]>
Commit | Line | Data |
---|---|---|
271fe394 DM |
1 | package PVE::Storage::PBSPlugin; |
2 | ||
3 | # Plugin to access Proxmox Backup Server | |
4 | ||
5 | use strict; | |
6 | use warnings; | |
76bb5feb | 7 | use Fcntl qw(F_GETFD F_SETFD FD_CLOEXEC); |
271fe394 | 8 | use HTTP::Request; |
76bb5feb | 9 | use IO::File; |
271fe394 | 10 | use JSON; |
76bb5feb WB |
11 | use LWP::UserAgent; |
12 | use POSIX qw(strftime ENOENT); | |
271fe394 DM |
13 | |
14 | use PVE::Tools qw(run_command file_read_firstline trim dir_glob_regex dir_glob_foreach); | |
15 | use PVE::Storage::Plugin; | |
16 | use PVE::JSONSchema qw(get_standard_option); | |
17 | ||
18 | use base qw(PVE::Storage::Plugin); | |
19 | ||
20 | # Configuration | |
21 | ||
22 | sub type { | |
23 | return 'pbs'; | |
24 | } | |
25 | ||
26 | sub plugindata { | |
27 | return { | |
28 | content => [ {backup => 1, none => 1}, { backup => 1 }], | |
29 | }; | |
30 | } | |
31 | ||
32 | sub properties { | |
33 | return { | |
34 | datastore => { | |
35 | description => "Proxmox backup server datastore name.", | |
36 | type => 'string', | |
37 | }, | |
38 | # openssl s_client -connect <host>:8007 2>&1 |openssl x509 -fingerprint -sha256 | |
39 | fingerprint => get_standard_option('fingerprint-sha256'), | |
ce2e2733 | 40 | 'encryption-key' => { |
1aeb322b | 41 | description => "Encryption key. Use 'autogen' to generate one automatically without passphrase.", |
76bb5feb WB |
42 | type => 'string', |
43 | }, | |
271fe394 DM |
44 | }; |
45 | } | |
46 | ||
47 | sub options { | |
48 | return { | |
49 | server => { fixed => 1 }, | |
50 | datastore => { fixed => 1 }, | |
51 | nodes => { optional => 1}, | |
52 | disable => { optional => 1}, | |
53 | content => { optional => 1}, | |
54 | username => { optional => 1 }, | |
ce2e2733 TL |
55 | password => { optional => 1 }, |
56 | 'encryption-key' => { optional => 1 }, | |
271fe394 DM |
57 | maxfiles => { optional => 1 }, |
58 | fingerprint => { optional => 1 }, | |
59 | }; | |
60 | } | |
61 | ||
62 | # Helpers | |
63 | ||
64 | sub pbs_password_file_name { | |
65 | my ($scfg, $storeid) = @_; | |
66 | ||
462537a2 | 67 | return "/etc/pve/priv/storage/${storeid}.pw"; |
271fe394 DM |
68 | } |
69 | ||
70 | sub pbs_set_password { | |
71 | my ($scfg, $storeid, $password) = @_; | |
72 | ||
73 | my $pwfile = pbs_password_file_name($scfg, $storeid); | |
9e34813f | 74 | mkdir "/etc/pve/priv/storage"; |
271fe394 DM |
75 | |
76 | PVE::Tools::file_set_contents($pwfile, "$password\n"); | |
77 | } | |
78 | ||
79 | sub pbs_delete_password { | |
80 | my ($scfg, $storeid) = @_; | |
81 | ||
82 | my $pwfile = pbs_password_file_name($scfg, $storeid); | |
83 | ||
84 | unlink $pwfile; | |
85 | } | |
86 | ||
87 | sub pbs_get_password { | |
88 | my ($scfg, $storeid) = @_; | |
89 | ||
90 | my $pwfile = pbs_password_file_name($scfg, $storeid); | |
91 | ||
92 | return PVE::Tools::file_read_firstline($pwfile); | |
93 | } | |
94 | ||
76bb5feb WB |
95 | sub pbs_encryption_key_file_name { |
96 | my ($scfg, $storeid) = @_; | |
97 | ||
98 | return "/etc/pve/priv/storage/${storeid}.enc"; | |
99 | } | |
100 | ||
101 | sub pbs_set_encryption_key { | |
102 | my ($scfg, $storeid, $key) = @_; | |
103 | ||
104 | my $pwfile = pbs_encryption_key_file_name($scfg, $storeid); | |
105 | mkdir "/etc/pve/priv/storage"; | |
106 | ||
107 | PVE::Tools::file_set_contents($pwfile, "$key\n"); | |
108 | } | |
109 | ||
110 | sub pbs_delete_encryption_key { | |
111 | my ($scfg, $storeid) = @_; | |
112 | ||
