272 lines
11 KiB
Bash
Executable File
272 lines
11 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# dolibarr-backup.sh — dedicated, offsite backup for the Arcodange Dolibarr ERP.
|
|
#
|
|
# Critical-data-aware (10-year accounting retention) and INDEPENDENT of the generic
|
|
# Longhorn platform backup — which today does NOT cover the erp volume (its volume
|
|
# sits in the orphaned `default` recurring-job group, lastBackupAt=never). Backs up
|
|
# BOTH halves of Dolibarr state to the existing object store (s3://arcodange-backup
|
|
# on GCS), under erp/<env>/:
|
|
# - the Postgres DB (pg_dump -Fc, restorable) -> erp/<env>/db/<ts>.dump
|
|
# - the documents PVC (/var/www/documents, RWX, ro) -> erp/<env>/docs/<ts>.tar.gz
|
|
# then prunes to a tiered retention: daily 30d, monthly 12m, yearly 10y.
|
|
#
|
|
# Safety, mirroring ops/sandbox/sandbox-lifecycle.sh:
|
|
# - the DB is read with the app's OWN dynamic creds (vso-db-credentials), scoped
|
|
# to its env; prod and sandbox never cross.
|
|
# - S3 creds are a TRANSIENT copy of the Longhorn GCS secret (deleted on exit);
|
|
# no secret value is ever printed.
|
|
# - the whole in-container script is shipped base64 (no nested-heredoc/quoting).
|
|
#
|
|
# Usage:
|
|
# dolibarr-backup.sh backup [--env prod|sandbox] # one-shot backup + prune
|
|
# dolibarr-backup.sh list [--env prod|sandbox] # what's in the store
|
|
# dolibarr-backup.sh restore --db <key> --env <e> --yes # restore DB (DESTRUCTIVE)
|
|
# dolibarr-backup.sh restore --docs <key> --env <e> --yes # restore documents
|
|
#
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
PG_IMAGE="postgres:16-alpine"
|
|
PGHOST="192.168.1.202" # direct Postgres (NOT pgbouncer)
|
|
BUCKET="${ARCO_BACKUP_BUCKET:-arcodange-backup}"
|
|
S3_SRC_NS="longhorn-system" # where the GCS HMAC creds live today
|
|
S3_SRC_SECRET="longhorn-gcs-backup-credentials"
|
|
TMP_S3_SECRET="dolibarr-backup-s3-temp"
|
|
|
|
log() { printf '\033[1;36m==>\033[0m %s\n' "$*"; }
|
|
die() { printf '\033[1;31mABORT:\033[0m %s\n' "$*" >&2; exit 1; }
|
|
|
|
# --- garde de cluster -------------------------------------------------------
|
|
# Ce script lit des secrets, crée des Jobs et peut RESTAURER une base. Lancé sur
|
|
# le mauvais contexte kubectl, il part sur l'infrastructure de quelqu'un d'autre.
|
|
# Le contexte courant d'une station de travail n'est pas une garantie : il suffit
|
|
# d'un `K config use-context` oublié. On l'épingle donc, et on vérifie une
|
|
# empreinte POSITIVE du homelab avant d'agir — mêmes garde-fous que
|
|
# ops/sandbox/sandbox-lifecycle.sh.
|
|
ERP_KUBE_CONTEXT="${ERP_KUBE_CONTEXT:-default}"
|
|
K() { kubectl --context "$ERP_KUBE_CONTEXT" "$@"; }
|
|
|
|
assert_arcodange_cluster() {
|
|
kubectl config get-contexts -o name 2>/dev/null | grep -qx "$ERP_KUBE_CONTEXT" \
|
|
|| die "kube-context '$ERP_KUBE_CONTEXT' n'existe pas (définir ERP_KUBE_CONTEXT)"
|
|
for ns in erp erp-sandbox "$S3_SRC_NS"; do
|
|
K get ns "$ns" >/dev/null 2>&1 \
|
|
|| die "le contexte '$ERP_KUBE_CONTEXT' n'a pas de namespace '$ns' — refus de s'y exécuter.
|
|
Ce script lit des secrets et peut restaurer une base ; il ne doit viser que le homelab Arcodange.
