Status: 🚧 In Entwicklung (20% implementiert)
Letzte Aktualisierung: 2026-01-17
Kritikalität: HOCH - Aktuell keine vollständige Backup-Automatisierung!
Organisation: Privates Test-Lab (K.I.T. Solutions Entwicklung)
| Tool | Status | Funktion | Bewertung |
|---|---|---|---|
| Syncthing | ✅ Aktiv | Datei-Synchronisation barry ↔ cisco ↔ gideon | Gut, aber kein echtes Backup |
| Keycloak Export | ⚠️ Manuell | Letzte Sicherung: 2025-11-15 | Veraltet, nicht automatisiert |
| Unraid Array | ✅ Parity | Single-Parity-Schutz für gideon | Schützt gegen HDD-Ausfall |
3 Kopien der Daten
├─ 1x Production (Live auf cisco/gideon)
├─ 1x Lokales Backup (NAS-Array auf gideon)
└─ 1x Off-Site Backup (Cloud/Remote)
2 verschiedene Medien
├─ SSD/HDD (cisco, gideon)
└─ Cloud Storage (Hetzner/R2/B2)
1 Kopie Off-Site
└─ Cloudflare R2 / Hetzner Storage Box
| Datenquelle | Größe | Priorität | Backup-Methode |
|---|---|---|---|
| PostgreSQL (workmate_os) | ~500 MB | HOCH | pg_dump → Borg → Cloud |
| PostgreSQL (keycloak) | ~100 MB | HOCH | pg_dump → Borg → Cloud |
| PostgreSQL (n8n) | ~50 MB | MITTEL | pg_dump → Borg → Cloud |
| Vaultwarden (Passwörter) | ~10 MB | HOCH | SQLite → Borg → Cloud |
| Docker Compose Configs | ~5 MB | HOCH | Git + Borg |
| Datenquelle | Größe | Priorität | Backup-Methode |
|---|---|---|---|
| Paperless-ngx Dokumente | ~2 GB | MITTEL | Borg → Cloud |
| Wiki.js Daten | ~100 MB | MITTEL | SQLite → Borg |
| Home Assistant Config | ~50 MB | MITTEL | Git + Borg |
| Caddy/Traefik Configs | ~10 MB | MITTEL | Git + Borg |
| SSH Keys & GPG Keys | ~1 MB | HOCH | Borg (verschlüsselt) |
| Datenquelle | Größe | Priorität | Backup-Methode |
|---|---|---|---|
| Jellyfin Metadata | ~5 GB | NIEDRIG | Rsync → gideon |
| Navidrome Playlists | ~100 MB | NIEDRIG | Borg |
| Entwicklungsprojekte | ~10 GB | MITTEL | Git + Syncthing |
Vorteile:
Installation:
# Arch Linux (cisco)
sudo pacman -S borg
# Unraid (gideon)
# Via Community Apps: "Borg Backup"
Beispiel-Kommando:
# Repository initialisieren
borg init --encryption=repokey-blake2 /mnt/backup/borg-repo
# Backup erstellen
borg create --stats --progress \
/mnt/backup/borg-repo::workmate-{now} \
/var/lib/docker/volumes/postgres_data/_data/
# Alte Backups löschen (7 täglich, 4 wöchentlich, 6 monatlich)
borg prune --keep-daily=7 --keep-weekly=4 --keep-monthly=6 \
/mnt/backup/borg-repo
Vorteile:
Nachteil:
Cloud-Integration:
# Cloudflare R2 (S3-kompatibel)
export RESTIC_REPOSITORY="s3:https://<account-id>.r2.cloudflarestorage.com/homelab-backups"
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
restic init
restic backup /path/to/data
restic snapshots
Funktion: Echtzeit-Synchronisation
Geräte: barry ↔ cisco ↔ gideon
Ordner:
~/Dokumente/PhuDev/ (Code-Projekte)~/Syncthing/Configs/ (Dotfiles, SSH-Keys)~/Syncthing/Workmate/ (Workmate-Entwicklung)Limitierung:
Empfehlung: Syncthing NUR für Sync, NICHT als Backup-Strategie!
