2026-05-14 plan: WireGuard VPN Eagle-Kraken via VPS for Time Machine
This commit is contained in:
Alexey Martemyanov
@@ -30,6 +30,18 @@ Tool mcp_obsidian_write_note returned error: "Error: Permission denied: personal
|
||||
|
||||
Контейнер запускается как root (uid=0), vault принадлежит kraken (uid=1000) — возможно `mcpvault` отказывает из-за ownership mismatch при создании новых файлов.
|
||||
|
||||
## Fix Required
|
||||
|
||||
Два изменения:
|
||||
|
||||
1. **SOUL.md Кракена** — добавить явный путь для задач/планов:
|
||||
```
|
||||
personal/plans/ — задачи, идеи, планы (надиктованные или записанные)
|
||||
```
|
||||
Сейчас в SOUL.md перечислены только `family/how-to/`, `family/documents/`, `family/contacts/`, `family/schedule/`, `personal/` — нет конкретного места для планов, поэтому агент придумывает пути сам.
|
||||
|
||||
2. **Создать директорию** `personal/plans/` в vault (через Eagle, т.к. Кракен не может писать).
|
||||
|
||||
## What Needs Investigation
|
||||
|
||||
1. Какие директории реально существуют в `/vault/` на Кракене?
|
||||
|
||||
@@ -1,83 +1,145 @@
|
||||
# Plan: Time Machine Backup via SSH Tunnel
|
||||
# Plan: Time Machine Backup via WireGuard VPN
|
||||
|
||||
**Date**: 2026-05-14
|
||||
**Status**: Planning
|
||||
**Date**: 2026-05-14
|
||||
**Status**: Ready to implement
|
||||
|
||||
## Problem
|
||||
|
||||
Kraken (RPi5) is in a different network (VPS via tunnel, IP 91.207.28.205:2223).
|
||||
Time Machine is configured for `smb://timemachine@kraken._smb._tcp.local./TimeMachine` via mDNS — not reachable when Kraken is on a remote network.
|
||||
Kraken (RPi5) в другой сети — доступен только через SSH-туннель на VPS (91.207.28.205:2223).
|
||||
Time Machine настроен на `smb://timemachine@kraken._smb._tcp.local./TimeMachine` через mDNS — не работает.
|
||||
Последний бэкап: 12 мая 2026. Квота: 3.98 TB.
|
||||
|
||||
Last backup: May 12, 2026. Backup destination is 3.98 TB quota.
|
||||
---
|
||||
|
||||
## Options
|
||||
## Топология
|
||||
|
||||
### Option A: SSH Tunnel → SMB Port Forward (complex, fragile)
|
||||
```bash
|
||||
ssh -L 445:localhost:445 kraken@91.207.28.205 -p 2223
|
||||
```
|
||||
Then add TM destination: `smb://timemachine@localhost/TimeMachine`
|
||||
|
||||
**Problems:**
|
||||
- SMB over SSH tunnel is slow for large backups
|
||||
- macOS blocks port 445 forwarding without SIP disabled
|
||||
- TM doesn't handle SMB reconnects well → corrupted sparsebundles
|
||||
- Port 445 requires root privileges on Mac side
|
||||
|
||||
### Option B: Netatalk (AFP over TCP) via Tunnel (legacy, not recommended)
|
||||
AFP support was removed from TM in macOS Ventura+. Not viable.
|
||||
|
||||
### Option C: restic/rclone to remote (not TM, but works)
|
||||
Replace TM for Kraken backup with `restic`:
|
||||
```bash
|
||||
# On Eagle:
|
||||
restic -r sftp:kraken@91.207.28.205:2223/backups/eagle backup ~/
|
||||
Eagle (10.99.0.2) ──→ VPS:51820 ←── Kraken (10.99.0.3)
|
||||
10.99.0.1
|
||||
```
|
||||
Works over SSH, incremental, encrypted. But not native TM UX.
|
||||
|
||||
### Option D: Wireguard VPN between Eagle and Kraken (best)
|
||||
- Kraken runs Wireguard server → Eagle connects as peer
|
||||
- Eagle sees Kraken's SMB share at VPN IP (e.g. 10.0.0.2)
|
||||
- TM configured to use VPN IP instead of mDNS
|
||||
- Survives network changes, works from any location
|
||||
**VPS — WireGuard сервер (хаб).** Eagle и Kraken — оба клиенты, оба инициируют исходящий UDP.
|
||||
|
||||
**Setup:**
|
||||
1. Install Wireguard on Kraken (Docker or host)
|
||||
2. Configure Eagle as Wireguard peer
|
||||
3. Expose Samba port on Kraken's VPN interface
|
||||
4. Update TM destination to VPN IP
|
||||
Kraken не может быть сервером: он за домашним NAT, входящий UDP снаружи недоступен без port forwarding на роутере.
|
||||
Cloudflare туннель не нужен — WireGuard использует UDP, CF его не поддерживает. Идёт напрямую на VPS.
