Synchronizing Snapshots that Rotate

OpenZFS
1

Hi all, my first post here. On my Internet server, I use this script daily to rotate snapshots:

for i in pool/home pool/www pool/local pool/share
do
   # Get the snapshot directory
   sdir=`df | grep $i | sed 's/.* //'`/.zfs/snapshot

   # Unmount all the snapshots
   for j in 0 1 2 3
     do umount $sdir/daily.$j 2> /dev/null
   done

   # Shuffle the snapshots & make a new one
   zfs destroy $i@daily.3 2> /dev/null
   zfs rename $i@daily.2 $i@daily.3 2> /dev/null
   zfs rename $i@daily.1 $i@daily.2 2> /dev/null
   zfs rename $i@daily.0 $i@daily.1 2> /dev/null
   zfs snapshot $i@daily.0 2> /dev/null

   # Unmount all the snapshots
   for j in 0 1 2 3
     do umount $sdir/daily.$j 2> /dev/null
   done
done

which makes and rotates, e.g. pool/home@daily.0 to .1, .2, .3.

I can ssh into the server as root as I have an authorized key set up. I want to be able to synchronise these snapshots to my NAS box at home, which is my own Linux box with ZFS working.

Issues: the mountpoint at home isn’t going to be the same as the mountpoint on the server. I also use port knocking, so each ssh command takes about a second to start, so I don’t want to use syncoid.

I’ve started to play with zfs send and zfs receive, but I’m a bit lost with all the options.

Could someone suggest a zfs send/receive pipeline to e.g. synchronise the pool/home snapshots on my server (mounted on /home) to my at-home pool8T/MinHome (mounted on /usr/MinSnap/home)?

Or, point me at some useful on-line resources?

Thanks so much! Warren

2

I know you said you don’t want to use syncoid, but… Syncoid does use SSH multiplexing with a persistent socket.

If your port knocking setup doesn’t recognize multiplexing already, you should be able to pretty easily reconfigure it to do so without compromising the port knocking obstacle for attackers. That would leave you with only one “couple of seconds” wait for the first connection on any given syncoid run, then all the rest would work without any of the setup overhead.

Alternately, you could establish a WireGuard tunnel between the two systems, and allow SSH without port knocking only on the WireGuard interface, not on the raw network interface.