feat: Phase 13 — off-site backup with rclone + crypt encryption

Adds cloud sync extension to the daily backup script using rclone with client-side AES-256 encryption. Includes interactive setup script for configuring OneDrive, Google Drive, or any rclone provider. - scripts/setup-rclone.sh: interactive NAS rclone installer + config - scripts/cloud-backup.sh: sourced by backup.sh when CLOUD_ENABLED=true - backup.sh: cloud sync step runs after local backup Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-06 01:21:41 +08:00
parent 0a497ca0f1
commit dd64420de1
4 changed files with 261 additions and 4 deletions
@@ -0,0 +1,165 @@
+#!/bin/bash
+# setup-rclone.sh — Install and configure rclone for off-site NAS backups
+#
+# This script sets up rclone (via Docker) for syncing backups to a cloud provider.
+# It supports OneDrive, Google Drive, S3, or any rclone-compatible provider.
+#
+# Usage:
+#   ssh <nas> "$(cat setup-rclone.sh)"           # Run remotely on NAS
+#   bash setup-rclone.sh                          # Run directly on NAS
+#
+# After setup, enable cloud backup in .env:
+#   CLOUD_ENABLED=true
+
+set -euo pipefail
+
+# ── Config ──────────────────────────────────────────────────────────
+DOCKER="/volume1/@appstore/ContainerManager/usr/bin/docker"
+RCLONE_CONFIG_DIR="/volume1/docker/nas-tools/rclone"
+NAS_TOOLS_DIR="/volume1/docker/nas-tools"
+COMPOSE_DIR="/volume1/docker"
+
+# ── Step 1: Create config directory ─────────────────────────────────
+echo "=== rclone Setup ==="
+echo "Config dir: $RCLONE_CONFIG_DIR"
+mkdir -p "$RCLONE_CONFIG_DIR"
+
+# ── Step 2: Pull rclone image ───────────────────────────────────────
+echo ""
+echo "Pulling rclone Docker image..."
+$DOCKER pull rclone/rclone:latest
+
+# ── Step 3: Interactive rclone config ───────────────────────────────
+echo ""
+echo "=== Cloud Provider Configuration ==="
+echo ""
+echo "rclone will now run in interactive config mode."
+echo "Choose your cloud provider:"
+echo "  1) OneDrive  (recommended for Microsoft 365 users)"
+echo "  2) Google Drive  (Google account)"
+echo "  3) Other (S3, WebDAV, etc.)"
+echo ""
+read -rp "Provider [1-3]: " PROVIDER_CHOICE
+
+case "$PROVIDER_CHOICE" in
+    1) PROVIDER_NAME="onedrive";;
+    2) PROVIDER_NAME="google-drive";;
+    3) echo "Using generic config — follow rclone prompts."
+        PROVIDER_NAME="";;
+    *) echo "Invalid choice. Falling back to generic config."
+        PROVIDER_NAME="";;
+esac
+
+echo ""
+echo "Starting rclone config..."
+echo "Follow the prompts to:"
+echo "  1. Create a new remote (name it 'nas-backup')"
+if [ -n "$PROVIDER_NAME" ]; then
+    echo "  2. Select '$PROVIDER_NAME' as the storage type"
+fi
+echo "  3. Complete OAuth authentication"
+echo "  4. Exit the configurator when done"
+echo ""
+
+$DOCKER run -it --rm \
+    -v "$RCLONE_CONFIG_DIR:/config/rclone" \
+    rclone/rclone:latest \
+    config --config /config/rclone/rclone.conf
+
+# ── Step 4: Set up encryption remote ────────────────────────────────
+echo ""
+echo "=== Encryption Setup ==="
+echo "Backups should be encrypted before uploading to the cloud."
+echo "rclone's 'crypt' remote provides client-side AES-256 encryption."
+echo ""
+read -rp "Set up encryption remote? [Y/n]: " SETUP_CRYPT
+if [[ "$SETUP_CRYPT" =~ ^[Yy]?$ ]]; then
+    echo ""
+    echo "Starting rclone config for encryption remote..."