|
|
Contexte courant : '$(kubectl config current-context 2>/dev/null)'.
|
|
Définir ERP_KUBE_CONTEXT sur le contexte du homelab et réessayer."
|
|
done
|
|
log "garde de cluster OK — contexte '$ERP_KUBE_CONTEXT' (namespaces erp/erp-sandbox/$S3_SRC_NS)"
|
|
}
|
|
|
|
CMD="${1:-}"; shift || true
|
|
ENV="prod"; KEY=""; KIND=""; YES=0
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--env) ENV="${2:?}"; shift 2 ;;
|
|
--db) KIND="db"; KEY="${2:?}"; shift 2 ;;
|
|
--docs) KIND="docs"; KEY="${2:?}"; shift 2 ;;
|
|
--yes) YES=1; shift ;;
|
|
*) die "unknown arg '$1'" ;;
|
|
esac
|
|
done
|
|
|
|
case "$ENV" in
|
|
prod) NS="erp"; DB="erp"; OWNER_ROLE="erp_role" ;;
|
|
sandbox) NS="erp-sandbox"; DB="erp-sandbox"; OWNER_ROLE="erp_sandbox_role" ;;
|
|
*) die "--env must be prod|sandbox" ;;
|
|
esac
|
|
PVC="$NS"
|
|
PREFIX="${ARCO_BACKUP_PREFIX:-erp/${ENV}}"
|
|
|
|
# in-container preamble: install tools, export region, define S3()
|
|
read -r -d '' PREAMBLE <<'SH' || true
|
|
set -eu
|
|
apk add --no-cache aws-cli tar gzip >/dev/null 2>&1 || { echo "ABORT apk add"; exit 1; }
|
|
export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"
|
|
# GCS / S3-compatible stores reject aws-cli v2.23+ default integrity checksums
|
|
# ("SignatureDoesNotMatch / Invalid argument"); only sign/validate when required.
|
|
export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
|
|
export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
|
|
aws --version 2>&1 | head -1
|
|
S3() { aws --endpoint-url "$AWS_ENDPOINTS" s3 "$@"; }
|
|
SH
|
|
|
|
copy_s3_secret() {
|
|
command -v python3 >/dev/null || die "python3 required to copy the S3 secret without exposing it"
|
|
K get secret "$S3_SRC_SECRET" -n "$S3_SRC_NS" -o json \
|
|
| python3 -c "import json,sys; d=json.load(sys.stdin); d['metadata']={'name':'$TMP_S3_SECRET','namespace':'$NS'}; d.pop('status',None); d['data']={k:d['data'][k] for k in ('AWS_ACCESS_KEY_ID','AWS_SECRET_ACCESS_KEY','AWS_ENDPOINTS')}; print(json.dumps(d))" \
|
|
| K apply -f - >/dev/null
|
|
}
|
|
cleanup_secret() { K delete secret "$TMP_S3_SECRET" -n "$NS" --ignore-not-found >/dev/null 2>&1 || true; }
|
|
|
|
# b64-encode an in-container script (host vars already substituted by the caller)
|
|
b64() { printf '%s' "$1" | base64 | tr -d '\n'; }
|
|
|
|
run_backup() {
|
|
trap cleanup_secret EXIT
|
|
log "Copying GCS creds into a transient secret in $NS (values stay base64)"
|
|
copy_s3_secret
|
|
log "Backup ${ENV}: DB=$DB PVC=$PVC -> s3://$BUCKET/$PREFIX/{db,docs}/"
|
|
