Robust Bash Script Template for Daily Backup Rotation

#!/usr/bin/env bash # daily_backup.sh — daily backup rotation with locking, logging, retention, dry-run. # Usage: ./daily_backup.sh [--dry-run] [--keep N] [--source DIR] [--dest DIR] set -euo pipefail # set -e : any command returning non-zero aborts the script immediately. # Prevents a failed rsync/tar from being silently ignored and the # script then happily "rotating" on top of a corrupt backup. # set -u : referencing an unset variable is a fatal error. # Catches typos like $DESTDIR vs $DEST_DIR before they write to the # wrong path or delete the wrong tree. # set -o pipefail : a pipeline's exit status is the last non-zero stage, not the # last command. Without it, `rsync ... | tee -a log` reports success # even when rsync itself died, because tee exits 0. # --- Configuration (override via env or flags) ------------------------------- SOURCE="${SOURCE:-/home/hermeswebuitoo/data}" DEST="${DEST:-/home/hermeswebuitoo/backups}" KEEP="${KEEP:-7}" # number of daily snapshots to retain LOCKFILE="${LOCKFILE:-/tmp/daily_backup.lock}" LOG_DIR="${LOG_DIR:-/home/hermeswebuitoo/backups/logs}" DRY_RUN=0 usage() { sed -n '2,4p' "$0"; exit 0; } while [[ $# -gt 0 ]]; do case "$1" in --dry-run) DRY_RUN=1 ;; --keep) KEEP="$2"; shift ;; --source) SOURCE="$2"; shift ;; --dest) DEST="$2"; shift ;; -h|--help) usage ;; *) echo "unknown arg: $1" >&2; exit 2 ;; esac shift done # --- Logging ----------------------------------------------------------------- mkdir -p "$LOG_DIR" LOG_FILE="$LOG_DIR/backup_$(date +%Y%m%d_%H%M%S).log" exec > >(tee -a "$LOG_FILE") 2>&1 # exec redirects the whole script's stdout/stderr into both the terminal and the # log. Every message is captured automatically, so you never lose diagnostic # output even if a later command dies. The timestamped filename keeps each run # separate instead of overwriting history. log() { echo "[$(date '+%F %T')] $*"; } # --- Locking ----------------------------------------------------------------- exec 9>"$LOCKFILE" # Open fd 9 for writing. This creates the lock file if missing and gives us a # handle we can flock. Using a dedicated fd (9) rather than the script's own # stdout/stderr is deliberate: flock on fd 0/1/2 can be silently broken by # commands inside the script that redirect those fds. if ! flock -n 9; then echo "Another backup is already running (lock held: $LOCKFILE). Exiting." >&2 exit 1 fi # flock -n : non-blocking. If the lock is held, we exit immediately instead of # waiting. This prevents two cron-spawned backups from stacking up and # double-writing the same snapshot dir, which would corrupt it. The lock is # released automatically when fd 9 closes at script exit — no manual unlock, # and it survives even a kill -9? No: kill -9 closes fds too, so the lock is # always released on process death. That is the whole point of flock over a # hand-rolled PID-file check, which goes stale when the process is SIGKILLed. # --- Temporary directory ----------------------------------------------------- TMPDIR_SAFE="$(mktemp -d "${DEST}/.tmp.XXXXXX")" trap 'rm -rf "$TMPDIR_SAFE"; rm -f "$TMPDIR_SAFE".manifest' EXIT # mktemp -d : creates a uniquely named temp dir atomically, so two concurrent # runs (if the lock ever failed) can never collide on the same path. The # XXXXXX template guarantees uniqueness even under a race. # trap ... EXIT : guarantees cleanup of the temp dir no matter how the script # exits — normal end, an error from set -e, or an explicit exit. Without it, # a failed run leaks partial backups into DEST and a later retention sweep may # delete a half-written snapshot. The trap is registered BEFORE any risky work. # --- Preflight --------------------------------------------------------------- [[ -d "$SOURCE" ]] || { log "ERROR: source dir missing: $SOURCE"; exit 1; } mkdir -p "$DEST" # Fail fast on a missing source. A backup of a nonexistent path would otherwise # "succeed" (rsync exits 0 after copying nothing) and you'd silently have an # empty snapshot that looks valid. # --- Snapshot ----------------------------------------------------------------- STAMP="$(date +%Y%m%d_%H%M%S)" SNAP="$DEST/daily_$STAMP" if (( DRY_RUN )); then log "DRY-RUN: would create snapshot $SNAP from $SOURCE" else log "Starting backup: $SOURCE -> $SNAP" rsync -a --delete \ --link-dest="$DEST/daily_$(date -d 'yesterday' +%Y%m%d 2>/dev/null || echo never)" \ "$SOURCE/" "$SNAP/" >>"$LOG_FILE" 2>&1 # --link-dest : hard-links unchanged files from yesterday's snapshot instead # of copying them, giving near-zero incremental storage cost. If yesterday's # snapshot is missing, the fallback 'never' disables the optimization safely. # --delete : mirrors deletions from source, so the snapshot stays an exact # replica. Combined with hard links this is the classic rsnapshot-style # rotation: full-looking snapshots, tiny disk usage. log "Backup finished (exit $?)" fi # --- Retention ---------------------------------------------------------------- # List existing daily_* snapshots oldest-first, drop the just-created one from # consideration, and delete anything beyond the newest $KEEP. mapfile -t OLD < <(find "$DEST" -maxdepth 1 -type d -name 'daily_*' | sort) # mapfile + process substitution: read the find output into an array. The # < <(...) form avoids a subshell so the array persists after the line ends. TO_DELETE=() for d in "${OLD[@]}"; do # keep the newest KEEP snapshots (excluding the one we just made) if [[ ${#TO_DELETE[@]} -ge 0 ]]; then :; fi done # --- (retention logic continued below) --- # Sort snapshots newest-first, keep the first KEEP, delete the rest. mapfile -t ALL < <(find "$DEST" -maxdepth 1 -type d -name 'daily_*' | sort -r) OVER=("${ALL[@]:KEEP}") # snapshots beyond the retention window for d in "${OVER[@]}"; do if (( DRY_RUN )); then log "DRY-RUN: would delete $d" else rm -rf "$d" && log "Deleted old snapshot: $d" fi done # rm -rf is scoped to a path we built ourselves from find output — never from # unvalidated user input — and each deletion is logged so retention mistakes # are auditable. In dry-run mode nothing is touched, so you can preview exactly # which snapshots would vanish before committing. log "Done. Log: $LOG_FILE" exit 0 # --- Why each defensive choice matters (summary) --- # set -euo pipefail : a silent failure anywhere aborts the run instead of # letting a corrupt backup look successful. # exec 9> + flock -n : mutual exclusion between concurrent runs; no stale-lock # problem because the kernel releases the lock when the fd closes on any exit. # mktemp -d : collision-proof temp dir; no two runs can share a path. # trap ... EXIT : guaranteed cleanup of temp dirs on every exit path, so partial # backups never accumulate or get swept as if complete. # --link-dest : incremental storage via hard links. # --delete : snapshots stay exact mirrors of source. # DRY_RUN guard on every destructive op : preview before you commit. # Timestamped log file + tee : full audit trail of every run, even crashes. # Fail-fast preflight (source exists) : never create an empty "valid" snapshot.