cisco:
# /etc/systemd/system/backup-databases.timer
[Unit]
Description=Daily Database Backup
[Timer]
OnCalendar=daily
OnCalendar=03:00
Persistent=true
[Install]
WantedBy=timers.target
Script: /usr/local/bin/backup-databases.sh
#!/bin/bash
set -euo pipefail
BACKUP_DIR="/mnt/gideon/backups/databases"
DATE=$(date +%Y-%m-%d_%H-%M-%S)
# PostgreSQL Backups
docker exec postgres pg_dumpall -U postgres | \
gzip > "$BACKUP_DIR/postgres_all_$DATE.sql.gz"
docker exec postgres pg_dump -U postgres workmate_os | \
gzip > "$BACKUP_DIR/workmate_os_$DATE.sql.gz"
docker exec postgres pg_dump -U postgres keycloak | \
gzip > "$BACKUP_DIR/keycloak_$DATE.sql.gz"
# MySQL Backup (Guacamole)
docker exec mysql mysqldump -u root -p$MYSQL_ROOT_PASSWORD guacamole_db | \
gzip > "$BACKUP_DIR/guacamole_$DATE.sql.gz"
# Borg Backup
borg create --stats --compression zstd,6 \
/mnt/gideon/borg-repo::databases-$DATE \
$BACKUP_DIR
# Cleanup (lokal nur 3 Tage behalten)
find $BACKUP_DIR -name "*.sql.gz" -mtime +3 -delete
echo "✅ Database Backup completed: $DATE" | \
systemd-cat -t backup-databases -p info
Geplant:
/etc/, /opt/, Docker Compose)Script: /usr/local/bin/backup-weekly.sh
#!/bin/bash
set -euo pipefail
DATE=$(date +%Y-%m-%d)
# Docker-Volumes
borg create --stats --compression zstd,9 \
/mnt/gideon/borg-repo::docker-volumes-$DATE \
/var/lib/docker/volumes/
# System-Configs
borg create --stats --compression zstd,9 \
/mnt/gideon/borg-repo::system-configs-$DATE \
/etc/ \
/opt/ \
/home/einfachnurphu/.ssh/ \
/home/einfachnurphu/.gnupg/ \
/root/docker-compose/
# Borg Prune (alte Backups löschen)
borg prune --keep-weekly=4 --keep-monthly=6 --keep-yearly=2 \
/mnt/gideon/borg-repo
echo "✅ Weekly Backup completed: $DATE"
Geplant:
Script: /usr/local/bin/backup-offsite.sh
#!/bin/bash
set -euo pipefail
# Rclone zu Cloudflare R2
rclone sync /mnt/gideon/borg-repo/ \
r2:homelab-backups/borg-repo/ \
--progress \
--transfers 4 \
--checkers 8
# Verify
rclone check /mnt/gideon/borg-repo/ r2:homelab-backups/borg-repo/
echo "✅ Off-Site Backup completed"
Vorteile:
Kosten-Beispiel (100 GB):
Setup:
# Rclone Config
rclone config create r2 s3 \
provider Cloudflare \
access_key_id <YOUR_KEY> \
secret_access_key <YOUR_SECRET> \
endpoint https://<account-id>.r2.cloudflarestorage.com
Vorteile:
Setup:
# Borg über SSH
borg init --encryption=repokey-blake2 \
ssh://u123456@u123456.your-storagebox.de:23/./backups/borg-repo
# Backup
borg create \
ssh://u123456@u123456.your-storagebox.de:23/./backups/borg-repo::workmate-{now} \
/var/lib/docker/volumes/postgres_data/
Vorteile:
Nachteil:
Modus: repokey-blake2
Schlüssel exportieren:
borg key export /mnt/gideon/borg-repo/ ~/borg-repo.key
# Backup auf USB-Stick + Passwort-Manager!
Automatisch aktiviert:
Passwort-Management:
# In .env-Datei
export RESTIC_PASSWORD_FILE="/root/.restic-password"
# Oder Systemd Credentials
systemd-creds encrypt - restic.cred <<< "mein-sicheres-passwort"
Konzept:
Beispiel:
# Am Ende von backup-databases.sh
curl -fsS --retry 3 https://hc-ping.com/your-uuid-here
Alternative: Self-hosted Uptime Kuma (bereits vorhanden!)
Geplant: Widget in Phu Dashboard
{
"last_backup": "2026-01-17T03:05:22Z",
"status": "success",
"size": "1.2 GB",
"duration": "4m 32s",
"next_backup": "2026-01-18T03:00:00Z"
}
# Datenbank löschen (VORSICHT!)
docker exec -it postgres psql -U postgres -c "DROP DATABASE workmate_os;"
docker exec -it postgres psql -U postgres -c "CREATE DATABASE workmate_os;"
# Backup einspielen
gunzip < /mnt/gideon/backups/databases/workmate_os_2026-01-17.sql.gz | \
docker exec -i postgres psql -U postgres workmate_os
# Liste alle Backups
borg list /mnt/gideon/borg-repo/
# Mount Backup (FUSE)
mkdir /tmp/borg-mount
borg mount /mnt/gideon/borg-repo::workmate-2026-01-17 /tmp/borg-mount
# Datei wiederherstellen
cp /tmp/borg-mount/path/to/file /restore/destination/
# Unmount
borg umount /tmp/borg-mount
Szenario: cisco komplett verloren
Recovery-Steps:
docker compose up -dRecovery Time Objective (RTO): ~4-6 Stunden
Recovery Point Objective (RPO): Max. 24 Stunden Datenverlust
Zeitaufwand: ~4-6 Stunden
Zeitaufwand: ~6-8 Stunden
Zeitaufwand: ~4-6 Stunden
Zeitaufwand: ~6-8 Stunden
| System | Storage | Verwendet | Frei |
|---|---|---|---|
| cisco | 500 GB SSD + 2 TB HDD | ~1.2 TB | ~1.3 TB |
| gideon | 240 GB + 119 GB + 2x 3 TB | ~3 TB | ~3 TB |
JONSBO N4 (6-Bay NAS):
Aufteilung:
# Borg Repository Info
borg info /mnt/gideon/borg-repo/
# Liste alle Backups
borg list /mnt/gideon/borg-repo/
# Backup-Größe anzeigen
borg info /mnt/gideon/borg-repo::workmate-2026-01-17
# Deduplizierungs-Statistik
borg info --stats /mnt/gideon/borg-repo/
# Prune (Simulation)
borg prune --dry-run --keep-daily=7 --keep-weekly=4 \
/mnt/gideon/borg-repo/
# PostgreSQL Backup (manuell)
docker exec postgres pg_dump -U postgres workmate_os | \
gzip > workmate_backup_$(date +%Y%m%d).sql.gz
# Restic Check
restic check
# Rclone Sync (Dry-Run)
rclone sync --dry-run /source/ r2:bucket/path/
Dokumentations-Stand: 2026-01-17
Implementierungs-Status: 20% (Syncthing aktiv, Rest geplant)
Nächste Review: Nach Phase 1 Implementierung (KW 4/2026)