Skip to content

backup: fix borgmatic config for 2.x schema and inline credentials

jedmund requested to merge jedmund/backup-borgmatic-config-fixes into main

Created by: jedmund

Summary

First manual borgmatic invocation revealed three issues with the config schema. All fixed here.

What failed

`docker exec -it borgmatic borgmatic rcreate --encryption repokey-blake2` exited with:

``` /etc/borgmatic.d/config.yaml: Unknown hook name: env /etc/borgmatic.d/config.yaml: Error getting local Borg version /etc/borgmatic.d/config.yaml: Error running configuration ```

Plus deprecation warnings for `before_backup` and `after_actions`.

Fixes

  1. Inline secrets directly. The `{credential env VAR}` syntax I used for the passphrase, DB passwords, and the Healthchecks URL produced "Unknown hook name: env". Could be a version mismatch on the credential provider or a renamed syntax in borgmatic 2.x. Either way, the reliable fix is to template the secret values directly from Ansible vars into `borgmatic.yaml`. The file is private to the container anyway; deploy it with mode 0600 plus `no_log: true` on the Ansible task.

  2. Migrate to `commands:` syntax. Borgmatic 2.x deprecated `before_backup` and `after_actions` in favor of a single `commands:` list with explicit `before:` / `after:` markers and `when:` / `run:` subkeys: ```yaml commands:

    • before: action when: [create] run: [/scripts/dump-couchdb.sh, /scripts/dump-sqlite.sh]
    • after: action when: [create] run: [/scripts/post-backup-rsync.sh] ```

  3. Trim the env file. Now that DB passwords live in `borgmatic.yaml` directly, the env file only carries:

    • `BORG_PASSPHRASE` (Borg reads natively for repo operations)
    • `BACKUP_CRON`, `RUN_ON_STARTUP`, `TZ` (container scheduling)
    • `COUCHDB_USER`, `COUCHDB_PASSWORD` (consumed by `dump-couchdb.sh`)

Functional change vs prior config

None. Same dumps for the same DBs, same retention, same NAS rsync, same Healthchecks ping. Just schema-correct for borgmatic 2.x and without the credential-syntax indirection.

Commits

  1. `backup: fix borgmatic config for 2.x schema and remove credential syntax`

Test plan

  • `make deploy-backup` redeploys with the new config
  • `docker exec borgmatic cat /etc/borgmatic.d/config.yaml` (inside container, no host shell needed) shows fully-rendered values with no template leftovers
  • `docker exec -it borgmatic borgmatic rcreate --encryption repokey-blake2` succeeds (or reports already-initialized, also fine)
  • `docker exec borgmatic borgmatic --verbosity 1` completes one full run
  • Logs show successful DB dumps for every Postgres, MariaDB, MongoDB, plus the custom CouchDB and SQLite dump scripts
  • NAS share at `/mnt/nas/backup/borg-nuc-mini/` has the repo files
  • Healthchecks.io check turns green
  • If anything else surfaces, fix on this same branch (one PR per deploy iteration)

Merge request reports