113 | my $pwfile = pbs_encryption_key_file_name($scfg, $storeid); | |
114 | ||
115 | unlink $pwfile; | |
116 | } | |
117 | ||
118 | sub pbs_get_encryption_key { | |
119 | my ($scfg, $storeid) = @_; | |
120 | ||
121 | my $pwfile = pbs_encryption_key_file_name($scfg, $storeid); | |
122 | ||
123 | return PVE::Tools::file_get_contents($pwfile); | |
124 | } | |
125 | ||
126 | # Returns a file handle if there is an encryption key, or `undef` if there is not. Dies on error. | |
127 | sub pbs_open_encryption_key { | |
128 | my ($scfg, $storeid) = @_; | |
129 | ||
130 | my $encryption_key_file = pbs_encryption_key_file_name($scfg, $storeid); | |
131 | ||
132 | my $keyfd; | |
133 | if (!open($keyfd, '<', $encryption_key_file)) { | |
134 | return undef if $! == ENOENT; | |
135 | die "failed to open encryption key: $encryption_key_file: $!\n"; | |
136 | } | |
137 | ||
138 | return $keyfd; | |
139 | } | |
140 | ||
8602fd56 FE |
141 | sub print_volid { |
142 | my ($storeid, $btype, $bid, $btime) = @_; | |
143 | ||
144 | my $time_str = strftime("%FT%TZ", gmtime($btime)); | |
145 | my $volname = "backup/${btype}/${bid}/${time_str}"; | |
146 | ||
147 | return "${storeid}:${volname}"; | |
148 | } | |
271fe394 | 149 | |
76bb5feb WB |
150 | my sub do_raw_client_cmd { |
151 | my ($scfg, $storeid, $client_cmd, $param, $can_encrypt, %opts) = @_; | |
271fe394 | 152 | |
1574a590 TL |
153 | my $client_exe = '/usr/bin/proxmox-backup-client'; |
154 | die "executable not found '$client_exe'! Proxmox backup client not installed?\n" | |
155 | if ! -x $client_exe; | |
156 | ||
271fe394 DM |
157 | my $server = $scfg->{server}; |
158 | my $datastore = $scfg->{datastore}; | |
159 | my $username = $scfg->{username} // 'root@pam'; | |
160 | ||
161 | my $userns_cmd = delete $opts{userns_cmd}; | |
162 | ||
163 | my $cmd = []; | |
164 | ||
165 | push @$cmd, @$userns_cmd if defined($userns_cmd); | |
166 | ||
1574a590 | 167 | push @$cmd, $client_exe, $client_cmd; |
271fe394 | 168 | |
76bb5feb WB |
169 | # This must live in the top scope to not get closed before the `run_command` |
170 | my $keyfd; | |
171 | if ($can_encrypt) { | |
172 | if (defined($keyfd = pbs_open_encryption_key($scfg, $storeid))) { | |
173 | my $flags = fcntl($keyfd, F_GETFD, 0) | |
174 | // die "failed to get file descriptor flags: $!\n"; | |
175 | fcntl($keyfd, F_SETFD, $flags & ~FD_CLOEXEC) | |
176 | or die "failed to remove FD_CLOEXEC from encryption key file descriptor\n"; | |
177 | push @$cmd, '--crypt-mode=encrypt', '--keyfd='.fileno($keyfd); | |
178 | } else { | |
179 | push @$cmd, '--crypt-mode=none'; | |
180 | } | |
181 | } | |
182 | ||
271fe394 DM |
183 | push @$cmd, @$param if defined($param); |
184 | ||
185 | push @$cmd, "--repository", "$username\@$server:$datastore"; | |
186 | ||
187 | local $ENV{PBS_PASSWORD} = pbs_get_password($scfg, $storeid); | |
188 | ||
189 | local $ENV{PBS_FINGERPRINT} = $scfg->{fingerprint}; | |
190 | ||
8b4c2a7e DM |
191 | # no ascii-art on task logs |
192 | local $ENV{PROXMOX_OUTPUT_NO_BORDER} = 1; | |
193 | local $ENV{PROXMOX_OUTPUT_NO_HEADER} = 1; | |
194 | ||
271fe394 | 195 | if (my $logfunc = $opts{logfunc}) { |
e6d1edcb | 196 | $logfunc->("run: " . join(' ', @$cmd)); |
271fe394 DM |
197 | } |
198 | ||
199 | run_command($cmd, %opts); | |
200 | } | |
201 | ||
76bb5feb WB |
202 | # FIXME: External perl code should NOT have access to this. |
203 | # | |
204 | # There should be separate functions to | |
205 | # - make backups | |
206 | # - restore backups | |
