From d4d709347c211d69fab9a7f958739c0edd810261 Mon Sep 17 00:00:00 2001 From: Matt Speer Date: Sat, 3 Oct 2026 10:09:37 -0500 Subject: [PATCH] Add Vaultwarden backup script with automated retention - Runs container DB snapshot via docker exec - Syncs DB, RSA keys, attachments, sends, and config via rsync - Implements timestamped folders and retention pruning - Sends pre-flight checks and execution status to ntfy --- vaultwarden_backup.sh | 78 +++++++++++++++++++++++++++---------------- 1 file changed, 49 insertions(+), 29 deletions(-) diff --git a/vaultwarden_backup.sh b/vaultwarden_backup.sh index 7fcac99..316c2ee 100755 --- a/vaultwarden_backup.sh +++ b/vaultwarden_backup.sh @@ -2,25 +2,28 @@ # ============================================================================== # Script: vaultwarden_backup.sh -# Description: Backs up Vaultwarden (SQLite DB, RSA keys, attachments, -# sends, and config) to a mounted drive using Vaultwarden's -# native backup command via Docker exec and rsync. +# Description: Backs up Vaultwarden to timestamped directories on a mounted +# drive using Docker exec and rsync. Utilizes hard links for +# deduplication and automatically prunes backups older than RETENTION_DAYS. # Usage: sudo ./vaultwarden_backup.sh -# Notes: Must be run with root/sudo privileges to access Docker socket -# and host directories. +# Notes: Must be run with root/sudo privileges. # ============================================================================== # ============================================================================== -# Define Variables for Source and Destination +# Define Variables for Source, Destination, and Retention # ============================================================================== BACKUP_MOUNT_POINT="/mnt/5TB-Disk1" -BACKUP_DESTINATION="$BACKUP_MOUNT_POINT/backup" - -# Vaultwarden settings -CONTAINER_NAME="vaultwarden" VAULTWARDEN_DATA_DIR="/srv/docker/vaultwarden/data" VAULTWARDEN_DESTINATION="$BACKUP_MOUNT_POINT/backup/services/vaultwarden" +CONTAINER_NAME="vaultwarden" +RETENTION_DAYS=30 + +# Timestamp and Folder Setup +TIMESTAMP=$(date +"%Y-%m-%d_%H%M%S") +CURRENT_BACKUP_DIR="$VAULTWARDEN_DESTINATION/backup_$TIMESTAMP" +LATEST_LINK="$VAULTWARDEN_DESTINATION/latest" + # ntfy Notification Configuration NTFY_TOPIC="Server" NTFY_SERVER="https://ntfy.speerfam.net" @@ -51,13 +54,13 @@ if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then exit 1 fi -# Ensure the destination directory exists. -mkdir -p "$VAULTWARDEN_DESTINATION" +# Create target directories if they don't exist +mkdir -p "$CURRENT_BACKUP_DIR" # ============================================================================== # Vaultwarden Backup Execution # ============================================================================== -echo "Starting Vaultwarden backup via container exec..." +echo "Starting Vaultwarden backup ($TIMESTAMP)..." # Step 1: Trigger in-container database backup docker exec "$CONTAINER_NAME" /vaultwarden backup @@ -66,6 +69,7 @@ DB_STATUS=$? if [ $DB_STATUS -ne 0 ]; then echo "Error: Vaultwarden docker exec backup failed with exit code $DB_STATUS." >&2 curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Vaultwarden internal DB backup command failed." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1 + rm -rf "$CURRENT_BACKUP_DIR" exit 1 fi @@ -75,36 +79,52 @@ LATEST_DB_BACKUP=$(ls -t "$VAULTWARDEN_DATA_DIR"/db_*.sqlite3 2>/dev/null | head if [ -z "$LATEST_DB_BACKUP" ]; then echo "Error: Could not locate generated db_*.sqlite3 backup file in '$VAULTWARDEN_DATA_DIR'." >&2 curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Vaultwarden backup snapshot file missing after exec." