バックアップとリストア：別 VM からサービスを復旧する

ssh ops@learner01

# 専用グループとサービスユーザ
sudo groupadd part3ops
sudo useradd --system \
  --gid part3ops \
  --home-dir /nonexistent \
  --shell /usr/sbin/nologin \
  part3svc

# setgid を付け、配下へ part3ops グループを継承させる
sudo install -d -o ops -g part3ops -m 2750 /srv/part3-final
sudo install -d -o ops -g part3ops -m 2750 /srv/part3-final/data

sudo -u ops tee /srv/part3-final/data/config.ini >/dev/null <<'EOF'
[service]
mode=training
message=part3-complete
EOF

sudo -u ops tee /srv/part3-final/data/inventory.csv >/dev/null <<'EOF'
service,status
part3-final,ready
EOF

sudo chown ops:part3ops /srv/part3-final/data/config.ini \
  /srv/part3-final/data/inventory.csv
sudo chmod 0640 /srv/part3-final/data/config.ini \
  /srv/part3-final/data/inventory.csv

sudo tee /usr/local/sbin/part3-final-validate >/dev/null <<'EOF'
#!/usr/bin/env bash
set -eu

data_dir=/srv/part3-final/data
for required in config.ini inventory.csv; do
  if [[ ! -r "${data_dir}/${required}" ]]; then
    echo "health=failed missing_or_unreadable=${required}" >&2
    exit 1
  fi
done
EOF

sudo tee /usr/local/sbin/part3-final-service >/dev/null <<'EOF'
#!/usr/bin/env bash
set -eu

data_dir=/srv/part3-final/data
while true; do
  file_count="$(find "${data_dir}" -maxdepth 1 -type f | wc -l)"
  echo "health=ok readable_files=${file_count}"
  sleep 15
done
EOF

sudo chown root:root /usr/local/sbin/part3-final-validate \
  /usr/local/sbin/part3-final-service
sudo chmod 0755 /usr/local/sbin/part3-final-validate \
  /usr/local/sbin/part3-final-service

sudo tee /etc/systemd/system/part3-final.service >/dev/null <<'EOF'
[Unit]
Description=Part 3 final backup and restore lab service
After=local-fs.target

[Service]
Type=simple
User=part3svc
Group=part3ops
ExecStartPre=/usr/local/sbin/part3-final-validate
ExecStart=/usr/local/sbin/part3-final-service
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now part3-final.service
systemctl is-enabled part3-final.service
systemctl is-active part3-final.service
sudo journalctl -u part3-final.service -n 10 --no-pager

enabled
active
…（略）
 8月 10 00:02:06 learner01 systemd[1]: Started part3-final.service - Part 3 final backup and restore lab service.
 8月 10 00:02:06 learner01 part3-final-service[2029]: health=ok readable_files=2

f: /srv/part3-final
drwxr-xr-x root root     /
drwxr-xr-x root root     srv
drwxr-s--- ops  part3ops part3-final
Access: (2750/drwxr-s---)  Uid: ( 1002/     ops)   Gid: ( 1005/part3ops)

# learner01 で ops として実行
install -d -m 0700 /home/ops/.ssh
ssh-keygen -t ed25519 \
  -N '' \
  -C 'part3-ch7-temporary' \
  -f /home/ops/.ssh/ch7_backup_ed25519

# workstation01 で実行
ssh ops@learner01 'cat ~/.ssh/ch7_backup_ed25519.pub' |
ssh ops@learner02 \
  "umask 077; mkdir -p ~/.ssh; touch ~/.ssh/authorized_keys; \
   sed -i '/ part3-ch7-temporary$/d' ~/.ssh/authorized_keys; \
   cat >> ~/.ssh/authorized_keys"

# workstation01 から learner02 のローカル fingerprint を確認
ssh ops@learner02 \
  'sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub'

# learner01 で、Ch7 専用 known_hosts を作る
ssh-keyscan -t ed25519 learner02 > /home/ops/.ssh/ch7_known_hosts
ssh-keygen -lf /home/ops/.ssh/ch7_known_hosts

