My Homelab Backup Scheme

#!/usr/bin/env bash
# We expect this to run as root, otherwise
# virsh will fail to find VMs (domains in libvirt lingo)

set -euo pipefail

# Usage: backup_vm.sh VMNAME
VM="$1"
BASE_DIR="/mnt/backup/vms"
TIMESTAMP=$(date +"%Y-%m-%d_%H-%M-%S")
BACKUP_DIR="$BASE_DIR/${VM}_${TIMESTAMP}"

mkdir -p "$BACKUP_DIR"

echo "Shutting down VM: $VM"
virsh shutdown "$VM"

# Shutting down the VM can take a few seconds
echo "Waiting for VM to stop..."
while true; do
    state=$(virsh domstate "$VM" 2>/dev/null | tr 'A-Z' 'a-z')
    if [[ "$state" =~ (shut[- ]?off|off) ]]; then
        echo "VM is off."
        break
    fi
    sleep 2
done

echo "Dumping XML config..."
virsh dumpxml "$VM" > "$BACKUP_DIR/${VM}.xml"

echo "Backing up disks..."

# This is using XPath to find the disks associated with the VM
# mapfile turns that list of disks into an array
# Assumes that the disks have a physical filesystem mapping
mapfile -t disks < <(virsh dumpxml "$VM" | xmlstarlet sel -t -v "//disk[@device='disk']/source/@file" -n)

# loop through the disks and 
for disk in "${disks[@]}"; do
    base=$(basename "$disk")
    temp_copy="$BACKUP_DIR/${base}"

    echo "Copying $disk → $temp_copy"
    cp --reflink=auto --sparse=always "$disk" "$temp_copy"

    # Using -6 as a compromise between time and compression level
    # This is Good Enough™ because the disk images are sparse anyway
    echo "Compressing disk image with zstd..."
    zstd -T0 -6 "$temp_copy"
    rm "$temp_copy"  # leave only .zst
done

echo "Restarting VM..."
virsh start "$VM"

echo "Backup complete: $BACKUP_DIR"

echo "Cleaning old backups (keeping only most recent)..."

# Find all backup directories for this VM in $BASE_DIR
mapfile -t old_backups < <(
    ls -1dt "$BASE_DIR"/"${VM}"_* 2>/dev/null | tail -n +2
)

# Delete all but the newest
for backup in "${old_backups[@]}"; do
    echo "Deleting old backup: $backup"
    rm -rf "$backup"
done

[Unit]
Description=Backup libvirt VM %i
After=network-online.target libvirtd.service
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup-vm.sh %i
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=7

[Unit]
Description=Daily backup for VM %i

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload

# Test once
sudo systemctl start backup-vm@myvm

# Enable timer for VM
sudo systemctl enable --now [email protected]

# Check the timers
systemctl list-timers | grep backup-vm

{
  "id": "vm-backups",
  "guid": "{some_guid_assigned_by_backrest}",
  "uri": "s3:https://s3.us-east.backblazeb2.com/{bucket_name}",
  "password": "{encryption_password}",
  "env": [
    "AWS_ACCESS_KEY_ID={backblaze_access_key}",
    "AWS_SECRET_ACCESS_KEY={backblaze_secret_id}"
  ],
  "flags": [],
  // A prune policy is how often restic will prune the repo.
  // I set B2 up to only keep one version of the files,
  // so this is basically moot.
  "prunePolicy": {
    "maxUnusedPercent": 10,
    "schedule": {
      "clock": "CLOCK_LAST_RUN_TIME",
      "maxFrequencyDays": 2
    }
  },
  // Restic can occasionally check the files in the repo for
  // integrity. This is the schedule for which to do so.
  "checkPolicy": {
    "readDataSubsetPercent": 0,
    "schedule": {
      "clock": "CLOCK_LAST_RUN_TIME",
      "maxFrequencyDays": 2
    }
  },
  "commandPrefix": {
    "ioNice": "IO_DEFAULT",
    "cpuNice": "CPU_DEFAULT"
  },
  "autoUnlock": false,
  "hooks": []
}

{
  "id": "vm-backup",
  "repo": "vm-backups",
  "paths": [
    "/mnt/backup/vms"
  ],
  "excludes": [],
  "iexcludes": [],
  // The local backups run at 00:00.
  // This will run at 02:00.
  "schedule": {
    "clock": "CLOCK_LOCAL",
    "cron": "0 2 * * *"
  },
  "backup_flags": [],
  "hooks": [],
  "retention": {
    "policyKeepAll": true
  }
}