Legacy backboa & duobackboa (AWS S3)

backboa is BOA's original off-site backup tool: AWS-S3-only, single bucket, symmetric-passphrase Duplicity encryption, configured inline through _AWS_* variables. duobackboa is its twin pointed at a second, independent bucket. Both ship and run on every host (no license gate) and remain on the static crontab; the modern path is multiback/dcysetup. This page is the operating reference for hosts still running the legacy tools.

Configuration — AWS*

backboa sources /root/.barracuda.cnf; duobackboa sources /root/.duobackboa.cnf. Same variable set:

# Required
_AWS_KEY='AWS Access Key ID'
_AWS_SEC='AWS Secret Access Key'
_AWS_PWD='encryption passphrase'   # openssl rand -base64 32 — store it safely
_AWS_REG='us-east-1'               # AWS region (default us-east-1 if empty)

# Optional (defaults shown)
_AWS_TTL='30D'                     # retention window (remove-older-than)
_AWS_FLC='7D'                      # full-cycle frequency (--full-if-older-than)
_AWS_VLV='warning'                 # Duplicity verbosity: error/warning/notice/info/debug
_AWS_EXB='YES'                     # exclude Aegir Backup tarballs (data/disk/*/backups)

Missing any of the three credential values (_AWS_KEY, _AWS_SEC, _AWS_PWD) prints the configuration block (with the full supported _AWS_REG list) and exits. _AWS_REG is the fourth nominally-required value but does not gate that check — an empty _AWS_REG silently defaults to us-east-1. When set, _AWS_REG is validated against a fixed allowlist of 31 regions including the two GovCloud regions. _AWS_TTL defaults to 30D and _AWS_FLC to 7D when unset. /data/conf/arch is excluded regardless of _AWS_EXB; the variable only toggles the per-tenant tarball exclusion. The default YES adds --exclude-regexp '^/data/disk/.*/backups' (the Aegir Backup tarballs); _AWS_EXB=NO drops that one regexp so the tarballs are kept.

These are the legacy equivalents of multiback's KEEP_WITHIN / FULL_BACKUP_FREQUENCY — see Retention.

What gets backed up

backboa and duobackboa both use the same _SOURCE:

/data /etc /home /opt/solr4 /var/aegir /var/solr7 /var/solr9 /var/www /var/xdrago

That is, the full nine-path set — including the Solr index dirs and /var/xdrago (BOA's own tooling/logs), which a shorter five-path list would wrongly imply are excluded. The backup is sent to a single S3 bucket with a --volsize 300, --s3-use-ia Duplicity invocation under symmetric (_AWS_PWD) encryption.

Bucket names

Tool Bucket
backboa daily-boa-<host-with-dashes>
duobackboa daily-remote-<host-with-dashes>

<host> is /etc/hostname lowercased with dots replaced by dashes (verify with cat /etc/hostname). Duplicity can create the bucket on demand but in practice AWS region propagation delays make that unreliable — create the bucket in the AWS S3 console first, in the _AWS_REG region, with the exact name above.

Install & first run

backboa install        # install/upgrade Duplicity + Python + par2 + awscli/boto3
backboa test           # verify connection to the bucket
backboa backup         # first run (a full)

install performs dependency setup only — it does not validate config. _AWS_* is sourced on every invocation; test is the connectivity check.

Scheduled runs — the static crontab

The legacy tools run from the BOA-managed root user crontab (the fixed crontab -l schedule), not the interval /etc/cron.d/duplicity_backup drop-in that the modern path uses:

15 3 * * *   ...  /opt/local/bin/backboa backup
15 5 * * *   ...  /opt/local/bin/duobackboa backup

So backboa runs at 03:15 and duobackboa at 05:15 daily. (For reference, the local SQL dump mysql_backup.sh runs at 01:15 and graceful.sh at 03:01 — neither is a remote backup.) Full-vs-incremental is decided inside the tool (_set_mode/_randomize_full), not by a separate weekly cron line.

Randomised full-backup day

By default _RDW=7 (Sunday) is the full-backup weekday when _AWS_FLC=7D. Creating /root/.randomize_duplicity_full_backup_day.cnf switches to a randomised, persisted weekday (stored locally in /var/log/boa/<bucket>.randomize.full.log) and staggers each step with a random short sleep — useful to spread fleet load off a fixed Sunday peak. duobackboa defaults to _RDW=6 in the non-randomised branch.

Monthly cleanup toggle

_monthly_cleanup runs cleanup --force once a month on a per-bucket random day-of-month 1–5 (persisted in /var/log/boa/<bucket>.randomize.cleanup.log), unless /root/.skip_duplicity_monthly_cleanup.cnf exists. Age retention itself runs via remove-older-than ${_AWS_TTL} --force after a full-day run.

Custom include / exclude

Beyond _AWS_EXB, fine-tune with singular-named files (a trailing s would be read by nothing):

/root/.backboa.include       (--include-filelist)
/root/.backboa.exclude       (--exclude-filelist)

duobackboa reads /root/.duobackboa.include / /root/.duobackboa.exclude. One path per line.

Restore & retrieve

restore is positional; the optional time is the second argument (there is no --time CLI flag — the --time is internal to the Duplicity call). The path must not start with a slash:

# latest version of a path to tmp/
backboa restore data/disk/o1/backups/foo.tar.gz tmp/foo.tar.gz

# an older version — interval or full date as the middle positional
backboa restore data/disk/o1/backups 7D8h8s tmp/backups
backboa restore data/disk/o1/backups 2014/11/11 tmp/backups

retrieve restores another host's bucket — it appends the source hostname so the bucket name resolves to that host, while reading the current host's _AWS_* credentials (set them to the source host's keys temporarily):

backboa retrieve data/disk/o1/backups/foo.tar.gz tmp/foo.tar.gz srv.foo.bar
backboa retrieve data/disk/o1/backups 2014/11/11 tmp/backups srv.foo.bar

Restored content goes to the target you name; it does not overwrite source files. Move it back with mv/rsync afterwards.

Logs

/var/log/boa/daily-boa-<host>.log        (backboa, + .archive.log)
/var/log/boa/daily-remote-<host>.log     (duobackboa, + .archive.log)

There is no file named backboa.log. Email summaries go to _MY_EMAIL when set and _INCIDENT_REPORT is not OFF.

backboa vs. multiback

Aspect backboa (legacy) multiback (current)
Providers AWS S3 only 9 providers / 11 keys
Config inline _AWS_* in .cnf /root/.remote_backups/ tree
Encryption symmetric _AWS_PWD PASSPHRASE from .secret.txt
Per-tenant variant none mybackup
Schedule static root crontab (03:15 / 05:15) /etc/cron.d interval cron (default 6-hourly)
License gate none _verify_boa_keys (pro/dev)

To migrate: stand up multiback (dcysetup install + setup), prove it for several days against at least one provider, then drop the legacy cron line (crontab -l | grep -v backboa | crontab -) while keeping the tool available to restore from the old daily-boa-<host> bucket.

Related