Install restic and setup backups using openstack application credentials

restic-os-install.sh

#!/usr/local/env bash

if [ -z $OS_AUTH_URL ]; then
  echo "OS_AUTH_URL is not set"
  exit 99
elif [ -z $OS_APPLICATION_CREDENTIAL_ID ]; then
  echo "OS_APPLICATION_CREDENTIAL_ID is not set"
  exit 99
elif [ -z $OS_APPLICATION_CREDENTIAL_SECRET ]; then
  echo "OS_APPLICATION_CREDENTIAL_SECRET is not set"
  exit 99
elif [ -z $ENCRYPTION_KEY ]; then
  echo "ENCRYPTION_KEY is not set"
  exit 99
fi

dnf -y install curl bzip2 wget jq

mkdir -p /etc/systemd/system
mkdir -p /usr/local/bin
mkdir -p /etc/restic

cat > /etc/systemd/system/restic-backup.service <<EOF
[Unit]
Description=Run Restic Backup
[Service]
Type=oneshot
EnvironmentFile=/etc/restic/restic.env
# This will backup the /home path, modifty to your needs
ExecStart=/usr/local/bin/restic backup /home --verbose --exclude-file=/etc/restic/restic.exclude
# If you have a separate excludes file, create /etc/restic.exclude with each pattern on a new line.
# Optionally, run a prune or check here after backups:
# ExecStartPost=/usr/local/bin/restic forget --prune --keep-daily 7
# ExecStartPost=/usr/local/bin/restic check
EOF

cat > /etc/systemd/system/restic-backup.timer <<EOF
[Unit]
Description=Run Restic backup every 12 hours

[Timer]
OnBootSec=15min
OnUnitActiveSec=12h
Unit=restic-backup.service

[Install]
WantedBy=multi-user.target
EOF

cat > /etc/restic/restic.env <<EOF
# Swift environment variables
OS_AUTH_URL="$OS_AUTH_URL"
OS_APPLICATION_CREDENTIAL_ID="$OS_APPLICATION_CREDENTIAL_ID"
OS_APPLICATION_CREDENTIAL_SECRET="$OS_APPLICATION_CREDENTIAL_SECRET"
# Restic encryption password
RESTIC_PASSWORD="$ENCRYPTION_KEY"
EOF

if [ -f /etc/restic/restic.exclude ]; then
  echo "Restic exclude file already exists, skipping creation."
else
  echo "Creating empty Restic exclude file at /etc/restic/restic.exclude."
  touch /etc/restic/restic.exclude
fi

grep -q RESTIC_REPOSITORY /etc/restic/restic.env || echo "RESTIC_REPOSITORY='swift:restic:/$(curl -s http://169.254.169.254/openstack/latest/meta_data.json | jq -r .uuid)'" | tee -a /etc/restic/restic.env
wget https://github.com/restic/restic/releases/download/v0.18.1/restic_0.18.1_linux_amd64.bz2 -O /opt/restic.bz2
bzip2 -d /opt/restic.bz2
mv /opt/restic /usr/local/bin/restic
chmod +x /usr/local/bin/restic
if /usr/sbin/getenforce; then
  chcon -R -t bin_t /usr/local/bin
fi
systemctl daemon-reload
bash -c "export $(grep -v '^#' /etc/restic/restic.env | xargs) && /usr/local/bin/restic init"
systemctl enable --now restic-backup.timer
systemctl start restic-backup.service