207 | # - restore files | |
208 | # with a sane API | |
209 | sub run_raw_client_cmd{ | |
210 | my ($scfg, $storeid, $client_cmd, $param, %opts) = @_; | |
211 | return do_raw_client_cmd($scfg, $storeid, $client_cmd, $param, 1, %opts); | |
212 | } | |
213 | ||
271fe394 DM |
214 | sub run_client_cmd { |
215 | my ($scfg, $storeid, $client_cmd, $param, $no_output) = @_; | |
216 | ||
217 | my $json_str = ''; | |
fee2ece3 | 218 | my $outfunc = sub { $json_str .= "$_[0]\n" }; |
271fe394 DM |
219 | |
220 | $param = [] if !defined($param); | |
221 | $param = [ $param ] if !ref($param); | |
222 | ||
223 | $param = [@$param, '--output-format=json'] if !$no_output; | |
224 | ||
76bb5feb WB |
225 | do_raw_client_cmd($scfg, $storeid, $client_cmd, $param, 0, |
226 | outfunc => $outfunc, errmsg => 'proxmox-backup-client failed'); | |
271fe394 DM |
227 | |
228 | return undef if $no_output; | |
229 | ||
230 | my $res = decode_json($json_str); | |
231 | ||
232 | return $res; | |
233 | } | |
234 | ||
235 | # Storage implementation | |
236 | ||
c855ac15 DM |
237 | sub extract_vzdump_config { |
238 | my ($class, $scfg, $volname, $storeid) = @_; | |
239 | ||
240 | my ($vtype, $name, $vmid, undef, undef, undef, $format) = $class->parse_volname($volname); | |
241 | ||
242 | my $config = ''; | |
fee2ece3 | 243 | my $outfunc = sub { $config .= "$_[0]\n" }; |
c855ac15 DM |
244 | |
245 | my $config_name; | |
246 | if ($format eq 'pbs-vm') { | |
247 | $config_name = 'qemu-server.conf'; | |
248 | } elsif ($format eq 'pbs-ct') { | |
249 | $config_name = 'pct.conf'; | |
250 | } else { | |
251 | die "unable to extract configuration for backup format '$format'\n"; | |
252 | } | |
253 | ||
76bb5feb WB |
254 | do_raw_client_cmd($scfg, $storeid, 'restore', [ $name, $config_name, '-' ], 0, |
255 | outfunc => $outfunc, errmsg => 'proxmox-backup-client failed'); | |
c855ac15 DM |
256 | |
257 | return $config; | |
258 | } | |
259 | ||
1aeb322b TL |
260 | my $autogen_encryption_key = sub { |
261 | my ($scfg, $storeid) = @_; | |
262 | my $encfile = pbs_encryption_key_file_name($scfg, $storeid); | |
263 | run_command(['proxmox-backup-client', 'key', 'create', '--kdf', 'none', $encfile]); | |
264 | }; | |
265 | ||
271fe394 DM |
266 | sub on_add_hook { |
267 | my ($class, $storeid, $scfg, %param) = @_; | |
268 | ||
76bb5feb WB |
269 | if (defined(my $password = $param{password})) { |
270 | pbs_set_password($scfg, $storeid, $password); | |
b494636a DM |
271 | } else { |
272 | pbs_delete_password($scfg, $storeid); | |
273 | } | |
76bb5feb | 274 | |
ce2e2733 | 275 | if (defined(my $encryption_key = $param{'encryption-key'})) { |
1aeb322b TL |
276 | if ($encryption_key eq 'autogen') { |
277 | $autogen_encryption_key->($scfg, $storeid); | |
278 | } else { | |
279 | pbs_set_encryption_key($scfg, $storeid, $encryption_key); | |
280 | } | |
76bb5feb WB |
281 | } else { |
282 | pbs_delete_encryption_key($scfg, $storeid); | |
283 | } | |
b494636a DM |
284 | } |
285 | ||
286 | sub on_update_hook { | |
287 | my ($class, $storeid, $scfg, %param) = @_; | |
288 | ||
76bb5feb WB |
289 | if (exists($param{password})) { |
290 | if (defined($param{password})) { | |
291 | pbs_set_password($scfg, $storeid, $param{password}); | |
292 | } else { | |
293 | pbs_delete_password($scfg, $storeid); | |
294 | } | |
295 | } | |
b494636a | 296 | |
ce2e2733 TL |
297 | if (exists($param{'encryption-key'})) { |
298 | if (defined(my $encryption_key = delete($param{'encryption-key'}))) { | |