256 SHA256:R+Kwa5SBz1fI…（環境により異なります） root@learner02 (ED25519)
256 SHA256:R+Kwa5SBz1fI…（環境により異なります） learner02 (ED25519)

# learner02 で ops として実行
OPS_GROUP="$(id -gn)"
sudo install -d -o ops -g "${OPS_GROUP}" -m 0750 \
  /srv/backups/part3-final

# learner01 で実行
ssh \
  -i /home/ops/.ssh/ch7_backup_ed25519 \
  -o IdentitiesOnly=yes \
  -o UserKnownHostsFile=/home/ops/.ssh/ch7_known_hosts \
  -o StrictHostKeyChecking=yes \
  ops@learner02 'test -d /srv/backups/part3-final && date -u'

  File: /srv/backups/part3-final
Access: (0750/drwxr-x---)  Uid: ( 1002/     ops)   Gid: ( 1002/     ops)
2026年  8月  9日 日曜日 15:09:28 UTC

date -u
sudo systemctl stop part3-final.service
systemctl is-active part3-final.service

BACKUP_ID="$(date -u +%Y%m%dT%H%M%SZ)"
printf '%s\n' "${BACKUP_ID}" | tee /srv/part3-final/backup-id

# 想定外の文字列を後のパス操作へ渡さない
case "${BACKUP_ID}" in
  20??????T??????Z) ;;
  *) echo 'invalid BACKUP_ID' >&2; exit 1 ;;
esac

(
  cd /srv/part3-final/data
  find . -type f -print0 | sort -z | xargs -0 sha256sum
) | tee /srv/part3-final/manifest.sha256

(
  cd /srv/part3-final/data
  find . -type f -printf '%P|%u|%g|%m|%s\n' | sort
) | tee /srv/part3-final/metadata.before

sudo chown ops:part3ops \
  /srv/part3-final/backup-id \
  /srv/part3-final/manifest.sha256 \
  /srv/part3-final/metadata.before
sudo chmod 0640 \
  /srv/part3-final/backup-id \
  /srv/part3-final/manifest.sha256 \
  /srv/part3-final/metadata.before

20260809T151003Z
e6c0bb6fb61941f5785a390847c2cbca9c9df0a46e3dec043fa232f7cee2ef4d  ./config.ini
2633b5b989d5b87b5663997bd98e11dfd4dff3022ea79cce04c5f76464ff94b4  ./inventory.csv
config.ini|ops|part3ops|640|47
inventory.csv|ops|part3ops|640|33
--- ファイル数
5
--- 論理バイト数
323	/srv/part3-final

ssh ops@<Proxmox管理IP>

# 対象 VM を名前と状態で再確認
qm list
qm config <VMID> | grep '^name:'

# 比較用 snapshot。復元には使わない
qm snapshot <VMID> ch7-before-loss \
  --description 'Part 3 Ch7 before data deletion'

qm listsnapshot <VMID>

      VMID NAME                 STATUS     MEM(MB)    BOOTDISK(GB) PID
       <VMID> learner01-<管理IP>   running    2048              32.00 61133
name: learner01-<管理IP>
snapshotting 'drive-scsi0' (local-lvm:vm-<VMID>-disk-0)
  WARNING: You have not turned on protection against thin pools running out of space.
  WARNING: Set activation/thin_pool_autoextend_threshold below 100 to trigger automatic extension of thin pools before they get full.
  WARNING: Sum of all thin volume sizes (1.42 TiB) exceeds the size of thin pool pve/data and the size of whole volume group (<464.00 GiB).
…（略）
created

（スナップショット一覧・末尾のみ）
              `-> clean-<世代>      2026-08-08 11:14:57     （説明は省略）
               `-> clean-<世代>     2026-08-09 23:47:22     （説明は省略）
                `-> ch7-before-loss 2026-08-10 00:10:44     Part 3 Ch7 before data deletion
                 `-> current                            You are here!

