__  ___ / /_  / _ )___ _____/ /____ _____
 / _  / _ \(_-</ __/ / _  / _ `/ __/  '_/ // / _ \
/_//_/\___/___/\__/ /____/\_,_/\__/_/\_\\_,_/ .__/
                                           /_/
EOF
}

# Function to perform backup
function perform_backup {
  local BACKUP_PATH
  local BACKUP_FILE
  local PASSWORD
  local CONFIRM_PASSWORD
  local DIR
  local selected_directories=()

  # Get backup path from user
  BACKUP_PATH=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "\nDefaults to /root/\ne.g. /mnt/backups/" 11 68 --title "Directory to backup to:" 3>&1 1>&2 2>&3) || return

  # Default to /root/ if no input
  BACKUP_PATH="${BACKUP_PATH:-/root/}"

  BACKUP_FILE="$(hostname)-backup"

  # Ask the user if they want to backup the usual files
  if (whiptail --backtitle "Proxmox VE Helper Scripts" --yesno "Backup the usual files (/etc, /var/lib/pve-cluster/config.db, and /root/.ssh)?" 10 88); then
    # Directories to backup
    selected_directories=( "/etc" "/var/lib/pve-cluster/config.db" "/root/.ssh" )
  else
    # Get directory to work in from user
    DIR=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "\nDefaults to /etc/\ne.g. /root/, /var/lib/pve-cluster/ etc." 11 68 --title "Directory to work in:" 3>&1 1>&2 2>&3) || return

    # Default to /etc/ if no input
    DIR="${DIR:-/etc/}"

    # Build a list of directories for backup
    local CTID_MENU=()
    while read -r dir; do
      CTID_MENU+=( "$(basename "$dir")" "$dir " "OFF" )
    done < <(ls -d "${DIR}"*)

    # Allow the user to select directories
    local HOST_BACKUP
    while [ -z "${HOST_BACKUP:+x}" ]; do
      HOST_BACKUP=$(whiptail --backtitle "Proxmox VE Host Backup" --title "Working in the ${DIR} directory " --checklist \
        "\nSelect what files/directories to backup:\n" 16 $(((${#DIRNAME} + 2) + 88)) 6 "${CTID_MENU[@]}" 3>&1 1>&2 2>&3) || return

      for selected_dir in ${HOST_BACKUP//\"/}; do
        selected_directories+=( "${DIR}$selected_dir" )
      done
    done
  fi

  # Get password from user
  while true; do
    PASSWORD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --passwordbox "Enter a password for the backup:" 10 60 3>&1 1>&2 2>&3) || return
    CONFIRM_PASSWORD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --passwordbox "Confirm the password:" 10 60 3>&1 1>&2 2>&3) || return
    if [ "$PASSWORD" = "$CONFIRM_PASSWORD" ]; then
      break
    else
      whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox "Passwords do not match. Please try again." 10 60
    fi
  done

  # Confirm before performing the backup
  if (whiptail --backtitle "Proxmox VE Helper Scripts" --yesno "This will create a password-protected backup in $BACKUP_PATH for these files and directories ${selected_directories[*]}. Proceed?" 10 88); then
    header_info
    echo "Working..."
    tar -czf - --absolute-names "${selected_directories[@]}" | openssl enc -aes-256-cbc -e -pass pass:"$PASSWORD" > "$BACKUP_PATH$BACKUP_FILE-$(date +%Y_%m_%d-%H_%M_%S).tar.gz"
    header_info
    echo -e "\nFinished"
    echo -e "\\e[1;33m \nA backup is rendered ineffective when it remains stored on the host.\n \\e[0m"
    sleep 2
  fi
}

# Function to restore backup
function restore_backup {
  local BACKUP_PATH
  local BACKUP_FILE
  local PASSWORD
  local CONFIRM_PASSWORD
  local TEMP_DIR

  # Get backup path from user
  BACKUP_PATH=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "\nDefaults to /root/\ne.g. /mnt/backups/" 11 68 --title "Directory to restore from:" 3>&1 1>&2 2>&3) || return

  # Default to /root/ if no input
  BACKUP_PATH="${BACKUP_PATH:-/root/}"

  # Get backup file from user
  BACKUP_FILE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "\nDefaults to $(hostname)-backup-$(date +%Y_%m_%d-%H_%M_%S).tar.gz" 11 68 --title "Backup file to restore:" 3>&1 1>&2 2>&3) || return

  # Default to hostname-backup-date if no input
  BACKUP_FILE="${BACKUP_PATH}${BACKUP_FILE:-$(hostname)-backup-$(date +%Y_%m_%d-%H_%M_%S).tar.gz}"

  # Confirm before performing the restore
  if (whiptail --backtitle "Proxmox VE Helper Scripts" --yesno "This will restore a backup from $BACKUP_FILE. This is a potentially destructive process. Are you sure you want to restore?" 10 88); then
    if (whiptail --backtitle "Proxmox VE Helper Scripts" --yesno "This is your last chance to cancel. Restoring will replace important system files. There's no way back after this. Are you sure you want to proceed?" 10 88); then
      # Rename the folders and files to be replaced
      mv /etc /BACKUP-$(date +%Y_%m_%d-%H_%M_%S)-etc
      mv /var/lib/pve-cluster/config.db /var/lib/pve-cluster/BACKUP-$(date +%Y_%m_%d-%H_%M_%S)-config.db
      mv /root/.ssh /root/BACKUP-$(date +%Y_%m_%d-%H_%M_%S).ssh

      # Create a temporary directory for extraction
      TEMP_DIR="${BACKUP_PATH}temp-$(basename "$BACKUP_FILE" .tar.gz)/"
      mkdir -p "$TEMP_DIR"

      # Extract the backup to the temporary directory
      openssl enc -aes-256-cbc -d -in "$BACKUP_FILE" | tar xz -C "$TEMP_DIR"

      # Move each uncompressed element to its corresponding location
      mv "${TEMP_DIR}etc" /etc
      mv "${TEMP_DIR}var/lib/pve-cluster/config.db" /var/lib/pve-cluster/config.db
      mv "${TEMP_DIR}root/.ssh" /root/.ssh

      # Delete the temporary directory
      rm -r "$TEMP_DIR"

      header_info
      echo -e "\nFinished"
      echo -e "\\e[1;33m \nYou need to reboot to see changes applied.\\n \\e[0m"
      sleep 2
    fi
  fi
}

# Main script execution loop
if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "Proxmox VE Host Backup" --yesno "This will create backups for /etc, /var/lib/pve-cluster/config.db, and /root/.ssh. Proceed?" 10 88); then
  perform_backup
elif (whiptail --backtitle "Proxmox VE Helper Scripts" --title "Proxmox VE Host Restore" --yesno "This will restore backups for /etc, /var/lib/pve-cluster/config.db, and /root/.ssh. Proceed?" 10 88); then
  restore_backup
fi