linux - Storing locally encrypted incremental ZFS snapshots in Amazon Glacier -
to have off-site , durable backups of zfs pool, store zfs snapshots in amazon glacier. data need encrypted locally, independently amazon, ensure privacy. how accomplish this?
an existing snapshot can sent s3 bucket following:
zfs send -r <pool name>@<snapshot name> | gzip | gpg --no-use-agent --no-tty --passphrase-file ./passphrase -c - | aws s3 cp - s3://<bucketname>/<filename>.zfs.gz.gpg
or incremental back-ups:
zfs send -r -i <pool name>@<snapshot incremental backup from> <pool name>@<snapshot name> | gzip | gpg --no-use-agent --no-tty --passphrase-file ./passphrase -c - | aws s3 cp - s3://<bucketname>/<filename>.zfs.gz.gpg
this command take existing snapshot, serialize zfs send, compress it, , encrypt passphrase gpg. passphrase must readable on first line in ./passphrase file.
remember back-up passphrase-file separately in multiple locations! - if lose access it, you'll never able data again!
this requires:
- a pre-created amazon s3 bucket
- awscli installed (
pip install awscli
) , configured (aws configure
). - gpg installed
lastly, s3 lifecycle rules can used transition s3 object glacier after pre-set amount of time (or immediately).
for restoring:
aws s3 cp - s3://<bucketname>/<filename>.zfs.gz.gpg | gpg --no-use-agent --passphrase-file ./passphrase -d - | gunzip | sudo zfs receive <new dataset name>
Comments
Post a Comment