Viewing topic Nextcloud backup solution

Title: Nextcloud backup solution

omicron-b 12 Dec 2020

Link

I'm planning to move my Nextcloud from a VPS to a home server next year, so I would like to have an opinion here on backup solution, since it's risky to keep only physical backup, and on my setup in general.

Here's a plan:
1) Nextcloud server on Ubuntu 20.04, LUKS disk encryption + ZFS
2) weekly backup to home PC
3) once a year backup to HDD that I would keep in a storage room, not at home
4) once a year take a snapshot, pipe to gzip, encrypt and backup to S3 Glacier storage (which is pretty cheap)

- Are there any improvements you can propose?
- I would like my home server to be able to boot automatically if power goes down briefly, I tried to save a decryption key into initrams to achieve that and it works, but that renders encryption pretty useless. Is there a way to only decrypt and boot when some kind of USB key is present?
Maybe I should encrypt only data partition and write some bash to read USB, mount data partition, then start nginx, php, etc.?

Thanks!

1 Likes, Who?

PublicNuisance 12 Dec 2020

Link

Quoting: omicron-bI'm planning to move my Nextcloud from a VPS to a home server next year, so I would like to have an opinion here on backup solution, since it's risky to keep only physical backup, and on my setup in general.

Here's a plan:
1) Nextcloud server on Ubuntu 20.04, LUKS disk encryption + ZFS
2) weekly backup to home PC
3) once a year backup to HDD that I would keep in a storage room, not at home
4) once a year take a snapshot, pipe to gzip, encrypt and backup to S3 Glacier storage (which is pretty cheap)

- Are there any improvements you can propose?
- I would like my home server to be able to boot automatically if power goes down briefly, I tried to save a decryption key into initrams to achieve that and it works, but that renders encryption pretty useless. Is there a way to only decrypt and boot when some kind of USB key is present?
Maybe I should encrypt only data partition and write some bash to read USB, mount data partition, then start nginx, php, etc.?

Thanks!

That's pretty similar to my backup routine so I can't fault much. I have Nextcloud for non sensitive data that is on a Trisquel machine using LUKS and ZFS. I use Back in Time for daily snapshots; do a weekly manual backup; and monthly clone images to a physical drive which is kept in a fire proof safe. Would a Librem key work for your USB option ? I don't know a lot about them but I think they deal with having encyrption keys on USB.

https://puri.sm/products/librem-key/

1 Likes, Who?

damarrin 12 Dec 2020

Link

You need a UPS obviously so it doesn't go down.

I have Nextcloud in a VM on Proxmox. If I need to start/restart it remotely, I connect with OpenVPN and then SSH into the VM or use Proxmox's web gui.

0 Likes

Julius 12 Dec 2020

Link

View PC info

Also look into FreeNAS (or now TrueNAS Core after their rebrand). Its FreeBSD based, but if you just plan to run Nextcloud on the system, it offers a really convenient plugin for it. ZFS 2.0 support is also much better than on Linux right now.

0 Likes

omicron-b 12 Dec 2020

Link

Quoting: PublicNuisanceWould a Librem key work for your USB option ? I don't know a lot about them but I think they deal with having encyrption keys on USB.

https://puri.sm/products/librem-key/

Thanks, great tip!
Actually, this gave me a simpler and cheaper idea: USB drive with a boot partition and grub.
The steps would look like:
1) Install Ubuntu with separate unencrypted /boot (default when you select full disk encryption)
2) Create a decryption key for LUKS partition and keep it on that LUKS partition, generate initramfs with that key
3) Copy grub and boot to a USB drive
4) Test booting from USB drive
5) Delete grub and boot from server, overwrite free space with zeroes

In case you break or loose the key, you still have the passphrase to unlock the disk.

1 Likes, Who?

damarrin 12 Dec 2020

Link

I’d say security is seriously lessened if the usb key is permanently stuck into the computer it’s supposed to be booting.

0 Likes

denyasis 12 Dec 2020

Link

Agreed. I'd say if you want some form of automation so the system comes up on it's own, full disk encryption would seem to be moot.

