automatic backup with proxmox

This was such a pain in the ass to find... but this is obviously a noob problem.  The steps:

1. Click the "Datacenter" root of the tree on the left of the UI.  Doesn't matter what view you have selected.  Right where this giant-ass red arrow is pointed:

2. Next, click the "Backup" tab.  Not sure what else you'd do at this point.  Look for the huge red arrow again:

3. Now click "Add".  Another enormous arrow points the way:

4. Now you get a fairly self-explanatory popup for configuring your automatic backups.  No arrows this time :(

5. Some potential sticking points on the backup form:
1. If you have no options under "Storage", you need to set up some storage other than the Proxmox boot disk.  Google around for it, I don't have any big-ass arrow-covered guides for that.
2. The mode you choose matters: 
1. "Snapshot" is not a real backup - if your VM server's disk craps out and you want to restore from backups, you'll be SOL if you chose snapshots.
2. "Stop" is the mode I use - while the backup is happening, the VM will not be running, but you get the entire state of the VM into the backup, which makes it a real backup.  On my Xeon E3-1250 (v1 or v2) with several dozen GB disks, this takes an extremely small amount of time, and I'm using the best compression as well.  If you have giant VMs or otherwise really care about performance, you may want to investigate further.
3. "Suspend" is identical to "Stop" for folks using KVM (VMs).  It differs only for the poor bastards who chose the HD-DVD of virtualization technologies, OpenVZ.  (If you're one of those poor bastards, get out as soon as possible - they're chopping OpenVZ support out of newer versions of Proxmox.  Your pain is my gain, because this allows Proxmox to move away from than ancient 2.6 kernel!)

getting inside a VM disk image

Have a VM disk image that you need to pull a few files from, but you don't want to spin it up into a VM?  Here's the simplest way I've found to get at the files inside it:

First, convert whatever format it's in to .raw using qemu-img - you'll need a good bit of disk space for this to work.  If your source virtual disk is a qcow2, for example, the command might look like this:

me@box$ qemu-img convert -f qcow2 -O raw var/lib/libvirt/images/own.qcow2 /mnt/thevault/everything/backups/own.raw

Then find the offset of the primary partition inside the image with fdisk:

me@box$ fdisk -l /mnt/thevault/everything/backups/own.raw

Disk /mnt/thevault/everything/backups/own.raw: 21.5 GB, 21474836480 bytes
255 heads, 63 sectors/track, 2610 cylinders, total 41943040 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0008fa87

                                      Device Boot      Start         End      Blocks   Id  System
/mnt/thevault/everything/backups/own.raw1   *        2048    40136703    20067328   83  Linux
/mnt/thevault/everything/backups/own.raw2        40138750    41940991      901121    5  Extended
/mnt/thevault/everything/backups/own.raw5        40138752    41940991      901120   82  Linux swap / Solaris

The partition we are interested in is raw1, the Linux (type 83) partition.  If you installed Debian on the disk and went with standard default partitioning options, putting everything under / in the same partition, yours will be the same.

Pull your unit size from the output as well, which in this case is 512 bytes, and then multiply that by the start sector (2048) to get 1048576.

Now we mount the .img file as a loopback device, starting with our calculated offset:

me@box$ mount -o loop,offset=1048576 /mnt/thevault/everything/backups/own.raw /mnt/own

And now you can access your files inside the old VM disk!  Don't forget to clean up, now.

running an openvpn server from home

After beating down my sysadmin ego by pouring days into alternate setups, I finally got an OpenVPN server running exactly as I wanted it on my home network.  If you need complete(-ish) local network access from remote devices, want to run it in a virtual environment, and only want to expose the single VPN port, here's how to do it.  Note that some of these steps assume you're using a VM server on the LAN running qemu-kvm, and your local machine connects to it with virt-manager.

    1. Download the i386 LiveCD w/ Installer pfsense image to your server.

root@server $ wget https://www.pfsense.org/download/download.php?url=http%3A%2F%2Ffiles.bgn.pfsense.org%2Fmirror%2Fdownloads%2FpfSense-LiveCD-2.1.2-RELEASE-i386.iso.gz

root@server $ mv download.php?url=http%3A%2F%2Ffiles.bgn.pfsense.org%2Fmirror%2Fdownloads%2FpfSense-LiveCD-2.1.2-RELEASE-i386.iso.gz /var/lib/libvirt/images/pfSense-LiveCD-2.1.2-RELEASE-i386.iso.gz

    2. Spin up the VM with pfsense.

lol@workstation $ virt-manager &

Connect to the server and make a new VM.  Choose local install media -> iso image -> choose the pfsense image.  OS type=UNIX, Version should autodetect to FreeBSD 8.x.  512MB RAM and a single core has been plenty for me, if my host gets strapped I'll probably drop the pfsense guest down to 256 and see how it does.  5GB hard disk is more than enough also.

