Add Vaultwarden backup script with automated retention

- Runs container DB snapshot via docker exec
- Syncs DB, RSA keys, attachments, sends, and config via rsync
- Implements timestamped folders and retention pruning
- Sends pre-flight checks and execution status to ntfy

vaultwarden_backup.sh

@@ -2,25 +2,28 @@
 
 # ==============================================================================
 # Script: vaultwarden_backup.sh
-# Description: Backs up Vaultwarden (SQLite DB, RSA keys, attachments, 
+# Description: Backs up Vaultwarden to timestamped directories on a mounted 
-#              sends, and config) to a mounted drive using Vaultwarden's 
+#              drive using Docker exec and rsync. Utilizes hard links for 
-#              native backup command via Docker exec and rsync.
+#              deduplication and automatically prunes backups older than RETENTION_DAYS.
 # Usage:       sudo ./vaultwarden_backup.sh
-# Notes:       Must be run with root/sudo privileges to access Docker socket
+# Notes:       Must be run with root/sudo privileges.
-#              and host directories.
 # ==============================================================================
 
 # ==============================================================================
-# Define Variables for Source and Destination
+# Define Variables for Source, Destination, and Retention
 # ==============================================================================
 BACKUP_MOUNT_POINT="/mnt/5TB-Disk1"
-BACKUP_DESTINATION="$BACKUP_MOUNT_POINT/backup"
-
-# Vaultwarden settings
-CONTAINER_NAME="vaultwarden"
 VAULTWARDEN_DATA_DIR="/srv/docker/vaultwarden/data"
 VAULTWARDEN_DESTINATION="$BACKUP_MOUNT_POINT/backup/services/vaultwarden"
 
+CONTAINER_NAME="vaultwarden"
+RETENTION_DAYS=30
+
+# Timestamp and Folder Setup
+TIMESTAMP=$(date +"%Y-%m-%d_%H%M%S")
+CURRENT_BACKUP_DIR="$VAULTWARDEN_DESTINATION/backup_$TIMESTAMP"
+LATEST_LINK="$VAULTWARDEN_DESTINATION/latest"
+
 # ntfy Notification Configuration
 NTFY_TOPIC="Server"
 NTFY_SERVER="https://ntfy.speerfam.net"
@@ -51,13 +54,13 @@ if ! docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
     exit 1
 fi
 
-# Ensure the destination directory exists.
+# Create target directories if they don't exist
-mkdir -p "$VAULTWARDEN_DESTINATION"
+mkdir -p "$CURRENT_BACKUP_DIR"
 
 # ==============================================================================
 # Vaultwarden Backup Execution
 # ==============================================================================
-echo "Starting Vaultwarden backup via container exec..."
+echo "Starting Vaultwarden backup ($TIMESTAMP)..."
 
 # Step 1: Trigger in-container database backup
 docker exec "$CONTAINER_NAME" /vaultwarden backup
@@ -66,6 +69,7 @@ DB_STATUS=$?
 if [ $DB_STATUS -ne 0 ]; then
     echo "Error: Vaultwarden docker exec backup failed with exit code $DB_STATUS." >&2
     curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Vaultwarden internal DB backup command failed." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
+    rm -rf "$CURRENT_BACKUP_DIR"
     exit 1
 fi
 
@@ -75,36 +79,52 @@ LATEST_DB_BACKUP=$(ls -t "$VAULTWARDEN_DATA_DIR"/db_*.sqlite3 2>/dev/null | head
 if [ -z "$LATEST_DB_BACKUP" ]; then
     echo "Error: Could not locate generated db_*.sqlite3 backup file in '$VAULTWARDEN_DATA_DIR'." >&2
     curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: Vaultwarden backup snapshot file missing after exec." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
+    rm -rf "$CURRENT_BACKUP_DIR"
     exit 1
 fi
 
