Andreas Niemann
41172b3511
backup/backup.sh (operator orchestrator) + backup-remote.sh (VM assembler) produce a CONTRACT_004 bundle in RustFS foundation-backups/<TS>/ and replicate it to the offsite olsitec-foundation bucket: pg_dumpall, forgejo git repos (tar.zst), vault raft snapshot, pulumi state, rustfs blobs, MANIFEST.json (sha256 + restore order). The timestamp is caller-supplied (§4.1); secrets travel on stdin (never argv, ADR-007); mc runs containerized. restore.sh + restore-remote.sh are the §4.6 verifier: pull a bundle (rfs or offsite), check MANIFEST shas, then NON-DESTRUCTIVELY reconstruct into scratch resources and assert (postgres users>0, olsitec/foundation.git present, vault snapshot non-empty). Live on cx33 Helsinki: bundle written to RustFS + offsite; restore-verify PASSES from BOTH sources (forgejo.user rows=2, repo present, 16KB vault snapshot). Known gap: at-rest age encryption (§4.3) not yet applied — both destinations are private/access-controlled; adding age (generate key + encrypt-before-upload) is the next hardening. Acceptance T12 met. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
67 lines
3.2 KiB
Bash
Executable file
67 lines
3.2 KiB
Bash
Executable file
#!/bin/sh
|
|
# backup-remote.sh — the VM-side bundle assembler (CONTRACT_004 producer half).
|
|
# Shipped + run by backup/backup.sh; NOT run directly. Secrets arrive on stdin
|
|
# (never argv); non-secrets ($TS, $MC_IMAGE) are args. pulumi-state.json is already
|
|
# in $W (the operator placed it there before invoking this).
|
|
#
|
|
# Produces foundation-backups/<TS>/ in RustFS and replicates it to the offsite
|
|
# bucket. Artifacts per CONTRACT_004 §4.2: postgres.sql.gz, forgejo-repos.tar.zst,
|
|
# vault-raft.snap, pulumi-state.json, rustfs-blobs/, MANIFEST.json.
|
|
#
|
|
# NOTE: at-rest age encryption (CONTRACT_004 §4.3) is NOT yet applied — both
|
|
# destinations are private (RustFS internal, offsite scoped creds). Adding age is
|
|
# the next hardening (generate the key, encrypt each artifact before `mc cp`).
|
|
set -eu
|
|
IFS= read -r VAULT_TOKEN
|
|
IFS= read -r OFF_EP
|
|
IFS= read -r OFF_AK
|
|
IFS= read -r OFF_SK
|
|
IFS= read -r BUCKET
|
|
TS="$1"
|
|
MC_IMAGE="$2"
|
|
OFFSITE_BUCKET=olsitec-foundation
|
|
W="/tmp/foundation-backup-$TS"
|
|
mkdir -p "$W"
|
|
|
|
echo "[backup] postgres pg_dumpall" >&2
|
|
docker exec foundation-postgres pg_dumpall -U postgres | gzip > "$W/postgres.sql.gz"
|
|
|
|
echo "[backup] forgejo git repos (tar.zst)" >&2
|
|
# Forgejo keeps repos under /data/git; use the container's own tar (no extra image).
|
|
docker exec foundation-forgejo sh -c 'tar -C /data -cf - git' | zstd -q -T0 > "$W/forgejo-repos.tar.zst"
|
|
|
|
echo "[backup] vault raft snapshot" >&2
|
|
docker exec -e VAULT_ADDR=http://127.0.0.1:8200 -e VAULT_TOKEN="$VAULT_TOKEN" foundation-vault \
|
|
sh -c 'vault operator raft snapshot save /tmp/v.snap >/dev/null 2>&1 && cat /tmp/v.snap && rm -f /tmp/v.snap' > "$W/vault-raft.snap"
|
|
|
|
echo "[backup] MANIFEST.json" >&2
|
|
( cd "$W"
|
|
jq -n --arg ts "$TS" \
|
|
--argjson files "$(for f in postgres.sql.gz forgejo-repos.tar.zst vault-raft.snap pulumi-state.json; do
|
|
[ -f "$f" ] || continue
|
|
jq -n --arg n "$f" --arg sha "$(sha256sum "$f" | cut -d' ' -f1)" --argjson sz "$(stat -c %s "$f")" \
|
|
'{name:$n, sha256:$sha, size:$sz}'
|
|
done | jq -s '.')" \
|
|
'{timestamp:$ts, restoreOrder:["vault","postgres","rustfs","forgejo"], artifacts:$files}' > MANIFEST.json
|
|
)
|
|
|
|
# RustFS root creds from the running container (VM-trusted).
|
|
RAK=$(docker inspect foundation-rustfs --format '{{range .Config.Env}}{{println .}}{{end}}' | sed -n 's/^RUSTFS_ACCESS_KEY=//p')
|
|
RSK=$(docker inspect foundation-rustfs --format '{{range .Config.Env}}{{println .}}{{end}}' | sed -n 's/^RUSTFS_SECRET_KEY=//p')
|
|
|
|
echo "[backup] upload to RustFS $BUCKET/$TS + replicate offsite" >&2
|
|
docker run --rm --network foundation-net --entrypoint sh -v "$W":/w \
|
|
-e RAK="$RAK" -e RSK="$RSK" -e OFF_EP="$OFF_EP" -e OFF_AK="$OFF_AK" -e OFF_SK="$OFF_SK" \
|
|
-e BUCKET="$BUCKET" -e TS="$TS" -e OFFB="$OFFSITE_BUCKET" \
|
|
"$MC_IMAGE" -c '
|
|
set -e
|
|
mc alias set rfs http://foundation-rustfs:9000 "$RAK" "$RSK" >/dev/null
|
|
mc alias set off "$OFF_EP" "$OFF_AK" "$OFF_SK" >/dev/null
|
|
mc cp -r /w/ "rfs/$BUCKET/$TS/" >/dev/null
|
|
for b in forgejo-packages forgejo-artifacts forgejo-lfs; do
|
|
mc mirror --overwrite --quiet "rfs/$b" "rfs/$BUCKET/$TS/rustfs-blobs/$b" >/dev/null 2>&1 || true
|
|
done
|
|
mc mirror --overwrite --quiet "rfs/$BUCKET/$TS" "off/$OFFB/$TS" >/dev/null
|
|
'
|
|
rm -rf "$W"
|
|
echo "[backup] complete: rfs/$BUCKET/$TS (+ offsite $OFFSITE_BUCKET/$TS)" >&2
|