Clonezilla back up / restore by machine number
Boot menu: "Clonezilla: back up this PC" and "restore this PC" ask for the machine number and boot Clonezilla (64-bit with Debian shim, or 32-bit i686 by cpuid) with ocs_repository=smb3://clonezilla:<pw>@server/clonezilla/, ocs_prerun fetching clonezilla-scripts/pxe-cz.sh and ocs_live_run running it. The script validates the machine number, saves <machine>-<YYYY-MM-DD-HHMM> (server time), writes pxe-meta.txt, runs ocs-chkimg, and restores only that machine's images with -k1 -r after a typed YES. The old entry is "Clonezilla: manual". Playbook: clonezilla Samba user for the [clonezilla] share only, password from clonezilla_smb_password (validated, filled into the menu placeholder), scripts installed to the web root. Webapp: Clonezilla backups page lists image folders and zips grouped by machine number with serial/model/version/check, serial mismatch flag, delete, move to another machine, streamed tar download, disk space bar and an explicit keep-last-N retention with preview. Tests and a VM test plan added.
This commit is contained in:
cproudlock
@@ -180,6 +180,14 @@
|
||||
# suffix is not blancco_ksuffix.
|
||||
blancco_kver: "7.0.0-34-generic"
|
||||
blancco_ksuffix: "{{ blancco_kver.split('.')[0] }}{{ blancco_kver.split('.')[1] }}"
|
||||
# Samba account for the [clonezilla] share only (Clonezilla back up /
|
||||
# restore by machine number). The iPXE menu carries it in Clonezilla's
|
||||
# ocs_repository URI (smb3://clonezilla:<password>@server/clonezilla/),
|
||||
# so any imaging client can read it: it opens that one share and
|
||||
# nothing else. Set a site value in site-vars.yml. Allowed characters:
|
||||
# letters, digits . _ ~ - (it sits in a URI, a kernel command line and
|
||||
# a mount option list), 8 to 64 of them.
|
||||
clonezilla_smb_password: "clonezilla-backup"
|
||||
image_types:
|
||||
- gea-standard
|
||||
- gea-engineer
|
||||
@@ -250,6 +258,17 @@
|
||||
Fix playbook/site-vars.yml and re-run.
|
||||
quiet: yes
|
||||
|
||||
- name: "Clonezilla: check the clonezilla Samba password"
|
||||
assert:
|
||||
that:
|
||||
- clonezilla_smb_password is string
|
||||
- clonezilla_smb_password is match('^[A-Za-z0-9._~-]{8,64}$')
|
||||
fail_msg: >-
|
||||
clonezilla_smb_password must be 8-64 characters from A-Z a-z 0-9 . _ ~ -
|
||||
(it goes into Clonezilla's smb3:// URI on the kernel command line).
|
||||
Fix it in playbook/site-vars.yml and re-run.
|
||||
quiet: yes
|
||||
|
||||
# --- Re-run safety (nothing below changes the box until these pass) ---
|
||||
- name: "Re-run safety: is imaging in progress? (SMB sessions, recent DHCP leases)"
|
||||
args:
|
||||
@@ -754,13 +773,50 @@
|
||||
# (iPXE shim command) so it runs with Secure Boot on. The Blancco
|
||||
# Releases page edits this file (test entry), so keep exactly one
|
||||
# "item blancco" line and the :blancco_efi kernel+initrd block.
|
||||
# The Clonezilla back up / restore entries carry the clonezilla
|
||||
# Samba password: the tracked file has the placeholder
|
||||
# __CLONEZILLA_SMB_PASSWORD__, filled in here (content, so a re-run
|
||||
# with the same password changes nothing).
|
||||
copy:
|
||||
src: "{{ usb_mount }}/ipxe/GetPxeScript.aspx"
|
||||
content: "{{ lookup('file', usb_mount ~ '/ipxe/GetPxeScript.aspx', rstrip=False) | replace('__CLONEZILLA_SMB_PASSWORD__', clonezilla_smb_password) }}"
|
||||
dest: "{{ web_root }}/Altiris/iPXE/GetPxeScript.aspx"
|
||||
mode: '0644'
|
||||
backup: yes
|
||||
diff: false # the content carries clonezilla_smb_password
|
||||
when: "'STAGED-TEST' not in menu_test_entry.stdout"
|
||||
|
||||
- name: "Menu: NOT replaced, so check the live menu's Clonezilla password"