local B64; B64="$(b64 "$(cat "${SCRIPT_DIR}/../../chart/files/backup-job.sh")")"
|
|
K delete job dolibarr-backup -n "$NS" --ignore-not-found >/dev/null 2>&1 || true
|
|
K apply -f - >/dev/null <<EOF
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata: { name: dolibarr-backup, namespace: $NS }
|
|
spec:
|
|
backoffLimit: 0
|
|
ttlSecondsAfterFinished: 600
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
volumes:
|
|
- name: docs
|
|
persistentVolumeClaim: { claimName: $PVC, readOnly: true }
|
|
containers:
|
|
- name: backup
|
|
image: $PG_IMAGE
|
|
envFrom:
|
|
- secretRef: { name: $TMP_S3_SECRET }
|
|
env:
|
|
- { name: BUCKET, value: "$BUCKET" }
|
|
- { name: PREFIX, value: "$PREFIX" }
|
|
- { name: DB, value: "$DB" }
|
|
- { name: PGHOST, value: "$PGHOST" }
|
|
- { name: PGUSER, valueFrom: { secretKeyRef: { name: vso-db-credentials, key: username } } }
|
|
- { name: PGPASSWORD, valueFrom: { secretKeyRef: { name: vso-db-credentials, key: password } } }
|
|
volumeMounts:
|
|
- { name: docs, mountPath: /docs, readOnly: true }
|
|
command: ["/bin/sh","-c"]
|
|
args: ["echo $B64 | base64 -d | sh"]
|
|
EOF
|
|
K wait --for=condition=complete job/dolibarr-backup -n "$NS" --timeout=300s >/dev/null 2>&1 \
|
|
|| die "backup Job did not complete — K logs -n $NS job/dolibarr-backup"
|
|
K logs -n "$NS" job/dolibarr-backup | sed 's/^/ /'
|
|
K delete job dolibarr-backup -n "$NS" --ignore-not-found >/dev/null 2>&1 || true
|
|
cleanup_secret; trap - EXIT
|
|
log "Backup complete."
|
|
}
|
|
|
|
run_list() {
|
|
trap cleanup_secret EXIT; copy_s3_secret
|
|
local SCRIPT
|
|
SCRIPT="$(cat <<EOF
|
|
$PREAMBLE
|
|
echo "db/:"; S3 ls "s3://$BUCKET/$PREFIX/db/" || echo " (empty)"
|
|
echo "docs/:"; S3 ls "s3://$BUCKET/$PREFIX/docs/" || echo " (empty)"
|
|
EOF
|
|
)"
|
|
K delete job dolibarr-backup-list -n "$NS" --ignore-not-found >/dev/null 2>&1 || true
|
|
K apply -f - >/dev/null <<EOF
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata: { name: dolibarr-backup-list, namespace: $NS }
|
|
spec:
|
|
backoffLimit: 0
|
|
ttlSecondsAfterFinished: 300
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: list
|
|
image: $PG_IMAGE
|
|
envFrom: [ { secretRef: { name: $TMP_S3_SECRET } } ]
|
|
command: ["/bin/sh","-c"]
|
|
args: ["echo $(b64 "$SCRIPT") | base64 -d | sh"]
|
|
EOF
|
|
K wait --for=condition=complete job/dolibarr-backup-list -n "$NS" --timeout=180s >/dev/null 2>&1 || true
|
|
K logs -n "$NS" job/dolibarr-backup-list 2>/dev/null | sed 's/^/ /'
|
|
K delete job dolibarr-backup-list -n "$NS" --ignore-not-found >/dev/null 2>&1 || true
