From 5af44953e9932c1efd82636fda835678a0aeb746 Mon Sep 17 00:00:00 2001 From: Alexey Martemyanov Date: Thu, 14 May 2026 12:47:32 +0600 Subject: [PATCH] 2026-05-14 plan: WireGuard VPN Eagle-Kraken via VPS for Time Machine --- work/plans/kraken-obsidian-write-bug.md | 12 ++ work/plans/time-machine-tunnel-backup.md | 184 +++++++++++++++-------- 2 files changed, 135 insertions(+), 61 deletions(-) diff --git a/work/plans/kraken-obsidian-write-bug.md b/work/plans/kraken-obsidian-write-bug.md index 1192f890..ff621844 100644 --- a/work/plans/kraken-obsidian-write-bug.md +++ b/work/plans/kraken-obsidian-write-bug.md @@ -30,6 +30,18 @@ Tool mcp_obsidian_write_note returned error: "Error: Permission denied: personal Контейнер запускается как root (uid=0), vault принадлежит kraken (uid=1000) — возможно `mcpvault` отказывает из-за ownership mismatch при создании новых файлов. +## Fix Required + +Два изменения: + +1. **SOUL.md Кракена** — добавить явный путь для задач/планов: + ``` + personal/plans/ — задачи, идеи, планы (надиктованные или записанные) + ``` + Сейчас в SOUL.md перечислены только `family/how-to/`, `family/documents/`, `family/contacts/`, `family/schedule/`, `personal/` — нет конкретного места для планов, поэтому агент придумывает пути сам. + +2. **Создать директорию** `personal/plans/` в vault (через Eagle, т.к. Кракен не может писать). + ## What Needs Investigation 1. Какие директории реально существуют в `/vault/` на Кракене? diff --git a/work/plans/time-machine-tunnel-backup.md b/work/plans/time-machine-tunnel-backup.md index f3795ce7..f733030e 100644 --- a/work/plans/time-machine-tunnel-backup.md +++ b/work/plans/time-machine-tunnel-backup.md @@ -1,83 +1,145 @@ -# Plan: Time Machine Backup via SSH Tunnel +# Plan: Time Machine Backup via WireGuard VPN -**Date**: 2026-05-14 -**Status**: Planning +**Date**: 2026-05-14 +**Status**: Ready to implement ## Problem -Kraken (RPi5) is in a different network (VPS via tunnel, IP 91.207.28.205:2223). -Time Machine is configured for `smb://timemachine@kraken._smb._tcp.local./TimeMachine` via mDNS — not reachable when Kraken is on a remote network. +Kraken (RPi5) в другой сети — доступен только через SSH-туннель на VPS (91.207.28.205:2223). +Time Machine настроен на `smb://timemachine@kraken._smb._tcp.local./TimeMachine` через mDNS — не работает. +Последний бэкап: 12 мая 2026. Квота: 3.98 TB. -Last backup: May 12, 2026. Backup destination is 3.98 TB quota. +--- -## Options +## Топология -### Option A: SSH Tunnel → SMB Port Forward (complex, fragile) -```bash -ssh -L 445:localhost:445 kraken@91.207.28.205 -p 2223 ``` -Then add TM destination: `smb://timemachine@localhost/TimeMachine` - -**Problems:** -- SMB over SSH tunnel is slow for large backups -- macOS blocks port 445 forwarding without SIP disabled -- TM doesn't handle SMB reconnects well → corrupted sparsebundles -- Port 445 requires root privileges on Mac side - -### Option B: Netatalk (AFP over TCP) via Tunnel (legacy, not recommended) -AFP support was removed from TM in macOS Ventura+. Not viable. - -### Option C: restic/rclone to remote (not TM, but works) -Replace TM for Kraken backup with `restic`: -```bash -# On Eagle: -restic -r sftp:kraken@91.207.28.205:2223/backups/eagle backup ~/ +Eagle (10.99.0.2) ──→ VPS:51820 ←── Kraken (10.99.0.3) + 10.99.0.1 ``` -Works over SSH, incremental, encrypted. But not native TM UX. -### Option D: Wireguard VPN between Eagle and Kraken (best) -- Kraken runs Wireguard server → Eagle connects as peer -- Eagle sees Kraken's SMB share at VPN IP (e.g. 10.0.0.2) -- TM configured to use VPN IP instead of mDNS -- Survives network changes, works from any location +**VPS — WireGuard сервер (хаб).