1aeb322b TL |
299 | if ($encryption_key eq 'autogen') { |
300 | $autogen_encryption_key->($scfg, $storeid); | |
301 | } else { | |
302 | pbs_set_encryption_key($scfg, $storeid, $encryption_key); | |
303 | } | |
76bb5feb WB |
304 | } else { |
305 | pbs_delete_encryption_key($scfg, $storeid); | |
306 | } | |
271fe394 DM |
307 | } |
308 | } | |
309 | ||
310 | sub on_delete_hook { | |
311 | my ($class, $storeid, $scfg) = @_; | |
312 | ||
313 | pbs_delete_password($scfg, $storeid); | |
76bb5feb | 314 | pbs_delete_encryption_key($scfg, $storeid); |
271fe394 DM |
315 | } |
316 | ||
317 | sub parse_volname { | |
318 | my ($class, $volname) = @_; | |
319 | ||
320 | if ($volname =~ m!^backup/([^\s_]+)/([^\s_]+)/([0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z)$!) { | |
321 | my $btype = $1; | |
322 | my $bid = $2; | |
323 | my $btime = $3; | |
324 | my $format = "pbs-$btype"; | |
325 | ||
326 | my $name = "$btype/$bid/$btime"; | |
327 | ||
328 | if ($bid =~ m/^\d+$/) { | |
329 | return ('backup', $name, $bid, undef, undef, undef, $format); | |
330 | } else { | |
331 | return ('backup', $name, undef, undef, undef, undef, $format); | |
332 | } | |
333 | } | |
334 | ||
335 | die "unable to parse PBS volume name '$volname'\n"; | |
336 | } | |
337 | ||
338 | sub path { | |
339 | my ($class, $scfg, $volname, $storeid, $snapname) = @_; | |
340 | ||
341 | die "volume snapshot is not possible on pbs storage" | |
342 | if defined($snapname); | |
343 | ||
344 | my ($vtype, $name, $vmid) = $class->parse_volname($volname); | |
345 | ||
346 | my $server = $scfg->{server}; | |
347 | my $datastore = $scfg->{datastore}; | |
348 | my $username = $scfg->{username} // 'root@pam'; | |
349 | ||
350 | # artifical url - we currently do not use that anywhere | |
351 | my $path = "pbs://$username\@$server:$datastore/$name"; | |
352 | ||
353 | return ($path, $vmid, $vtype); | |
354 | } | |
355 | ||
356 | sub create_base { | |
357 | my ($class, $storeid, $scfg, $volname) = @_; | |
358 | ||
359 | die "can't create base images in pbs storage\n"; | |
360 | } | |
361 | ||
362 | sub clone_image { | |
363 | my ($class, $scfg, $storeid, $volname, $vmid, $snap) = @_; | |
364 | ||
365 | die "can't clone images in pbs storage\n"; | |
366 | } | |
367 | ||
368 | sub alloc_image { | |
369 | my ($class, $storeid, $scfg, $vmid, $fmt, $name, $size) = @_; | |
370 | ||
371 | die "can't allocate space in pbs storage\n"; | |
372 | } | |
373 | ||
374 | sub free_image { | |
375 | my ($class, $storeid, $scfg, $volname, $isBase) = @_; | |
376 | ||
377 | my ($vtype, $name, $vmid) = $class->parse_volname($volname); | |
378 | ||
379 | run_client_cmd($scfg, $storeid, "forget", [ $name ], 1); | |
380 | } | |
381 | ||
382 | ||
383 | sub list_images { | |
384 | my ($class, $storeid, $scfg, $vmid, $vollist, $cache) = @_; | |
385 | ||
386 | my $res = []; | |
387 | ||
388 | return $res; | |
389 | } | |
390 | ||
391 | sub list_volumes { | |
392 | my ($class, $storeid, $scfg, $vmid, $content_types) = @_; | |
393 | ||
394 | my $res = []; | |
395 | ||
396 | return $res if !grep { $_ eq 'backup' } @$content_types; | |
397 | ||
398 | my $data = run_client_cmd($scfg, $storeid, "snapshots"); | |
399 | ||
400 | foreach my $item (@$data) { | |
401 | my $btype = $item->{"backup-type"}; | |
402 | my $bid = $item->{"backup-id"}; | |
545e127e | 403 | my $epoch = $item->{"backup-time"}; |
271fe394 DM |
404 | my $size = $item->{size} // 1; |
405 | ||
406 | next if !($btype eq 'vm' || $btype eq 'ct'); | |
