container-openvpn/docs/backup.md

# Backing Up Configuration and Certificates

## Security

The resulting archive from this back-up contains all credential to impersonate the server at a minimum.  If the client private keys are generated using the EasyRSA utility then it also contains the client certificates that could be used to impersonate said clients.  Most importantly, if the certificate authority key is in this archive (as it is given the quick start directions), then a adversary could generate certificates at will.

I'd recommend encrypting the archive with something strong (e.g. gpg or openssl + AES).  For the paranoid keep backup offline.  For the truly paranoid users, never keep any keys (i.e. client and certificate authority) in the docker container to begin with :).


TL;DR Protect the resulting archive file, by ensure there is very limited access to it.

## Backup to Archive

    docker run --volumes-from openvpn-data --rm busybox tar -cvf - -C /etc openvpn | xz > openvpn-backup.tar.xz

## Retore to New Image

    xzcat openvpn-backup.tar.xz | docker run --name openvpn-data -v /etc/openvpn -i busybox tar -xvf - -C /etc
docs: Add backup documentation * Brain dump on ways to backup the docker volume container for peace of mind. 2014-06-30 16:19:36 +00:00			`# Backing Up Configuration and Certificates`

			`## Security`

			`The resulting archive from this back-up contains all credential to impersonate the server at a minimum. If the client private keys are generated using the EasyRSA utility then it also contains the client certificates that could be used to impersonate said clients. Most importantly, if the certificate authority key is in this archive (as it is given the quick start directions), then a adversary could generate certificates at will.`

			`I'd recommend encrypting the archive with something strong (e.g. gpg or openssl + AES). For the paranoid keep backup offline. For the truly paranoid users, never keep any keys (i.e. client and certificate authority) in the docker container to begin with :).`


			`TL;DR Protect the resulting archive file, by ensure there is very limited access to it.`

backup: Add restore step * Add restore step * Use lzma compression since we're in the 2010's 2014-07-06 07:11:27 +00:00			`## Backup to Archive`
docs: Add backup documentation * Brain dump on ways to backup the docker volume container for peace of mind. 2014-06-30 16:19:36 +00:00
backup: Add restore step * Add restore step * Use lzma compression since we're in the 2010's 2014-07-06 07:11:27 +00:00			`docker run --volumes-from openvpn-data --rm busybox tar -cvf - -C /etc openvpn \| xz > openvpn-backup.tar.xz`

			`## Retore to New Image`

			`xzcat openvpn-backup.tar.xz \| docker run --name openvpn-data -v /etc/openvpn -i busybox tar -xvf - -C /etc`