BACKUP_ID="$(cat /srv/part3-final/backup-id)"
case "${BACKUP_ID}" in
  20??????T??????Z) ;;
  *) echo 'invalid BACKUP_ID' >&2; exit 1 ;;
esac

ssh \
  -i /home/ops/.ssh/ch7_backup_ed25519 \
  -o IdentitiesOnly=yes \
  -o UserKnownHostsFile=/home/ops/.ssh/ch7_known_hosts \
  -o StrictHostKeyChecking=yes \
  ops@learner02 \
  "mkdir -p /srv/backups/part3-final/${BACKUP_ID}/data"

rsync -a \
  --delete \
  --no-owner \
  --no-group \
  --itemize-changes \
  -e "ssh -i /home/ops/.ssh/ch7_backup_ed25519 \
      -o IdentitiesOnly=yes \
      -o UserKnownHostsFile=/home/ops/.ssh/ch7_known_hosts \
      -o StrictHostKeyChecking=yes" \
  /srv/part3-final/data/ \
  ops@learner02:/srv/backups/part3-final/${BACKUP_ID}/data/

rsync -a \
  --no-owner \
  --no-group \
  -e "ssh -i /home/ops/.ssh/ch7_backup_ed25519 \
      -o IdentitiesOnly=yes \
      -o UserKnownHostsFile=/home/ops/.ssh/ch7_known_hosts \
      -o StrictHostKeyChecking=yes" \
  /srv/part3-final/manifest.sha256 \
  /srv/part3-final/metadata.before \
  /srv/part3-final/backup-id \
  ops@learner02:/srv/backups/part3-final/${BACKUP_ID}/

ssh \
  -i /home/ops/.ssh/ch7_backup_ed25519 \
  -o IdentitiesOnly=yes \
  -o UserKnownHostsFile=/home/ops/.ssh/ch7_known_hosts \
  -o StrictHostKeyChecking=yes \
  ops@learner02 \
  "chmod -R a-w /srv/backups/part3-final/${BACKUP_ID}"

.d..tp..... ./
<f+++++++++ config.ini
<f+++++++++ inventory.csv

データ本体      real 0m0.336s   user 0m0.087s   sys 0m0.004s
検証用ファイル  real 0m0.318s   user 0m0.083s   sys 0m0.007s

-r--r----- ops:ops 161 /srv/backups/part3-final/20260809T151003Z/manifest.sha256
-r--r----- ops:ops 17 /srv/backups/part3-final/20260809T151003Z/backup-id
-r--r----- ops:ops 33 /srv/backups/part3-final/20260809T151003Z/data/inventory.csv
-r--r----- ops:ops 47 /srv/backups/part3-final/20260809T151003Z/data/config.ini
-r--r----- ops:ops 65 /srv/backups/part3-final/20260809T151003Z/metadata.before
dr-xr-s--- ops:ops 4096 /srv/backups/part3-final/20260809T151003Z/data
dr-xr-xr-x ops:ops 4096 /srv/backups/part3-final/20260809T151003Z

BACKUP_ID="$(cat /srv/part3-final/backup-id)"
case "${BACKUP_ID}" in
  20??????T??????Z) ;;
  *) echo 'invalid BACKUP_ID' >&2; exit 1 ;;
esac

ssh \
  -i /home/ops/.ssh/ch7_backup_ed25519 \
  -o IdentitiesOnly=yes \
  -o UserKnownHostsFile=/home/ops/.ssh/ch7_known_hosts \
  -o StrictHostKeyChecking=yes \
  ops@learner02 \
  "cd /srv/backups/part3-final/${BACKUP_ID}/data && \
   sha256sum -c ../manifest.sha256"

ssh \
  -i /home/ops/.ssh/ch7_backup_ed25519 \
  -o IdentitiesOnly=yes \
  -o UserKnownHostsFile=/home/ops/.ssh/ch7_known_hosts \
  -o StrictHostKeyChecking=yes \
  ops@learner02 \
  "date -u; du -sb /srv/backups/part3-final/${BACKUP_ID}; \
   df -h /srv/backups/part3-final/${BACKUP_ID}"