** Eagle и Kraken — оба клиенты, оба инициируют исходящий UDP. -**Setup:** -1. Install Wireguard on Kraken (Docker or host) -2. Configure Eagle as Wireguard peer -3. Expose Samba port on Kraken's VPN interface -4. Update TM destination to VPN IP +Kraken не может быть сервером: он за домашним NAT, входящий UDP снаружи недоступен без port forwarding на роутере. +Cloudflare туннель не нужен — WireGuard использует UDP, CF его не поддерживает. Идёт напрямую на VPS. -### Option E: Keep WD12-TimeMachine local + periodic rsync to Kraken -- WD12-TimeMachine (6.01 TB) is LOCAL — backups fine -- Rsync the TM sparsebundle to Kraken weekly -- Kraken = offsite copy, not real-time TM +Kraken держит два исходящих туннеля на VPS: +- уже есть: autossh TCP:2223 (SSH доступ) +- новый: wg-quick UDP:51820 (VPN) -## Recommendation +--- -**Short term**: Do nothing — WD12 local TM is working fine (last backup May 12). +## Что уже есть -**Medium term (1-2 weeks)**: Option D (Wireguard VPN) -- Best reliability, proper TM over SMB -- Kraken already has Docker — easy to add Wireguard container +| Узел | Статус | +|------|--------| +| VPS (Debian 6.1) | ✅ kernel module wireguard есть, `wireguard-tools` не установлен | +| Kraken (RPi5 6.12) | ✅ `wireguard-tools` в apt, модуль встроен в ядро | +| Eagle (macOS) | Нужен WireGuard.app (App Store) или `brew install wireguard-tools` | -**Alternatively**: Option E (rsync TM bundle to Kraken) — simpler, less real-time +--- -## Current Status +## Фаза 1 — VPS: сервер (~10 мин) -- WD12-TimeMachine: local, 6.01 TB, working ✅ -- Kraken SMB TM: 3.98 TB, last backup May 12, NOT reachable from Eagle currently ⚠️ -- Kraken network: accessible only via SSH tunnel (VPS 91.207.28.205:2223) +```bash +apt install -y wireguard-tools -## Next Steps (when ready to implement) +# Ключи +wg genkey | tee /etc/wireguard/server.key | wg pubkey > /etc/wireguard/server.pub -1. Decision: Wireguard vs rsync-only -2. If Wireguard: deploy wg-easy Docker container on Kraken -3. Configure Eagle as peer (macOS Wireguard app or CLI) -4. Test SMB reach over VPN -5. Update TM destination +# /etc/wireguard/wg0.conf +[Interface] +Address = 10.99.0.1/24 +ListenPort = 51820 +PrivateKey = +PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE +PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE -## Notes +[Peer] +# Eagle +PublicKey = +AllowedIPs = 10.99.0.2/32 -- Don't try SMB over port-forward — port 445 blocked by macOS SIP on loopback -- Kraken SSH tunnel is stable (CF tunnel via cloudflared) -- TrueNAS (Taiga) also available for backup — might be better option if Taiga on local net +[Peer] +# Kraken +PublicKey = +AllowedIPs = 10.99.0.3/32 + +# IP forwarding +echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf && sysctl -p + +systemctl enable --now wg-quick@wg0 +``` + +--- + +## Фаза 2 — Kraken: клиент (~5 мин) + +```bash +sudo apt install -y wireguard-tools + +# Ключи +wg genkey | sudo tee /etc/wireguard/client.key | wg pubkey | sudo tee /etc/wireguard/client.pub + +# /etc/wireguard/wg0.conf +[Interface] +Address = 10.99.0.3/24 +PrivateKey = + +[Peer] +PublicKey = +Endpoint = 91.207.28.205:51820 +AllowedIPs = 10.99.0.0/24 +PersistentKeepalive = 25 + +sudo systemctl enable --now wg-quick@wg0 +``` + +--- + +## Фаза 3 — Eagle: клиент (~5 мин) + +```bash +# Генерация ключей +wg genkey | tee ~/eagle.key | wg pubkey > ~/eagle.pub + +# tunnel.conf (импортировать в WireGuard.app) +[Interface] +Address = 10.99.0.2/24 +PrivateKey = + +[Peer] +PublicKey = +Endpoint = 91.207.28.205:51820 +AllowedIPs = 10.99.0.0/24 +PersistentKeepalive = 25 +``` + +--- + +## Фаза 4 — Тест (~5 мин) + +```bash +ping 10.99.0.1 # Eagle → VPS +ping 10.99.0.3 # Eagle → Kraken +smbclient -L //10.99.0.3 -U timemachine +``` + +--- + +## Фаза 5 — Time Machine + +```bash +sudo tmutil removedestination +sudo tmutil setdestination smb://timemachine@10.99.0.3/TimeMachine +``` + +Или через GUI: System Settings → General → Time Machine → Add Backup Disk → `smb://timemachine@10.99.0.3/TimeMachine` + +--- + +## Заметки + +- `AllowedIPs = 10.99.0.0/24` — только VPN-трафик через туннель, интернет напрямую +- SMB через WireGuard достаточно быстр для TM +- VPS = single point of failure для TM, это приемлемо