|
||||
# The Blancco test entry blocked the menu update above: a changed
|
||||
# clonezilla_smb_password would leave the live menu with the old one
|
||||
# (Clonezilla back up / restore then cannot mount the share).
|
||||
shell: |
|
||||
F="{{ web_root }}/Altiris/iPXE/GetPxeScript.aspx"
|
||||
grep -q 'ocs_repository=' "$F" || { echo "no Clonezilla repository entries in the live menu"; exit 0; }
|
||||
if grep -qF "smb3://clonezilla:${CZ_PW}@" "$F"; then echo "password matches"; else
|
||||
echo "WARNING: the live menu's Clonezilla entries do not carry clonezilla_smb_password;"
|
||||
echo "remove the Blancco test entry and re-run to update the menu."
|
||||
fi
|
||||
environment:
|
||||
CZ_PW: "{{ clonezilla_smb_password }}"
|
||||
register: menu_cz_pw
|
||||
changed_when: false
|
||||
no_log: true
|
||||
when: "'STAGED-TEST' in menu_test_entry.stdout"
|
||||
|
||||
- name: "Menu: Clonezilla password check result"
|
||||
debug:
|
||||
msg: "{{ menu_cz_pw.stdout }}"
|
||||
when: "'STAGED-TEST' in menu_test_entry.stdout"
|
||||
|
||||
- name: "Install the Clonezilla back up / restore scripts (fetched by Clonezilla live)"
|
||||
# GetPxeScript.aspx: ocs_prerun downloads
|
||||
# http://<server>/clonezilla-scripts/pxe-cz.sh, ocs_live_run runs it.
|
||||
copy:
|
||||
src: "{{ usb_mount }}/clonezilla-scripts/"
|
||||
dest: "{{ web_root }}/clonezilla-scripts/"
|
||||
mode: '0644'
|
||||
directory_mode: '0755'
|
||||
|
||||
# Boot files (80) and the iPXE menu (4433) are served on the imaging IP
|
||||
# only, never on the GE NIC. 9009 (webapp) stays on all addresses: admins
|
||||
# reach it from the GE side (see pxe-server.conf below).
|
||||
@@ -1118,7 +1174,9 @@
|
||||
browseable = yes
|
||||
read only = no
|
||||
guest ok = no
|
||||
valid users = pxe-upload
|
||||
# clonezilla: the menu's back up / restore entries (this share
|
||||
# only); pxe-upload: admins and manual Clonezilla runs.
|
||||
valid users = pxe-upload clonezilla
|
||||
force user = root
|
||||
comment = Clonezilla backup images
|
||||
|
||||
@@ -1171,6 +1229,20 @@
|
||||
executable: /bin/bash
|
||||
changed_when: false
|
||||
|
||||
- name: "Create the clonezilla Samba user ([clonezilla] share only)"
|
||||
# System user, no home, no login shell. Only [clonezilla] lists it in
|
||||
# valid users. smbpasswd runs every time so a changed
|
||||
# clonezilla_smb_password takes effect (the menu is updated with it).
|
||||
shell: |
|
||||
id clonezilla >/dev/null 2>&1 || useradd -r -M -d /nonexistent -s /usr/sbin/nologin clonezilla
|
||||
printf '%s\n%s\n' "$CZ_PW" "$CZ_PW" | smbpasswd -a -s clonezilla >/dev/null
|
||||
environment:
|
||||
CZ_PW: "{{ clonezilla_smb_password }}"
|
||||
args:
|
||||
executable: /bin/bash
|
||||
changed_when: false
|
||||
no_log: true
|
||||
|
||||
- name: "Deploy nf_conntrack TCP timeout sysctl for PXE workload"
|
||||
copy:
|
||||
src: "{{ usb_mount }}/pxe-server-helpers/99-pxe-conntrack.conf"
|
||||
|
||||
Reference in New Issue
Block a user