./config.ini: OK
./inventory.csv: OK
2026年  8月  9日 日曜日 15:13:24 UTC
323	/srv/backups/part3-final/20260809T151003Z
Filesystem                         Size  Used Avail Use% Mounted on
/dev/mapper/ubuntu--vg-ubuntu--lv   15G   12G  2.7G  81% /

sudo systemctl start part3-final.service
systemctl is-active part3-final.service
sudo journalctl -u part3-final.service -n 10 --no-pager

ls -l /srv/part3-final/data/config.ini \
  /srv/part3-final/data/inventory.csv

date -u
sudo rm -f -- \
  /srv/part3-final/data/config.ini \
  /srv/part3-final/data/inventory.csv

sudo systemctl restart part3-final.service
systemctl show part3-final.service \
  -p ActiveState -p SubState -p NRestarts
sudo journalctl -u part3-final.service -n 30 --no-pager

-rw-r----- 1 ops part3ops 47  8月 10 00:01 /srv/part3-final/data/config.ini
-rw-r----- 1 ops part3ops 33  8月 10 00:01 /srv/part3-final/data/inventory.csv
障害発生時刻: 2026-08-09 15:14:20 UTC

合計 8
drwxr-s--- 2 ops part3ops 4096  8月 10 00:14 .
drwxr-s--- 3 ops part3ops 4096  8月 10 00:10 ..
Job for part3-final.service failed because the control process exited with error code.
NRestarts=0
ActiveState=activating
SubState=auto-restart

 8月 10 00:14:20 learner01 part3-final-validate[3190]: health=failed missing_or_unreadable=config.ini
 8月 10 00:14:20 learner01 systemd[1]: part3-final.service: Control process exited, code=exited, status=1/FAILURE
…（略）
 8月 10 00:14:20 learner01 systemd[1]: Failed to start part3-final.service - Part 3 final backup and restore lab service.

sudo systemctl stop part3-final.service
sudo systemctl reset-failed part3-final.service

BACKUP_ID="$(cat /srv/part3-final/backup-id)"
case "${BACKUP_ID}" in
  20??????T??????Z) ;;
  *) echo 'invalid BACKUP_ID' >&2; exit 1 ;;
esac

printf 'restore source: learner02:/srv/backups/part3-final/%s/data/\n' \
  "${BACKUP_ID}"
printf 'restore destination: learner01:/srv/part3-final/data/\n'

rsync -a \
  --checksum \
  --no-owner \
  --no-group \
  --itemize-changes \
  -e "ssh -i /home/ops/.ssh/ch7_backup_ed25519 \
      -o IdentitiesOnly=yes \
      -o UserKnownHostsFile=/home/ops/.ssh/ch7_known_hosts \
      -o StrictHostKeyChecking=yes" \
  ops@learner02:/srv/backups/part3-final/${BACKUP_ID}/data/ \
  /srv/part3-final/data/

install -d -m 0750 /srv/part3-final/restore-evidence

rsync -a \
  --no-owner \
  --no-group \
  -e "ssh -i /home/ops/.ssh/ch7_backup_ed25519 \
      -o IdentitiesOnly=yes \
      -o UserKnownHostsFile=/home/ops/.ssh/ch7_known_hosts \
      -o StrictHostKeyChecking=yes" \
  ops@learner02:/srv/backups/part3-final/${BACKUP_ID}/manifest.sha256 \
  ops@learner02:/srv/backups/part3-final/${BACKUP_ID}/metadata.before \
  /srv/part3-final/restore-evidence/

.d..tp..... ./
>f+++++++++ config.ini
>f+++++++++ inventory.csv

データ本体（--checksum）  real 0m0.929s   user 0m0.087s   sys 0m0.002s
検査票の取り戻し          real 0m0.307s   user 0m0.082s   sys 0m0.008s

