tegwick
a689270f18
Document OpenBao/warden paths for the offsite backup lane and flag the sealed Vault blocker. Point production Makefile targets at CoulombCore, auto-discover CNPG clusters in backup status, add apps-pg pg_dump dry-run tooling, and record Core Hub Helm cutover findings (live gitea image, adopt required).
66 lines
No EOL
2.2 KiB
Bash
Executable file
66 lines
No EOL
2.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Phase 1 logical backup for apps-pg consumer databases (Option A lane).
|
|
# Encrypts locally with age; Nextcloud upload requires OpenBao offsite-lane creds.
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
PLATFORM_REPO="${PLATFORM_REPO:-$HOME/railiance-platform}"
|
|
COMMON_SH="${PLATFORM_REPO}/lib/railiance-backup-common.sh"
|
|
|
|
APPS_PG_NAMESPACE="${APPS_PG_NAMESPACE:-databases}"
|
|
APPS_PG_CLUSTER="${APPS_PG_CLUSTER:-apps-pg}"
|
|
APPS_PG_POD="${APPS_PG_POD:-}"
|
|
APPS_PG_DATABASE="${APPS_PG_DATABASE:-vergabe_db}"
|
|
BACKUP_DIR="${BACKUP_DIR:-$HOME/.cache/railiance/backups/apps-pg}"
|
|
DRY_RUN="${RAILIANCE_BACKUP_DRY_RUN:-1}"
|
|
|
|
if [[ ! -f "$COMMON_SH" ]]; then
|
|
echo "ERROR: missing ${COMMON_SH}" >&2
|
|
exit 1
|
|
fi
|
|
# shellcheck source=/dev/null
|
|
source "$COMMON_SH"
|
|
|
|
railiance_backup_require_tools
|
|
mkdir -p "$BACKUP_DIR"
|
|
|
|
if [[ -z "$APPS_PG_POD" ]]; then
|
|
APPS_PG_POD="$(
|
|
kubectl get pods -n "$APPS_PG_NAMESPACE" \
|
|
-l "cnpg.io/cluster=${APPS_PG_CLUSTER},role=primary" \
|
|
-o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true
|
|
)"
|
|
fi
|
|
if [[ -z "$APPS_PG_POD" ]]; then
|
|
echo "ERROR: primary pod for ${APPS_PG_CLUSTER} not found in ${APPS_PG_NAMESPACE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
TS="$(date -u +%Y%m%dT%H%M%SZ)"
|
|
DB_PLAIN="${BACKUP_DIR}/apps-pg-${APPS_PG_DATABASE}-${TS}.dump"
|
|
DB_AGE="${DB_PLAIN}.age"
|
|
|
|
echo "apps-pg backup dry-run"
|
|
echo " cluster: ${APPS_PG_CLUSTER}"
|
|
echo " pod: ${APPS_PG_POD}"
|
|
echo " database:${APPS_PG_DATABASE}"
|
|
echo
|
|
|
|
kubectl exec -n "$APPS_PG_NAMESPACE" "$APPS_PG_POD" -c postgres -- \
|
|
pg_dump -U postgres -d "$APPS_PG_DATABASE" -Fc --no-owner --no-acl > "$DB_PLAIN"
|
|
echo "ok: pg_dump $(du -h "$DB_PLAIN" | awk '{print $1}')"
|
|
|
|
railiance_backup_encrypt "$DB_PLAIN" "$DB_AGE"
|
|
echo "ok: age encrypted $(basename "$DB_AGE")"
|
|
|
|
if [[ "$DRY_RUN" == "1" ]]; then
|
|
echo "ok: dry-run — skipping Nextcloud upload (OpenBao offsite-lane required)"
|
|
echo " Decrypt with ~/.config/age/railiance-backup.key"
|
|
exit 0
|
|
fi
|
|
|
|
railiance_backup_require_openbao_lane
|
|
RAILIANCE_BACKUP_NC_PREFIX="${RAILIANCE_BACKUP_NC_PREFIX:-apps-pg}"
|
|
railiance_backup_nc_upload "$DB_AGE" "apps-pg-${APPS_PG_DATABASE}-${TS}.dump.age"
|
|
railiance_backup_record_success "$BACKUP_DIR" "$TS"
|
|
echo "ok: uploaded apps-pg-${APPS_PG_DATABASE}-${TS}.dump.age" |