+    echo "  1. Create a NEW remote (name it 'nas-backup-crypt')"
+    echo "  2. Select 'crypt' as the storage type"
+    echo "  3. Set 'nas-backup:nas-tools' as the remote + path"
+    echo "  4. Choose 'standard' file name encryption"
+    echo "  5. Set your own password or generate one"
+    echo "  6. Exit when done"
+    echo ""
+    echo "NOTE: Save the encryption password somewhere safe!"
+    echo "Without it, backups CANNOT be recovered."
+    echo ""
+
+    $DOCKER run -it --rm \
+        -v "$RCLONE_CONFIG_DIR:/config/rclone" \
+        rclone/rclone:latest \
+        config --config /config/rclone/rclone.conf
+fi
+
+# ── Step 5: Test connection ─────────────────────────────────────────
+echo ""
+echo "=== Testing Connection ==="
+REMOTE_NAME="nas-backup"
+if $DOCKER run --rm \
+    -v "$RCLONE_CONFIG_DIR:/config/rclone" \
+    rclone/rclone:latest \
+    listremotes --config /config/rclone/rclone.conf; then
+    echo ""
+    echo "Configured remotes:"
+    $DOCKER run --rm \
+        -v "$RCLONE_CONFIG_DIR:/config/rclone" \
+        rclone/rclone:latest \
+        about "${REMOTE_NAME}:" --config /config/rclone/rclone.conf 2>&1 || \
+        echo "(note: 'about' may not be supported by all providers)"
+else
+    echo "ERROR: No remotes configured."
+    echo "Re-run this script or manually run:"
+    echo "  $DOCKER run -it --rm -v $RCLONE_CONFIG_DIR:/config/rclone rclone/rclone:latest config"
+    exit 1
+fi
+
+# ── Step 6: Patch backup.sh .env ────────────────────────────────────
+ENV_FILE="$NAS_TOOLS_DIR/.env"
+CLOUD_ENV_BLOCK="
+# --- Off-site Backup (rclone) ---
+CLOUD_ENABLED=true
+RCLONE_REMOTE=nas-backup
+RCLONE_CRYPT_REMOTE=nas-backup-crypt:nas-tools
+CLOUD_RETENTION_DAYS=30
+RCLONE_EXTRA_FLAGS=--bwlimit 5M
+RCLONE_CONFIG_DIR=$RCLONE_CONFIG_DIR
+"
+
+if [ -f "$ENV_FILE" ]; then
+    echo ""
+    echo "=== Updating .env ==="
+    echo "Appending cloud backup config to $ENV_FILE ..."
+    echo "$CLOUD_ENV_BLOCK" >> "$ENV_FILE"
+    echo "Done."
+else
+    echo ""
+    echo "=== .env not found ==="
+    echo "Create $ENV_FILE with:"
+    echo "$CLOUD_ENV_BLOCK"
+fi
+
+# ── Summary ─────────────────────────────────────────────────────────
+echo ""
+echo "=== Setup Complete ==="
+echo ""
+echo "The following rclone remotes are configured:"
+$DOCKER run --rm \
+    -v "$RCLONE_CONFIG_DIR:/config/rclone" \
+    rclone/rclone:latest \
+    listremotes --config /config/rclone/rclone.conf
+
+echo ""
+echo "To run a test backup:"
+echo "  ssh nas \"cd $COMPOSE_DIR/nas-tools && CLOUD_ENABLED=true bash backup.sh\""
+echo ""
+echo "To restore from cloud:"
+echo "  # List available backups:"
+echo "  ssh nas \"$DOCKER run --rm -v $RCLONE_CONFIG_DIR:/config/rclone rclone/rclone:latest \\
+        ls nas-backup-crypt:nas-tools --config /config/rclone/rclone.conf\""
+echo ""
+echo "IMPORTANT:"
+echo "  - If you used encryption, store the password in your password manager!"
+echo "  - The rclone config is at: $RCLONE_CONFIG_DIR/rclone.conf"
+echo "  - Back it up: cp $RCLONE_CONFIG_DIR/rclone.conf /volume1/backups/"