Install zfs-autobackup

Install zfs-autobackup on the source machine:

# pkg install py311-zfs-autobackup

Configure dataset properties

zfs-autobackup uses ZFS properties to identify which datasets should be snapshotted and replicated.

Enable backups on the source dataset:

# zfs set autobackup:backup_tag=true zroot/important-data

Verify property:

# zfs get autobackup:backup zroot/important-data

Expected output:

NAME                  PROPERTY                VALUE  SOURCE
zroot/important-data  autobackup:backup_tag   true   local

The replication command will only process datasets with the autobackup:backup_tag=true property.

Delegate permissions

Allow user backup to receive snapshots on the target machine:

# zfs allow backup \
    canmount,compression,create,dedup,destroy,encryption,hold,keyformat,keylocation,mount,mountpoint,readonly,receive,release,rollback,userprop \
    backup/important-data

Verify permissions:

# zfs allow backup/important-data

Example output:

---- Permissions on backup/important-data ---------------------------------
Local+Descendent permissions:
        user backup canmount,compression,create,dedup,destroy,encryption,hold,keyformat,keylocation,mount,mountpoint,readonly,receive,release,rollback,userprop

Explanation of each permission:

Run first backup

Run replication manually:

# zfs-autobackup \
    --allow-empty \
    --clear-mountpoint \
    --encrypt \
    --ssh-target backup@192.168.1.10 \
    backup_tag \
    backup/important-data

Options:

• --allow-empty allows replication even if there are no changes
• --clear-mountpoint avoids mountpoint conflicts
• --encrypt sends raw encrypted ZFS streams
• --ssh-target defines remote backup server

Automate backups using cron

Add cron entry on /etc/cron.d/zfs-autobackup:

*/30 * * * * root flock -n /var/backups.lock zfs-autobackup --allow-empty --clear-mountpoint --encrypt --ssh-target backup@192.168.1.10 backup_tag backup/important_data

flock prevents multiple backup jobs from running simultaneously.

Verify snapshots

List snapshots:

# zfs list -t snapshot | grep backup_tag

Notes about encrypted replication

--encrypt is used when you want plain (unencrypted) source datasets to be stored encrypted on the target side. Without --encrypt, plain datasets remain plain after replication, even if the target parent dataset is encrypted. --encrypt makes the receive side inherit encryption settings from the target parent dataset. The target encryption must already be configured and its keys loaded.

Source:
https://it-notes.dragas.net/2024/08/21/automating-zfs-snapshots-for-peace-of-mind/
https://github.com/psy0rz/zfs_autobackup

get in touch

• Email

  hi@adrianobarbosa.xyz