Once the VM comes up, choosing all defaults is fine for installation.  Once the ncurses install is complete, the configurator will ask for the primary network interface, or try to do some kind of autodetection.  We created the VM with the default single interface because there is upstream DHCP coming from the home router and we're only using pfsense for the OpenVPN features, so the answer to the interface question is probably "em0".  Choose sensible options for everything else.

Note that after you choose what hostname pfsense will tell the upstream DHCP server, you will likely get a new IP after reboot, so check your DHCP logs for what the new IP is.

    3. Use this youtube video to configure the OpenVPN server.

I think I did everything exactly the same as the guy in the video, except I chose max key lengths, a longer AES cipher, and 9999 days for everything.  Stop when he gets to the client export/configuration part.

Make sure the "Local network" option is set to your local subnet, and the IPv4 tunnel network" option is NOT set to your local subnet.  Not sure why the guy in the video used 192.168.2.0/24; I chose 10.0.0.0/24 since it's also designated for private networks and it's way more visible at a glance.

    4. Open the port on your router.

My router (a D-Link DIR-655) has a "virtual servers" option, which is like port forwarding on steroids.  Either way, this part is simple - make sure UDP port 1194 is open and points to your pfsense server.  It's probably a good idea to make sure the pfsense VM has a static IP at this point too.

    5. Set up dynamic DNS pointing at your house.

pfsense comes with clients for many free dynamic DNS services - I'm using no-ip.com.  Make an account and grab some trashy xxx.no-ip.biz domain.  In pfsense, go to services -> dynamic DNS and add your account.  Super simple, now your no-ip subdomain will always point at your house no matter how often your ISP changes your WAN IP.

    6. Make the Android client work.

The OpenVPN Connect app worked on the first try for me, and it's free, small, has few permissions and has a clean interface.  Plug your phone into the computer you're checking out pfsense on, then in the pfsense web UI go to VPN -> OpenVPN -> Client Export.  This will only be there if you installed the "export" package from the youtube video.

Make sure to choose the DynDNS option for your domain under Host name resolution.  If it isn't there for some reason, or if you don't want to run the dynamic DNS client on pfsense or whatever, just choose "other" and enter the domain manually there.

At the bottom, under the "Client Install Packages" section, click the "OpenVPN Connect (iOS/Android)" link.  The downloaded .ovpn file has "iOS" in the name, but don't worry about that.  Copy that file to your phone's storage (SD or onboard).  Pull up the OpenVPN app, choose Menu (the vertical ellipsis (...) button) ->Import Profile from SD card -> enter your username and password, and boom!  It should just work.

EDIT FOR T-MOBILE USERS: It just worked when I was on Verizon, because they're a lumbering behemoth and are still using IPv4 everyplace - if you're on T-Mobile, you'll need to follow a substep that I wrote up here.

    7. Make the Linux (NetworkManager) client work.

From the same client export page that we used in the last step, under the "Client Install Packages" section, click the "Standard Configurations: Archive" link.  Unzip the downloaded file somewhere in your home directory - default permissions were not cool, so take away everything but rx on the dir for owner, and just r for the owner on the files inside:

lol@vpnclient $ mv downloads/vpn-files.zip vpn-stuff/

lol@vpnclient $ unzip vpn-files.zip

lol@vpnclient $ sudo chmod -Rc a-rwx vpn-files

lol@vpnclient $ sudo chmod -Rc u+rx vpn-files

lol@vpnclient $ sudo chmod -c u-x vpn-files/*

(The chmod steps in the above are optional.  I know it could have been done more succinctly, but I don't typically use masks for chmod - of course I'm familiar with 0777, 0655 etc, but for non-standard permissions sets they seem obfuscating.  In ten years they probably won't, but I'm just not there yet.)

Click Network Manager icon -> VPN connections -> Configure VPN -> Import -> Choose the unzipped .ovpn file.  Everything except username and the two password boxes should be filled in, enter the user credentials you chose on pfsense and enter the same password again for the "private key password".  The three file pickers were all pointed at the same .p12 file - this is ok.

Remember that weird stuff might happen if you try to connect to the VPN while the client is already attached to the network you're attaching to.  To test, I just shut down the Android VPN client, created a wifi hotspot with my phone, attached to that with my laptop, and then connected just the laptop to the home VPN.

Hope it works for you!