Datastore Sync Hook Scripts

M

Mrt12

Well-Known Member
May 19, 2019
177
21
58
46
CH
Hello,
So I have one PBS Server on-site where all the clients and VMs get backed up. Very nice, super good deduplication and everything.
However, due to obvious reasons, a sync to a remote site is desirable.
I have on purpose for this configured a little Wireguard VPN that I connect to, then run the sync and then disconnect again from the VPN. This work beautifully and I can sync the local datastore to a remote PBS server using an API token and a dedicated namespace, to not mix things that do not belong together.
Currently, to achieve the sync, I made a little bash script, that first connects to the Wireguard VPN (using wg-quick), thn runs the datastore sync command from PBS, and then disconnects from the VPN again. I don't want the VPN connection to stay open longer than necessary.

When setting this up, I found it would be super convenient if the Proxmox Web GUI would offer the option to add pre-/post sync hook scripts, in this way, actions like connecting to a VPN and such could be performed before the sync starts.

Is there maybe already somehow the possibility, or could this be an interesting feature?
 
Mrt12 said:
I don't want the VPN connection to stay open longer than necessary.
Click to expand...
Understandably, but what about building it the other way around:

Connecting the tunnel from the destination side, running the sync job and the disconnecting it again? This is (without error handling) a 3 line bash script.
Pulling is in general considered safer, because an attacker cannot control this from the source.
 
  • Like
Reactions: Johannes S and UdoB
yes, this would work also, but still does not really solve the problem that some kind of pre/post-sync hook is required. Also the current implementation with pushing (rather than pulling) is a 3 line bash script, and it works well, but the disadvantage is that I cannot manage this particular sync job from the web GUI, because if the sync job is run from the web GUI, I first need to connect to the VPN and disconnect after it's done, but this is not possible.

So I set in the web GUI the schedule to "none", and then call the bash script from cron, that first connects the VPN, then manually starts the sync, and then disconnects. It would have been much nicer if all of these steps were visible in the web GUI, because if changes are made in the web GUI for whatever reason, these are not necessarily reflected into the bash script (and can be forgotten easily, for example).
 
Well, the problem is a bit more subtle.
I think for backups, the port 8007 needs to be used. However, on 8007 is also the Web GUI.
I would actually not be worried to have the backup server exposed to the internet, but I don't want the Web GUI be accessible. But I think it's not possible to avoid this?
i.e. if I want to backup from a remote site, I have to give access to 8007, and then anyone from the internet can also access my Web GUI, right?

This is why I configured Wireguard.

I set up a cronjob that connects Wireguard, then runs the sync, and then disconnects. Of course that works, but having the additional step of connecting/disconnecting the VPN visible in the Web Gui would be nice.
 
if you have no problem opening the API, you also don't have a problem opening the UI - they are one and the same.

note that you can configure the sync job using the UI but leave the schedule unset, and then run it via `proxmox-backup-manager sync-job run ..` in your script.
 
You must log in or register to reply here.
Top Bottom
Back