Update docs/configuring-playbook-backup-borg.md (#3943)

* Update docs/configuring-playbook-backup-borg.md: add the section "Extending the configuration"

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

* Update docs/configuring-playbook-backup-borg.md

- Move the instruction about setting up the server to the section "Prerequisites"
- Replace instructions with a listing with a common format
- Adopt the common descripton for setting a strong password
- Create sections for optional configurations

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

* Update docs/configuring-playbook-backup-borg.md: add descriptions about other useful options

This commit adds descriptions about options for setting the archive name and the retention policy.

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

* Update docs/configuring-playbook-backup-borg.md: remove the instruction about creating a backup without encryption

It is generally not recommended to store unencrypted backups on computers which you do not own, so this commit removes it from the guide.

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

---------

Signed-off-by: Suguru Hirahara <acioustick@noreply.codeberg.org>
Co-authored-by: Suguru Hirahara <acioustick@noreply.codeberg.org>

docs/configuring-playbook-backup-borg.md

@@ -4,45 +4,65 @@ The playbook can install and configure [BorgBackup](https://www.borgbackup.org/)
 
 BorgBackup is a deduplicating backup program with optional compression and encryption. That means your daily incremental backups can be stored in a fraction of the space and is safe whether you store it at home or on a cloud service.
 
+## Prerequisites
+
+### Set up a remote server for storing backups
+
 You will need a remote server where BorgBackup will store the backups. There are hosted, BorgBackup compatible solutions available, such as [BorgBase](https://www.borgbase.com).
 
-The backup will run based on `backup_borg_schedule` var (systemd timer calendar), default: 4am every day.
+### Check the Postgres version
 
-By default, if you're using the integrated Postgres database server (as opposed to [an external Postgres server](configuring-playbook-external-postgres.md)), backups with BorgBackup will also include dumps of your Postgres database. An alternative solution for backing up the Postgres database is [postgres backup](configuring-playbook-postgres-backup.md). If you decide to go with another solution, you can disable Postgres-backup support for BorgBackup using the `backup_borg_postgresql_enabled` variable.
+By default, if you're using the integrated Postgres database server (as opposed to [an external Postgres server](configuring-playbook-external-postgres.md)), backups with BorgBackup will also include dumps of your Postgres database.
 
-## Prerequisites
+Unless you disable the Postgres-backup support, make sure that the Postgres version of your homeserver's database is compatible with borgmatic. You can check the compatible versions [here](https://github.com/mother-of-all-self-hosting/ansible-role-backup_borg/blob/main/defaults/main.yml).
+
+An alternative solution for backing up the Postgres database is [postgres backup](configuring-playbook-postgres-backup.md). If you decide to go with another solution, you can disable Postgres-backup support for BorgBackup using the `backup_borg_postgresql_enabled` variable.
 
-1. If you do not disable Postgres-backup support, make sure that the Postgres version of your homeserver's database is compatible with borgmatic.
+### Create a new SSH key
+
+Run the command below on any machine to create a new SSH key:
+
+```sh
+ssh-keygen -t ed25519 -N '' -f matrix-borg-backup -C matrix
+```
 
-2. Create a new SSH key:
+You don't need to place the key in the `.ssh` folder.
 
-    ```sh
-    ssh-keygen -t ed25519 -N '' -f matrix-borg-backup -C matrix
-    ```
+### Add the public key
 
-    This can be done on any machine and you don't need to place the key in the `.ssh` folder. It will be added to the Ansible config later.
+Next, add the **public** part of this SSH key (the `matrix-borg-backup.pub` file) to your BorgBackup provider/server.
 
-3. Add the **public** part of this SSH key (the `matrix-borg-backup.pub` file) to your BorgBackup provider/server:
+If you are using a hosted solution, follow their instructions. If you have your own server, copy the key to it with the command like below:
 
-    If you plan to use a hosted solution, follow their instructions. If you have your own server, copy the key over:
+```sh
+# Example to append the new PUBKEY contents, where:
+# - PUBKEY is path to the public key
+# - USER is a ssh user on a provider / server
+# - HOST is a ssh host of a provider / server
+cat PUBKEY | ssh USER@HOST 'dd of=.ssh/authorized_keys oflag=append conv=notrunc'
+```
 
-    ```sh
-    # example to append the new PUBKEY contents, where:
-    # PUBKEY is path to the public key,
-    # USER is a ssh user on a provider / server
-    # HOST is a ssh host of a provider / server
-    cat PUBKEY | ssh USER@HOST 'dd of=.ssh/authorized_keys oflag=append conv=notrunc'
-    ```
+The **private** key needs to be added to `backup_borg_ssh_key_private` on your `inventory/host_vars/matrix.example.com/vars.yml` file as below.
 
