ccnet-WI: add a borg backup target on the QNAP alongside the PBS replica #24
Labels
No labels
blocked
borg-backup
ceph
forgejo
in-progress
infra
netdata
nextcloud
p:high
p:low
p:medium
searxng
service-onboard
swarm-nodes
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
copper/ccnet-prod-devops#24
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
docs/ccnet-wi-site.md documents ccnet-wi-pbs (CT101) as a pull-based offsite replica of the main site's PBS (aegis-unraid) onto ccnet-wi-qnap's RAID6 array — confirmed working 2026-07-13. There's no equivalent borg-based replica at this site, though: ccnet-borg-backup/ pushes CephFS archives (client swarm-cephfs) only to Unraid's borgserver, with no offsite copy of that data anywhere.
Scope: stand up a borg repo target on ccnet-wi-qnap (or a small CT alongside ccnet-wi-pbs, mirroring the QNAP-as-NFS-target pattern already in place) so CephFS backup data lands here too, alongside the PBS replica — giving this site full offsite coverage for both backup mechanisms the main site uses, not just one. Could be a direct borg push from swarm-mgr-01 (a second client name, e.g. swarm-cephfs-wi) or a periodic sync of the existing Unraid borgserver repo — needs scoping.
Related: ccnet-borg-backup/, docs/ccnet-wi-site.md's ccnet-wi-pbs section.
Done. WI-site offsite copy of the
swarm-cephfsborg backup is live and verified.Final design (see
ccnet-borg-backup/README.mdanddocs/ccnet-wi-site.md'sccnet-wi-borgbackupsection for full detail): a real second independent borg client (swarm-cephfs-wi), not a mirror — swarm-mgr-01 pushes directly to a dedicatedborg servetarget on a new unprivileged LXC,ccnet-wi-borgbackup(CT102,10.20.10.253) onccnet-wi-trixie, landing on the same QNAP arrayccnet-wi-pbsalready uses.Delivered:
swarm-cephfsconfig touched)borg extract, checksums verified against live databorg check --repository-onlynow deployed for both destinations (added the same check to the original Unraid client too, once it turned up that one had never had scheduled verification at all) — both proven clean via a real manual runReal gotchas hit and documented for next time: unprivileged Proxmox LXCs can't mount NFS at all (host-mount + bind-mount-point workaround), OPNsense's legacy
write_config()silently no-ops on Model-layer changes, borg'sssh://absolute-vs-relative path syntax.Follow-up filed separately, not blocking this: #42 (WireGuard tunnel throughput tuning, p:low) and #41 (OPNsense API key for the WI firewall, p:low).