/srv/part3-final/data/:
-r--r----- 1 ops ops 47  8月 10 00:01 config.ini
-r--r----- 1 ops ops 33  8月 10 00:01 inventory.csv

/srv/part3-final/restore-evidence/:
-r--r----- 1 ops part3ops 161  8月 10 00:10 manifest.sha256
-r--r----- 1 ops part3ops  65  8月 10 00:10 metadata.before

(
  cd /srv/part3-final/data
  sha256sum -c ../restore-evidence/manifest.sha256
)

./config.ini: OK
./inventory.csv: OK

(
  cd /srv/part3-final/data
  find . -type f -printf '%P|%u|%g|%m|%s\n' | sort
) | tee /srv/part3-final/restore-evidence/metadata.after

diff -u \
  /srv/part3-final/restore-evidence/metadata.before \
  /srv/part3-final/restore-evidence/metadata.after

namei -l /srv/part3-final/data/config.ini
namei -l /srv/part3-final/data/inventory.csv

config.ini|ops|ops|440|47
inventory.csv|ops|ops|440|33
--- diff (before vs after)
--- /srv/part3-final/restore-evidence/metadata.before  2026-08-10 00:10:03.327000000 +0900
+++ /srv/part3-final/restore-evidence/metadata.after   2026-08-10 00:17:17.499000000 +0900
@@ -1,2 +1,2 @@
-config.ini|ops|part3ops|640|47
-inventory.csv|ops|part3ops|640|33
+config.ini|ops|ops|440|47
+inventory.csv|ops|ops|440|33
diff: 差分あり(exit=1)

f: /srv/part3-final/data/config.ini
drwxr-xr-x root root     /
drwxr-xr-x root root     srv
drwxr-s--- ops  part3ops part3-final
dr-xr-x--- ops  part3ops data
-r--r----- ops  ops      config.ini

sudo systemctl stop part3-final.service
sudo systemctl reset-failed part3-final.service

# ディレクトリを先に戻す（setgid を含む）
sudo chown -R ops:part3ops /srv/part3-final/data
sudo chmod 2750 /srv/part3-final/data

# metadata.before を 1 行ずつ読んで、ファイルごとに戻す
while IFS='|' read -r name owner group mode size; do
  [ -n "$name" ] || continue
  sudo chown "${owner}:${group}" "/srv/part3-final/data/${name}"
  sudo chmod "0${mode}" "/srv/part3-final/data/${name}"
done < /srv/part3-final/restore-evidence/metadata.before

restored: config.ini -> ops:part3ops 0640
restored: inventory.csv -> ops:part3ops 0640

config.ini|ops|part3ops|640|47
inventory.csv|ops|part3ops|640|33
diff: 差分なし ✅
drwxr-s--- ops  part3ops part3-final
drwxr-s--- ops  part3ops data
-rw-r----- ops  part3ops config.ini

sudo -u part3svc /usr/local/sbin/part3-final-validate
sudo systemctl start part3-final.service
systemctl is-enabled part3-final.service
systemctl is-active part3-final.service
systemctl show part3-final.service \
  -p ActiveState -p SubState -p NRestarts

validate: OK ✅
start: OK
enabled
active
NRestarts=0
ActiveState=active
SubState=running

sudo journalctl -u part3-final.service \
  --since '10 minutes ago' --no-pager
date -u

 8月 10 00:15:29 learner01 systemd[1]: part3-final.service: Scheduled restart job, restart counter is at 13.
 8月 10 00:17:17 learner01 part3-final-validate[3491]: health=failed missing_or_unreadable=config.ini
 8月 10 00:17:17 learner01 systemd[1]: Failed to start part3-final.service - Part 3 final backup and restore lab service.
…（略）
 8月 10 00:19:13 learner01 systemd[1]: Started part3-final.service - Part 3 final backup and restore lab service.
 8月 10 00:19:13 learner01 part3-final-service[3695]: health=ok readable_files=2