 ## Adjusting the playbook configuration
 
-Minimal working configuration (`inventory/host_vars/matrix.example.com/vars.yml`) to enable BorgBackup:
+To enable BorgBackup, add the following configuration to your `vars.yml` file (adapt to your needs):
 
 ```yaml
 backup_borg_enabled: true
+
+# Set the repository location, where:
+# - USER is a ssh user on a provider / server
+# - HOST is a ssh host of a provider / server
+# - REPO is a BorgBackup repository name
 backup_borg_location_repositories:
  - ssh://USER@HOST/./REPO
+
+# Generate a strong password used for encrypting backups. You can create one with a command like `pwgen -s 64 1`.
 backup_borg_storage_encryption_passphrase: "PASSPHRASE"
+
+# Add the content of the **private** part of the SSH key you have created.
+# Note: the whole key (all of its belonging lines) under the variable needs to be indented with 2 spaces.
 backup_borg_ssh_key_private: |
   -----BEGIN OPENSSH PRIVATE KEY-----
   TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2NpbmcgZW
@@ -53,19 +73,53 @@ backup_borg_ssh_key_private: |
   -----END OPENSSH PRIVATE KEY-----
 ```
 
-where:
+**Note**: `REPO` will be initialized on backup start, for example: `matrix`. See [Remote repositories](https://borgbackup.readthedocs.io/en/stable/usage/general.html#repository-urls) for the syntax.
+
+### Set backup archive name (optional)
+
+You can specify the backup archive name format. To set it, add the following configuration to your `vars.yml` file (adapt to your needs):
+
+```yaml
+backup_borg_storage_archive_name_format: matrix-{now:%Y-%m-%d-%H%M%S}
+```
+
+### Configure retention policy (optional)
+
+It is also possible to configure a retention strategy. To configure it, add the following configuration to your `vars.yml` file (adapt to your needs):
+
+```yaml
+backup_borg_retention_keep_hourly: 0
+backup_borg_retention_keep_daily: 7
+backup_borg_retention_keep_weekly: 4
+backup_borg_retention_keep_monthly: 12
+backup_borg_retention_keep_yearly: 2
+```
+
+### Edit the backup schedule (optional)
+
+By default the backup will run 4 a.m. every day based on the `backup_borg_schedule` variable. It is defined in the format of systemd timer calendar.
+
+To edit the schedule, add the following configuration to your `vars.yml` file (adapt to your needs):
+
+```yaml
+backup_borg_schedule: "*-*-* 04:00:00"
+```
+
+**Note**: the actual job may run with a delay. See `backup_borg_schedule_randomized_delay_sec` [here](https://github.com/mother-of-all-self-hosting/ansible-role-backup_borg/blob/f5d5b473d48c6504be10b3d946255ef5c186c2a6/defaults/main.yml#L50) for its default value.
+
+### Set include and/or exclude directories (optional)
 
-* USER - SSH user of a provider/server
-* HOST - SSH host of a provider/server
-* REPO - BorgBackup repository name, it will be initialized on backup start, eg: `matrix`, regarding Syntax see [Remote repositories](https://borgbackup.readthedocs.io/en/stable/usage/general.html#repository-urls)
-* PASSPHRASE - passphrase used for encrypting backups. You can create one with a command like `pwgen -s 64 1`.
-* PRIVATE KEY - the content of the **private** part of the SSH key you created before. The whole key (all of its belonging lines) under `backup_borg_ssh_key_private` needs to be indented with 2 spaces
+`backup_borg_location_source_directories` defines the list of directories to back up. It's set to `{{ matrix_base_data_path }}` by default, which is the base directory for every service's data, such as Synapse, Postgres and the bridges.
 
-To backup without encryption, add `backup_borg_encryption: 'none'` to your vars. This will also enable the `backup_borg_unknown_unencrypted_repo_access_is_ok` variable.
+You might also want to exclude certain directories or file patterns from the backup using the `backup_borg_location_exclude_patterns` variable.
 
-`backup_borg_location_source_directories` defines the list of directories to back up: it's set to `{{ matrix_base_data_path }}` by default, which is the base directory for every service's data, such as Synapse, Postgres and the bridges. You might want to exclude certain directories or file patterns from the backup using the `backup_borg_location_exclude_patterns` variable.
+### Extending the configuration
 
-Check the [backup_borg role](https://github.com/mother-of-all-self-hosting/ansible-role-backup_borg)'s [defaults/main.yml](https://github.com/mother-of-all-self-hosting/ansible-role-backup_borg/blob/main/defaults/main.yml) file for the full list of available options.
+There are some additional things you may wish to configure about the component.
+
+Take a look at:
+
+- [backup_borg role](https://github.com/mother-of-all-self-hosting/ansible-role-backup_borg)'s [`defaults/main.yml`](https://github.com/mother-of-all-self-hosting/ansible-role-backup_borg/blob/main/defaults/main.yml) for some variables that you can customize via your `vars.yml` file. You can override settings (even those that don't have dedicated playbook variables) using the `backup_borg_configuration_extension_yaml` variable
 
 ## Installing
 
@@ -82,4 +136,8 @@ The shortcut commands with the [`just` program](just.md) are also available: `ju
 
 ## Manually start a backup
 
-For testing your setup it can be helpful to not wait until 4am. If you want to run the backup immediately, log onto the server and run `systemctl start matrix-backup-borg`. This will not return until the backup is done, so possibly a long time. Consider using [tmux](https://en.wikipedia.org/wiki/Tmux) if your SSH connection is unstable.
+Sometimes it can be helpful to run the backup as you'd like, avoiding to wait until 4 a.m., like when you test your configuration.
+
+If you want to run the backup immediately, log in to the server with SSH and run `systemctl start matrix-backup-borg`.
+
+This will not return until the backup is done, so it can possibly take a long time. Consider using [tmux](https://en.wikipedia.org/wiki/Tmux) if your SSH connection is unstable.