So, let’s try again from scratch ,step by step.
Main goal: ransomware protection and 6 months of restores configured like this:
latest 72 hourly backups
30 daily backups
24 weekly backups
in other words , i would like to restore any file up to 3 days ago, with an hourly resolution, up to 1 month with a daily resolution then 6 months with a weekly resolution (6*4 = 24 weekly backups
Step by step commands:
# kopia repo create s3 --bucket xxx --access-key=yyy --secret-access-key=zzz+WDc0ZdJce --retention-mode GOVERNANCE --retention-period 180d --endpoint="storage.googleapis.com" --encryption=CHACHA20-POLY1305-HMAC-SHA256
Enter password to create new repository:
Re-enter password for verification:
Initializing repository with:
block hash: BLAKE2B-256-128
encryption: CHACHA20-POLY1305-HMAC-SHA256
splitter: DYNAMIC-4M-BUZHASH
Connected to repository.
NOTICE: Kopia will check for updates on GitHub every 7 days, starting 24 hours after first use.
To disable this behavior, set environment variable KOPIA_CHECK_FOR_UPDATES=false
Alternatively you can remove the file "/root/.config/kopia/repository.config.update-info.json".
Retention:
Annual snapshots: 3 (defined for this target)
Monthly snapshots: 24 (defined for this target)
Weekly snapshots: 4 (defined for this target)
Daily snapshots: 7 (defined for this target)
Hourly snapshots: 48 (defined for this target)
Latest snapshots: 10 (defined for this target)
Ignore identical snapshots: false (defined for this target)
Compression disabled.
To find more information about default policy run 'kopia policy get'.
To change the policy use 'kopia policy set' command.
NOTE: Kopia will perform quick maintenance of the repository automatically every 1h0m0s
and full maintenance every 24h0m0s when running as root@x.
See https://kopia.io/docs/advanced/maintenance/ for more information.
NOTE: To validate that your provider is compatible with Kopia, please run:
$ kopia repository validate-provider
# kopia maintenance set --extend-object-locks true
Object Lock extension maintenance enabled.
# kopia policy set --global --compression=pgzip
Setting policy for (global)
- setting compression algorithm to pgzip
Running full maintenance...
Looking for active contents...
Looking for unreferenced contents...
GC found 0 unused contents (0 B)
GC found 0 unused contents that are too recent to delete (0 B)
GC found 0 in-use contents (0 B)
GC found 3 in-use system-contents (1.5 KB)
Rewriting contents from short packs...
Total bytes rewritten 0 B
Not enough time has passed since previous successful Snapshot GC. Will try again next time.
Skipping blob deletion because not enough time has passed yet (59m59s left).
Extending retention time for blobs...
Found 8 blobs to extend
Extended total 8 blobs
Cleaned up 0 logs.
Cleaning up old index blobs which have already been compacted...
Finished full maintenance.
# kopia snapshot create /
Snapshotting root@crm:/ ...
\ 2 hashing, 1171 hashed (7.6 MB), 0 cached (0 B), uploaded 196 B, estimating...
! Ignored error when processing "etc/ssh/oslogin_trustedca.pub": unknown or unsupported entry type
* 0 hashing, 181604 hashed (6.7 GB), 0 cached (0 B), uploaded 2.3 GB (1 errors ignored), estimated 6.7 GB (100.0%) 0s left
Created snapshot with root keb0ecfc7aebdc6c089ea26581d5c9789 and ID c6ae3e458c50d0dfa028bb4778cd1286 in 5m20s
WARN Ignored 1 error(s) while snapshotting root@x:/.
(there is a .kopiaignore file in /)
# kopia snapshot list
root@x:/
2024-01-05 18:40:51 CET keb0ecfc7aebdc6c089ea26581d5c9789 6.7 GB drwxr-xr-x files:176451 dirs:29070 (latest-1,hourly-1,daily-1,monthly-1,annual-1)
Up to this, looks good to me.
So, now
- which check should I do to see if ransomware protection is working as expected ?
- how can i configure Kopia for the retantion wrote above?
- as scheduling, a siimple hourly cron (the lower resolution i need) that call
kopia snapshot createis enough or should I add more commands ?