-# Rsync the snapshot file to destination as db.sqlite3
+# Rsync the snapshot file into the timestamped directory as db.sqlite3
-echo "Rsyncing database snapshot to '$VAULTWARDEN_DESTINATION/db.sqlite3'..."
+echo "Rsyncing database snapshot to '$CURRENT_BACKUP_DIR/db.sqlite3'..."
-rsync -av --no-owner --no-group "$LATEST_DB_BACKUP" "$VAULTWARDEN_DESTINATION/db.sqlite3"
+rsync -av --no-owner --no-group "$LATEST_DB_BACKUP" "$CURRENT_BACKUP_DIR/db.sqlite3"
 RSYNC_DB_STATUS=$?
 
+# Cleanup local temporary snapshot file
+rm -f "$LATEST_DB_BACKUP"
+
 if [ $RSYNC_DB_STATUS -ne 0 ]; then
     echo "Error: rsync failed to copy database snapshot file." >&2
     curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: rsync failed during Vaultwarden DB snapshot sync." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
     exit 1
 fi
 
-# Remove the temporary snapshot file from host source directory
+# Step 3: Rsync remaining data (using --link-dest for storage efficiency if 'latest' exists)
-rm -f "$LATEST_DB_BACKUP"
+echo "Rsyncing attachments, RSA keys, and configuration files..."
+LINK_DEST_PARAM=""
+if [ -d "$LATEST_LINK" ]; then
+    LINK_DEST_PARAM="--link-dest=$LATEST_LINK"
+fi
 
-# Step 3: Rsync remaining data (RSA keys, attachments, sends, config) excluding live db files
+rsync -av --no-owner --no-group $LINK_DEST_PARAM --exclude='db.sqlite3*' "$VAULTWARDEN_DATA_DIR/" "$CURRENT_BACKUP_DIR/"
-echo "Rsyncing attachments, RSA keys, and configuration files to '$VAULTWARDEN_DESTINATION'..."
-rsync -av --no-owner --no-group --exclude='db.sqlite3*' "$VAULTWARDEN_DATA_DIR/" "$VAULTWARDEN_DESTINATION/"
 RSYNC_DATA_STATUS=$?
 
+if [ $RSYNC_DATA_STATUS -ne 0 ]; then
+    echo "Error: rsync failed during remaining files sync." >&2
+    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: rsync failed during Vaultwarden data backup." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
+    exit 1
+fi
+
+# Step 4: Update 'latest' symlink to point to this new backup folder
+rm -f "$LATEST_LINK"
+ln -s "$CURRENT_BACKUP_DIR" "$LATEST_LINK"
+
+# ==============================================================================
+# Retention Cleanup (Prune Backups Older than RETENTION_DAYS)
+# ==============================================================================
+echo "Checking for backups older than $RETENTION_DAYS days..."
+find "$VAULTWARDEN_DESTINATION" -maxdepth 1 -type d -name "backup_*" -mtime +$RETENTION_DAYS -exec rm -rf {} +
+
 # ==============================================================================
 # Completion and Notification
 # ==============================================================================
-if [ $RSYNC_DATA_STATUS -eq 0 ]; then
+echo "Success: Vaultwarden backup completed at '$CURRENT_BACKUP_DIR'."
-    echo "Success: Vaultwarden database, keys, and attachments backed up to '$VAULTWARDEN_DESTINATION'."
+curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Success: Vaultwarden backup completed ($TIMESTAMP). Retaining $RETENTION_DAYS days." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
-    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Success: Vaultwarden backup completed successfully to $VAULTWARDEN_DESTINATION" "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
-else
-    echo "Error: rsync failed with exit code $RSYNC_DATA_STATUS. Check directory permissions." >&2
-    curl -H "Authorization: Bearer $NTFY_TOKEN" -d "Error: rsync failed during Vaultwarden data backup." "$NTFY_SERVER/$NTFY_TOPIC" > /dev/null 2>&1
-    exit 1
-fi