|
|
cleanup_secret; trap - EXIT
|
|
}
|
|
|
|
# restore a half from a stored key. DESTRUCTIVE: scales the app to 0, replaces the
|
|
# DB (DROP OWNED BY <owner> CASCADE + pg_restore) or the documents (clear + untar),
|
|
# then scales back. Mirrors ops/sandbox/sandbox-lifecycle.sh's reset mechanics.
|
|
run_restore() {
|
|
trap cleanup_secret EXIT
|
|
copy_s3_secret
|
|
local DEPLOY="$NS" # release/instance name == namespace (erp / erp-sandbox)
|
|
log "Restore ${KIND} on '${ENV}' from ${KEY} (scaling ${DEPLOY} to 0)"
|
|
K scale deploy "$DEPLOY" -n "$NS" --replicas=0 >/dev/null 2>&1 || true
|
|
K wait --for=delete pod -l app.kubernetes.io/instance="$NS" -n "$NS" --timeout=120s >/dev/null 2>&1 || true
|
|
|
|
local SCRIPT VOLS="[]" MOUNTS="[]"
|
|
if [[ "$KIND" == "db" ]]; then
|
|
SCRIPT="$(cat <<EOF
|
|
$PREAMBLE
|
|
S3 cp "s3://$BUCKET/$PREFIX/db/$KEY" /tmp/r.dump
|
|
echo "fetched \$(wc -c < /tmp/r.dump) bytes"
|
|
psql -h "$PGHOST" -U "\$PGUSER" -d "$DB" -v ON_ERROR_STOP=1 -c "DROP OWNED BY $OWNER_ROLE CASCADE;"
|
|
pg_restore -h "$PGHOST" -U "\$PGUSER" -d "$DB" --no-owner --role=$OWNER_ROLE /tmp/r.dump \\
|
|
&& echo "RESTORED db" || echo "restored db (ignorable warnings)"
|
|
EOF
|
|
)"
|
|
else
|
|
VOLS="
|
|
- name: docs
|
|
persistentVolumeClaim: { claimName: ${PVC} }"
|
|
MOUNTS="
|
|
- { name: docs, mountPath: /docs }"
|
|
SCRIPT="$(cat <<EOF
|
|
$PREAMBLE
|
|
S3 cp "s3://$BUCKET/$PREFIX/docs/$KEY" /tmp/r.tgz
|
|
echo "fetched \$(wc -c < /tmp/r.tgz) bytes"
|
|
rm -rf /docs/* 2>/dev/null || true
|
|
tar -C /docs -xzf /tmp/r.tgz && echo "RESTORED docs"
|
|
EOF
|
|
)"
|
|
fi
|
|
local B64; B64="$(b64 "$SCRIPT")"
|
|
K delete job dolibarr-restore -n "$NS" --ignore-not-found >/dev/null 2>&1 || true
|
|
K apply -f - >/dev/null <<EOF
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata: { name: dolibarr-restore, namespace: $NS }
|
|
spec:
|
|
backoffLimit: 0
|
|
ttlSecondsAfterFinished: 600
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
volumes: ${VOLS}
|
|
containers:
|
|
- name: restore
|
|
image: $PG_IMAGE
|
|
envFrom:
|
|
- secretRef: { name: $TMP_S3_SECRET }
|
|
env:
|
|
- { name: PGUSER, valueFrom: { secretKeyRef: { name: vso-db-credentials, key: username } } }
|
|
- { name: PGPASSWORD, valueFrom: { secretKeyRef: { name: vso-db-credentials, key: password } } }
|
|
volumeMounts: ${MOUNTS}
|
|
command: ["/bin/sh","-c"]
|
|
args: ["echo $B64 | base64 -d | sh"]
|
|
EOF
|
|
if ! K wait --for=condition=complete job/dolibarr-restore -n "$NS" --timeout=300s >/dev/null 2>&1; then
|
|
K logs -n "$NS" job/dolibarr-restore 2>&1 | sed 's/^/ /'
|
|
K scale deploy "$DEPLOY" -n "$NS" --replicas=1 >/dev/null 2>&1 || true
|
|
die "restore Job did not complete"
|
|
fi
|
|
K logs -n "$NS" job/dolibarr-restore | sed 's/^/ /'
|
|
K delete job dolibarr-restore -n "$NS" --ignore-not-found >/dev/null 2>&1 || true
|
|
log "Scaling ${DEPLOY} back to 1"
|
|
K scale deploy "$DEPLOY" -n "$NS" --replicas=1 >/dev/null 2>&1 || true
|
|
cleanup_secret; trap - EXIT
|
|
log "Restore complete."
|
|
}
|
|
|
|
assert_arcodange_cluster
|
|
|
|
case "$CMD" in
|
|
backup) run_backup ;;
|
|
list) run_list ;;
|
|
restore)
|
|
[[ -n "$KEY" && -n "$KIND" ]] || die "restore needs --db <key> or --docs <key>"
|
|
[[ "$YES" == "1" ]] || die "restore is DESTRUCTIVE on '$ENV' — re-run with --yes"
|
|
run_restore
|
|
;;
|
|
*) echo "usage: $0 {backup|list|restore} [--env prod|sandbox] [--db|--docs <key>] [--yes]" >&2; exit 2 ;;
|
|
esac
|