What is the purpose of the encryption? Like what are you wanting to do?

Either you need manual intervention to unlock the encryption on boot, or you'd need the keys initramfs usb to boot, etc.

Maybe instead of full disk encryption run by the root, perhaps move the encryption toward user space?
I know NextCloud has an encryption module built in. Would something like that work?

1 Likes, Who?

omicron-b 12 Dec 2020

Link

Quoting: damarrinI’d say security is seriously lessened if the usb key is permanently stuck into the computer it’s supposed to be booting.

I agree.

So far 3 use cases for that kind of encryption (USB key always in):
1) The disk is bad, I want to replace it. No need to worry about data on a bad disk.
2) Police comes in without any good reason and wants to seize all my digital devices.
Take out and lose the USB key and shutdown the server.
3) I'm moving and want to leave my server with a 3rd party for a while

Quoting: denyasisI know NextCloud has an encryption module built in. Would something like that work?

I looked into that, and they only have a manual for enabling server-side encryption, zero-access encryption is also declared but I did not find any manual on that.

0 Likes

damarrin 12 Dec 2020

Link

Police would probably seize everything, if you manage to take out the key then cool. If they take the server out, it'll be turned off anyway.

A thief might leave the usb key, or break it as they're running off with your hardware.

I still think just typing in a password on boot is most sensible. Unless you're treating this as a learning exercise, in which case go right ahead and describe your experiences somewhere online for posterity. :-)

0 Likes

Arehandoro 12 Dec 2020

Link

Supporter

View PC info

Quoting: omicron-b2) Police comes in without any good reason and wants to seize all my digital devices.
Take out and lose the USB key and shutdown the server.

If you have backups in AWS Glacier the police doesn't need to seize your devices at all, they'll know you have an AWS account if you're onto something and AWS are obliged to give them your data.

As for the backups, I run NC in docker in a PC with RAID 10 and drive encryption at home. With rsync I upload incrementally the content each night to Backblaze -cheaper than Glacier- when the network is pretty much unused.

So far has been a quite solid solution.

0 Likes

omicron-b 13 Dec 2020

Link

Quoting: ArehandoroIf you have backups in AWS Glacier the police doesn't need to seize your devices at all, they'll know you have an AWS account if you're onto something and AWS are obliged to give them your data.

It's encrypted though. Let them have it.

Quoting: ArehandoroAs for the backups, I run NC in docker in a PC with RAID 10 and drive encryption at home. With rsync I upload incrementally the content each night to Backblaze -cheaper than Glacier- when the network is pretty much unused.

So far has been a quite solid solution.

Thanks, it's great to know of an alternative. Although just now I found even cheaper Amazon storage class - S3 Glacier Deep Archive.
It would cost me crazy 0.36 + taxes per month to store 200 GB of data, and about 6 USD to retrieve it (which hopefully never happens, as it would mean 2 of my HDDs are dead or lost).
It takes up to 12h to access data, but that's not a problem for me.

0 Likes

walther von stolzing 13 Dec 2020

Link

View PC info

Quoting: omicron-bIt would cost me crazy 0.36 + taxes per month to store 200 GB of data, and about 6 USD to retrieve it

... those are absurdly low prices; I had no idea. I once considered using [tarsnap](https://www.tarsnap.com/); but this is an order of magnitude cheaper.

Slightly more on topic, my S3 Glacier-Tier $.0002 on Nextcloud: Upgrade woes & half-baked features that keep getting added left me pretty disappointed with NC; though I was a very enthusiastic user in the beginning. I'm sure using it for storage only would be less of a hassle compared to crash-prone Collabora & Only Office; though in that case I suspect just using native ZFS encryption with standard unix tools for moving data in & out would be a better choice.

0 Likes

While you're here, please consider supporting GamingOnLinux on:

Reward Tiers: Patreon. Plain Donations:

PayPal.

This ensures all of our main content remains totally free for everyone! Patreon supporters can also remove all adverts and sponsors! Supporting us helps bring good, fresh content. Without your continued support, we simply could not continue!

You can find even more ways to support us on this dedicated page any time. If you already are, thank you!