Duplicati 部署教程：加密备份、远端存储与文件恢复

bash <<'BASH' || exit 1
set -euo pipefail
umask 077
parent="$HOME/services"
project="$parent/duplicati"
test -d "$HOME"
test ! -L "$HOME"
if [ -e "$parent" ] || [ -L "$parent" ]; then
  test -d "$parent"
  test ! -L "$parent"
  test -O "$parent"
else
  mkdir -m 700 "$parent"
fi
if [ -e "$project" ] || [ -L "$project" ]; then
  printf '%s\n' '部署目录已存在，停止初始化；保留原 .env、密钥和 config。' >&2
  exit 1
fi
mkdir -m 700 "$project"
cd -- "$project"
mkdir -m 700 config restore-test
id
settings_key="$(openssl rand -hex 32)"
web_password="$(openssl rand -hex 24)"
[[ "$settings_key" =~ ^[0-9a-f]{64}$ ]] || exit 1
[[ "$web_password" =~ ^[0-9a-f]{48}$ ]] || exit 1
(set -o noclobber; printf 'SETTINGS_ENCRYPTION_KEY=%s\nDUPLICATI__WEBSERVICE_PASSWORD=%s\n' "$settings_key" "$web_password" > .env)
BASH
cd -- "$HOME/services/duplicati" || exit 1

services:
  duplicati:
    image: lscr.io/linuxserver/duplicati:latest
    env_file:
      - .env
    environment:
      PUID: "1000"
      PGID: "1000"
      TZ: Asia/Shanghai
    ports:
      - "127.0.0.1:8200:8200"
    volumes:
      - ./config:/config
      - /srv/backup-source:/source:ro
      - ./restore-test:/restore-test
    restart: unless-stopped

docker compose config --quiet
docker compose up -d
docker compose logs --tail=80 duplicati

ssh -L 18200:127.0.0.1:8200 user@your-server

find restore-test -maxdepth 3 -type f
sha256sum restore-test/example.txt

set -eu
sql_file=restore-test/database.sql
test -f "$sql_file"
test ! -e restore-check.sqlite
sqlite3 restore-check.sqlite < "$sql_file"
sqlite3 restore-check.sqlite 'PRAGMA integrity_check;'

(
  set +e
  umask 077
  container_id=$(docker compose ps --all --quiet duplicati) || exit 1
  case "$container_id" in
    ''|*[!0-9a-f]*) printf '%s\n' '未找到唯一的 Duplicati 容器，停止操作。' >&2; exit 1 ;;
  esac
  [ "${#container_id}" -eq 64 ] || exit 1
  running=$(docker inspect --format '{{.State.Running}}' "$container_id") || exit 1
  [ "$running" = true ] || {
    printf '%s\n' '此片段只用于原本正在运行的实例；未启动已停止的实例。' >&2
    exit 1
  }

  mkdir -p local-config-backups || exit 1
  archive_dir=$(mktemp -d local-config-backups/duplicati-config.XXXXXX) || exit 1
  partial="$archive_dir/config.tar.gz.partial"
  archive="$archive_dir/config.tar.gz"
  restart_needed=0
  finish() {
    result=$?
    trap - 0 HUP INT TERM
    if [ "$restart_needed" -eq 1 ]; then
      restart_needed=0
      if docker start "$container_id" >/dev/null; then
        running=$(docker inspect --format '{{.State.Running}}' "$container_id") || running=unknown
        [ "$running" = true ] || result=1
      else
        result=1
      fi
    fi
    if [ "$result" -eq 0 ]; then
      printf '配置归档已通过读取校验，原容器已重新运行：%s\n' "$archive"
    else
      printf '操作未完成；检查原容器状态，保留本次目录供排查：%s\n' "$archive_dir" >&2
    fi
    exit "$result"
  }
  trap finish 0
  trap 'exit 129' HUP
  trap 'exit 130' INT
  trap 'exit 143' TERM

  restart_needed=1
  docker compose stop duplicati || exit 1
  running=$(docker inspect --format '{{.State.Running}}' "$container_id") || exit 1
  [ "$running" = false ] || exit 1
  tar -czf "$partial" config .env compose.yaml || exit 1
  gzip -t "$partial" || exit 1
  tar -tzf "$partial" >/dev/null || exit 1
  mv "$partial" "$archive" || exit 1
)