Installing Restic Backup

#!/usr/bin/env bash
set -euo pipefail
umask 077

RESTIC_VERSION="0.17.3"
RESTIC_URL="https://github.com/restic/restic/releases/download/v${RESTIC_VERSION}/restic_${RESTIC_VERSION}_linux_amd64.bz2"

RESTIC_DIR="/etc/restic"
SYSTEMD_DIR="/etc/systemd/system"
BIN_DIR="/usr/local/bin"

# Default directories to back up.
BACKUP_PATHS="/etc /home /root"

require_root() {
  if [[ "${EUID}" -ne 0 ]]; then
    echo "Please run this script as root." >&2
    exit 1
  fi
}

install_packages() {
  if command -v apt-get >/dev/null 2>&1; then
    apt-get update
    apt-get install -y curl bzip2 jq
  elif command -v dnf >/dev/null 2>&1; then
    dnf install -y curl bzip2 jq
  elif command -v yum >/dev/null 2>&1; then
    yum install -y curl bzip2 jq
  else
    echo "No supported package manager found." >&2
    exit 1
  fi
}

prompt_required() {
  local prompt_text="$1"
  local var_name="$2"
  local hidden="${3:-false}"
  local value=""

  while :; do
    if [[ "${hidden}" == "true" ]]; then
      read -rsp "${prompt_text}" value
      echo
    else
      read -rp "${prompt_text}" value
    fi

    if [[ -n "${value}" ]]; then
      printf -v "${var_name}" '%s' "${value}"
      return 0
    fi

    echo "Value cannot be blank. Please try again." >&2
  done
}

get_auth_url() {
  local region=""

  while :; do
    read -rp "OpenStack Region (dfw, iad, sjc): " region
    region="$(printf '%s' "${region}" | tr '[:upper:]' '[:lower:]')"

    case "${region}" in
      dfw)
        OS_AUTH_URL="https://keystone.api.dfw3.rackspacecloud.com/v3"
        return 0
        ;;
      iad)
        OS_AUTH_URL="https://keystone.api.iad3.rackspacecloud.com/v3"
        return 0
        ;;
      sjc)
        OS_AUTH_URL="https://keystone.api.sjc3.rackspacecloud.com/v3"
        return 0
        ;;
      *)
        echo "Invalid region. Please enter dfw, iad, or sjc." >&2
        ;;
    esac
  done
}

get_instance_uuid() {
  local metadata uuid
  metadata="$(curl -fsS http://169.254.169.254/openstack/latest/meta_data.json)"
  uuid="$(jq -r '.uuid // empty' <<<"${metadata}")"

  if [[ -z "${uuid}" ]]; then
    echo "Could not determine instance UUID from the metadata service." >&2
    exit 1
  fi

  printf '%s' "${uuid}"
}

write_systemd_units() {
  cat > "${SYSTEMD_DIR}/restic-backup.service" <<EOF
[Unit]
Description=Run Restic Backup
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
EnvironmentFile=/etc/restic/restic.env

# Edit the directories below if you want a different backup set.
ExecStart=/usr/local/bin/restic backup ${BACKUP_PATHS} --verbose --exclude-file=/etc/restic/restic.exclude

Nice=19
IOSchedulingClass=idle
EOF

  cat > "${SYSTEMD_DIR}/restic-backup.timer" <<'EOF'
[Unit]
Description=Run Restic backup every 12 hours

[Timer]
OnBootSec=15min
OnUnitActiveSec=12h
Unit=restic-backup.service

[Install]
WantedBy=multi-user.target
EOF
}

write_restic_files() {
  local app_cred_id="$1"
  local app_cred_secret="$2"
  local restic_password="$3"
  local instance_uuid="$4"

  cat > "${RESTIC_DIR}/restic.env" <<EOF
OS_AUTH_URL="${OS_AUTH_URL}"
OS_APPLICATION_CREDENTIAL_ID="${app_cred_id}"
OS_APPLICATION_CREDENTIAL_SECRET="${app_cred_secret}"
RESTIC_PASSWORD="${restic_password}"
RESTIC_REPOSITORY="swift:restic:/${instance_uuid}"
EOF

  cat > "${RESTIC_DIR}/restic.exclude" <<'EOF'
# Add one exclusion per line.
# Example entries:
# *.log
# /tmp
# /var/tmp
EOF

  chmod 600 "${RESTIC_DIR}/restic.env" "${RESTIC_DIR}/restic.exclude"
}

install_restic_binary() {
  curl -fsSL "${RESTIC_URL}" -o /tmp/restic.bz2
  bzip2 -d -f /tmp/restic.bz2
  mv -f /tmp/restic "${BIN_DIR}/restic"
  chmod 0755 "${BIN_DIR}/restic"

  if command -v getenforce >/dev/null 2>&1 && command -v chcon >/dev/null 2>&1; then
    if [[ "$(getenforce)" != "Disabled" ]]; then
      chcon -t bin_t "${BIN_DIR}/restic" || true
    fi
  fi
}

initialize_repository_if_needed() {
  set -a
  # shellcheck disable=SC1090
  source "${RESTIC_DIR}/restic.env"
  set +a

  if ! /usr/local/bin/restic -r "${RESTIC_REPOSITORY}" cat config >/dev/null 2>&1; then
    /usr/local/bin/restic -r "${RESTIC_REPOSITORY}" init
  fi
}

main() {
  require_root
  install_packages

  mkdir -p "${RESTIC_DIR}" "${SYSTEMD_DIR}" "${BIN_DIR}"

  get_auth_url
  prompt_required "OpenStack Application Credential ID: " APP_CRED_ID false
  prompt_required "OpenStack Application Credential Secret: " APP_CRED_SECRET true
  prompt_required "Restic Repository Password: " RESTIC_PASSWORD true

  INSTANCE_UUID="$(get_instance_uuid)"

  write_systemd_units
  write_restic_files "${APP_CRED_ID}" "${APP_CRED_SECRET}" "${RESTIC_PASSWORD}" "${INSTANCE_UUID}"
  install_restic_binary

  systemctl daemon-reload
  initialize_repository_if_needed
  systemctl enable --now restic-backup.timer
  systemctl start restic-backup.service

  echo "Restic backup setup complete."
}

main "$@"