|
||||
|
||||
### Option E: Keep WD12-TimeMachine local + periodic rsync to Kraken
|
||||
- WD12-TimeMachine (6.01 TB) is LOCAL — backups fine
|
||||
- Rsync the TM sparsebundle to Kraken weekly
|
||||
- Kraken = offsite copy, not real-time TM
|
||||
Kraken держит два исходящих туннеля на VPS:
|
||||
- уже есть: autossh TCP:2223 (SSH доступ)
|
||||
- новый: wg-quick UDP:51820 (VPN)
|
||||
|
||||
## Recommendation
|
||||
---
|
||||
|
||||
**Short term**: Do nothing — WD12 local TM is working fine (last backup May 12).
|
||||
## Что уже есть
|
||||
|
||||
**Medium term (1-2 weeks)**: Option D (Wireguard VPN)
|
||||
- Best reliability, proper TM over SMB
|
||||
- Kraken already has Docker — easy to add Wireguard container
|
||||
| Узел | Статус |
|
||||
|------|--------|
|
||||
| VPS (Debian 6.1) | ✅ kernel module wireguard есть, `wireguard-tools` не установлен |
|
||||
| Kraken (RPi5 6.12) | ✅ `wireguard-tools` в apt, модуль встроен в ядро |
|
||||
| Eagle (macOS) | Нужен WireGuard.app (App Store) или `brew install wireguard-tools` |
|
||||
|
||||
**Alternatively**: Option E (rsync TM bundle to Kraken) — simpler, less real-time
|
||||
---
|
||||
|
||||
## Current Status
|
||||
## Фаза 1 — VPS: сервер (~10 мин)
|
||||
|
||||
- WD12-TimeMachine: local, 6.01 TB, working ✅
|
||||
- Kraken SMB TM: 3.98 TB, last backup May 12, NOT reachable from Eagle currently ⚠️
|
||||
- Kraken network: accessible only via SSH tunnel (VPS 91.207.28.205:2223)
|
||||
```bash
|
||||
apt install -y wireguard-tools
|
||||
|
||||
## Next Steps (when ready to implement)
|
||||
# Ключи
|
||||
wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub
|
||||
|
||||
1. Decision: Wireguard vs rsync-only
|
||||
2. If Wireguard: deploy wg-easy Docker container on Kraken
|
||||
3. Configure Eagle as peer (macOS Wireguard app or CLI)
|
||||
4. Test SMB reach over VPN
|
||||
5. Update TM destination
|
||||
# /etc/wireguard/wg0.conf
|
||||
[Interface]
|
||||
Address = 10.99.0.1/24
|
||||
ListenPort = 51820
|
||||
PrivateKey = <server.key>
|
||||
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||||
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
|
||||
|
||||
## Notes
|
||||
[Peer]
|
||||
# Eagle
|
||||
PublicKey = <eagle.pub>
|
||||
AllowedIPs = 10.99.0.2/32
|
||||
|
||||
- Don't try SMB over port-forward — port 445 blocked by macOS SIP on loopback
|
||||
- Kraken SSH tunnel is stable (CF tunnel via cloudflared)
|
||||
- TrueNAS (Taiga) also available for backup — might be better option if Taiga on local net
|
||||
[Peer]
|
||||
# Kraken
|
||||
PublicKey = <kraken.pub>
|
||||
AllowedIPs = 10.99.0.3/32
|
||||
|
||||
# IP forwarding
|
||||
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf && sysctl -p
|
||||
|
||||
systemctl enable --now wg-quick@wg0
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Фаза 2 — Kraken: клиент (~5 мин)
|
||||
|
||||
```bash
|
||||
sudo apt install -y wireguard-tools
|
||||
|
||||
# Ключи
|
||||
wg genkey | sudo tee /etc/wireguard/client.key | wg pubkey | sudo tee /etc/wireguard/client.pub
|
||||
|
||||
# /etc/wireguard/wg0.conf
|
||||
[Interface]
|
||||
Address = 10.99.0.3/24
|
||||
PrivateKey = <client.key>
|
||||
|
||||
[Peer]
|
||||
PublicKey = <server.pub>
|
||||
Endpoint = 91.207.28.205:51820
|
||||
AllowedIPs = 10.99.0.0/24
|
||||
PersistentKeepalive = 25
|
||||
|
||||
sudo systemctl enable --now wg-quick@wg0
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Фаза 3 — Eagle: клиент (~5 мин)
|
||||
|
||||
```bash
|
||||
# Генерация ключей
|
||||
wg genkey | tee ~/eagle.key | wg pubkey > ~/eagle.pub
|
||||
|
||||
# tunnel.conf (импортировать в WireGuard.app)
|
||||
[Interface]
|
||||
Address = 10.99.0.2/24
|
||||
PrivateKey = <eagle.key>
|
||||
|
||||
[Peer]
|
||||
PublicKey = <server.pub>
|
||||
Endpoint = 91.207.28.205:51820
|
||||
AllowedIPs = 10.99.0.0/24
|
||||
PersistentKeepalive = 25
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Фаза 4 — Тест (~5 мин)
|
||||
|
||||
```bash
|
||||
ping 10.99.0.1 # Eagle → VPS
|
||||
ping 10.99.0.3 # Eagle → Kraken
|
||||
smbclient -L //10.99.0.3 -U timemachine
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Фаза 5 — Time Machine
|
||||
|
||||
```bash
|
||||
sudo tmutil removedestination <old-id>
|
||||
sudo tmutil setdestination smb://timemachine@10.99.0.3/TimeMachine
|
||||
```
|
||||
|
||||
Или через GUI: System Settings → General → Time Machine → Add Backup Disk → `smb://timemachine@10.99.0.3/TimeMachine`
|
||||
|
||||
---
|
||||
|
||||
## Заметки
|
||||
|
||||
- `AllowedIPs = 10.99.0.0/24` — только VPN-трафик через туннель, интернет напрямую
|
||||
- SMB через WireGuard достаточно быстр для TM
|
||||
- VPS = single point of failure для TM, это приемлемо
|
||||
|
||||
Reference in New Issue
Block a user