407 | next if $bid !~ m/^\d+$/; | |
ddf7fdaa | 408 | next if defined($vmid) && $bid ne $vmid; |
271fe394 | 409 | |
8602fd56 | 410 | my $volid = print_volid($storeid, $btype, $bid, $epoch); |
271fe394 | 411 | |
545e127e | 412 | my $info = { |
c05b1a8c TL |
413 | volid => $volid, |
414 | format => "pbs-$btype", | |
415 | size => $size, | |
416 | content => 'backup', | |
417 | vmid => int($bid), | |
418 | ctime => $epoch, | |
545e127e | 419 | }; |
271fe394 DM |
420 | |
421 | push @$res, $info; | |
422 | } | |
423 | ||
424 | return $res; | |
425 | } | |
426 | ||
427 | sub status { | |
428 | my ($class, $storeid, $scfg, $cache) = @_; | |
429 | ||
430 | my $total = 0; | |
431 | my $free = 0; | |
432 | my $used = 0; | |
433 | my $active = 0; | |
434 | ||
435 | eval { | |
436 | my $res = run_client_cmd($scfg, $storeid, "status"); | |
437 | ||
438 | $active = 1; | |
439 | $total = $res->{total}; | |
440 | $used = $res->{used}; | |
f155c912 TL |
441 | $free = $res->{avail}; |
442 | }; | |
271fe394 DM |
443 | if (my $err = $@) { |
444 | warn $err; | |
445 | } | |
446 | ||
447 | return ($total, $free, $used, $active); | |
448 | } | |
449 | ||
450 | sub activate_storage { | |
451 | my ($class, $storeid, $scfg, $cache) = @_; | |
bb0a0f96 TL |
452 | |
453 | run_client_cmd($scfg, $storeid, "status"); | |
454 | ||
271fe394 DM |
455 | return 1; |
456 | } | |
457 | ||
458 | sub deactivate_storage { | |
459 | my ($class, $storeid, $scfg, $cache) = @_; | |
460 | return 1; | |
461 | } | |
462 | ||
463 | sub activate_volume { | |
464 | my ($class, $storeid, $scfg, $volname, $snapname, $cache) = @_; | |
465 | ||
466 | die "volume snapshot is not possible on pbs device" if $snapname; | |
467 | ||
468 | return 1; | |
469 | } | |
470 | ||
471 | sub deactivate_volume { | |
472 | my ($class, $storeid, $scfg, $volname, $snapname, $cache) = @_; | |
473 | ||
474 | die "volume snapshot is not possible on pbs device" if $snapname; | |
475 | ||
476 | return 1; | |
477 | } | |
478 | ||
479 | sub volume_size_info { | |
480 | my ($class, $scfg, $storeid, $volname, $timeout) = @_; | |
481 | ||
482 | my ($vtype, $name, undef, undef, undef, undef, $format) = $class->parse_volname($volname); | |
483 | ||
484 | my $data = run_client_cmd($scfg, $storeid, "files", [ $name ]); | |
485 | ||
486 | my $size = 0; | |
487 | foreach my $info (@$data) { | |
488 | $size += $info->{size} if $info->{size}; | |
489 | } | |
490 | ||
491 | my $used = $size; | |
492 | ||
493 | return wantarray ? ($size, $format, $used, undef) : $size; | |
494 | } | |
495 | ||
496 | sub volume_resize { | |
497 | my ($class, $scfg, $storeid, $volname, $size, $running) = @_; | |
498 | die "volume resize is not possible on pbs device"; | |
499 | } | |
500 | ||
501 | sub volume_snapshot { | |
502 | my ($class, $scfg, $storeid, $volname, $snap) = @_; | |
503 | die "volume snapshot is not possible on pbs device"; | |
504 | } | |
505 | ||
506 | sub volume_snapshot_rollback { | |
507 | my ($class, $scfg, $storeid, $volname, $snap) = @_; | |
508 | die "volume snapshot rollback is not possible on pbs device"; | |
509 | } | |
510 | ||
511 | sub volume_snapshot_delete { | |
512 | my ($class, $scfg, $storeid, $volname, $snap) = @_; | |
513 | die "volume snapshot delete is not possible on pbs device"; | |
514 | } | |
515 | ||
516 | sub volume_has_feature { | |
517 | my ($class, $scfg, $feature, $storeid, $volname, $snapname, $running) = @_; | |
518 | ||
519 | return undef; | |
520 | } | |
521 | ||
522 | 1; |