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1 + rm -rf "$CURRENT_BACKUP_DIR" exit 1 fi -# Rsync the snapshot file to destination as db.sqlite3 -echo "Rsyncing database snapshot to '$VAULTWARDEN_DESTINATION/db.sqlite3'..." -rsync -av --no-owner --no-group "$LATEST_DB_BACKUP" "$VAULTWARDEN_DESTINATION/db.sqlite3" +# Rsync the snapshot file into the timestamped directory as db.sqlite3 +echo "Rsyncing database snapshot to '$CURRENT_BACKUP_DIR/db.sqlite3'..." +rsync -av --no-owner --no-group "$LATEST_DB_BACKUP" "$CURRENT_BACKUP_DIR/db.sqlite3" RSYNC_DB_STATUS=$? +# Cleanup local temporary snapshot file +rm -f "$LATEST_DB_BACKUP" + if [ $RSYNC_DB_STATUS -ne 0 ]; then echo "Error: rsync failed to copy database snapshot file." >&2 curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: rsync failed during Vaultwarden DB snapshot sync." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1 exit 1 fi -# Remove the temporary snapshot file from host source directory -rm -f "$LATEST_DB_BACKUP" +# Step 3: Rsync remaining data (using --link-dest for storage efficiency if 'latest' exists) +echo "Rsyncing attachments, RSA keys, and configuration files..." +LINK_DEST_PARAM="" +if [ -d "$LATEST_LINK" ]; then + LINK_DEST_PARAM="--link-dest=$LATEST_LINK" +fi -# Step 3: Rsync remaining data (RSA keys, attachments, sends, config) excluding live db files -echo "Rsyncing attachments, RSA keys, and configuration files to '$VAULTWARDEN_DESTINATION'..." -rsync -av --no-owner --no-group --exclude='db.sqlite3*' "$VAULTWARDEN_DATA_DIR/" "$VAULTWARDEN_DESTINATION/" +rsync -av --no-owner --no-group $LINK_DEST_PARAM --exclude='db.sqlite3*' "$VAULTWARDEN_DATA_DIR/" "$CURRENT_BACKUP_DIR/" RSYNC_DATA_STATUS=$? +if [ $RSYNC_DATA_STATUS -ne 0 ]; then + echo "Error: rsync failed during remaining files sync." >&2 + curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: rsync failed during Vaultwarden data backup." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1 + exit 1 +fi + +# Step 4: Update 'latest' symlink to point to this new backup folder +rm -f "$LATEST_LINK" +ln -s "$CURRENT_BACKUP_DIR" "$LATEST_LINK" + +# ============================================================================== +# Retention Cleanup (Prune Backups Older than RETENTION_DAYS) +# ============================================================================== +echo "Checking for backups older than $RETENTION_DAYS days..." +find "$VAULTWARDEN_DESTINATION" -maxdepth 1 -type d -name "backup_*" -mtime +$RETENTION_DAYS -exec rm -rf {} + + # ============================================================================== # Completion and Notification # ============================================================================== -if [ $RSYNC_DATA_STATUS -eq 0 ]; then - echo "Success: Vaultwarden database, keys, and attachments backed up to '$VAULTWARDEN_DESTINATION'." - curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Success: Vaultwarden backup completed successfully to $VAULTWARDEN_DESTINATION" "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1 -else - echo "Error: rsync failed with exit code $RSYNC_DATA_STATUS. Check directory permissions." >&2 - curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: rsync failed during Vaultwarden data backup." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1 - exit 1 -fi \ No newline at end of file +echo "Success: Vaultwarden backup completed at '$CURRENT_BACKUP_DIR'." +curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Success: Vaultwarden backup completed ($TIMESTAMP). Retaining $RETENTION_DAYS days." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1 \ No newline at end of file