feat: backup cron

2026-08-13 14:20:28 +02:00
parent fd59e627cc
commit 334d94e712
8 changed files with 756 additions and 44 deletions
@@ -0,0 +1,122 @@
+#!/bin/sh
+set -eu
+
+umask 077
+
+require_variable() {
+    variable_name="$1"
+    eval "variable_value=\${$variable_name:-}"
+
+    if [ -z "$variable_value" ]; then
+        echo "$variable_name is required." >&2
+        exit 1
+    fi
+}
+
+aws_cli() {
+    endpoint="${BACKUP_S3_ENDPOINT:-${AWS_ENDPOINT:-}}"
+
+    if [ -n "$endpoint" ]; then
+        aws --endpoint-url "$endpoint" "$@"
+    else
+        aws "$@"
+    fi
+}
+
+for variable in \
+    AWS_ACCESS_KEY_ID \
+    AWS_DEFAULT_REGION \
+    AWS_SECRET_ACCESS_KEY \
+    BACKUP_S3_BUCKET \
+    DB_DATABASE \
+    DB_HOST \
+    DB_PASSWORD \
+    DB_USERNAME
+do
+    require_variable "$variable"
+done
+
+backup_directory="${BACKUP_DIRECTORY:-/backups}"
+backup_prefix="${BACKUP_S3_PREFIX:-database-backups/postgres}"
+backup_prefix="${backup_prefix#/}"
+backup_prefix="${backup_prefix%/}"
+backup_label="${1:-manual}"
+backup_label="$(printf "%s" "$backup_label" | tr -cd "A-Za-z0-9_-")"
+retention_days="${BACKUP_LOCAL_RETENTION_DAYS:-7}"
+timestamp="$(date -u +"%Y%m%dT%H%M%SZ")"
+database_name="$(printf "%s" "$DB_DATABASE" | tr -cd "A-Za-z0-9_-")"
+backup_name="${timestamp}-${database_name}-${backup_label:-manual}.dump"
+backup_path="$backup_directory/$backup_name"
+temporary_path="$backup_path.partial"
+checksum_path="$backup_path.sha256"
+lock_directory="/tmp/bowli-database-backup.lock"
+
+case "$retention_days" in
+    ""|*[!0-9]*)
+        echo "BACKUP_LOCAL_RETENTION_DAYS must be a positive integer." >&2
+        exit 1
+        ;;
+esac
+
+if ! mkdir "$lock_directory" 2>/dev/null; then
+    echo "Another database backup is already running." >&2
+    exit 1
+fi
+
+cleanup() {
+    rm -f "$temporary_path"
+    rmdir "$lock_directory" 2>/dev/null || true
+}
+
+trap cleanup EXIT INT TERM
+
+mkdir -p "$backup_directory"
+
+export PGPASSWORD="$DB_PASSWORD"
+export PGCONNECT_TIMEOUT="${PGCONNECT_TIMEOUT:-10}"
+
+echo "Creating PostgreSQL backup: $backup_name"
+pg_dump \
+    --host="$DB_HOST" \
+    --port="${DB_PORT:-5432}" \
+    --username="$DB_USERNAME" \
+    --dbname="$DB_DATABASE" \
+    --format=custom \
+    --compress=9 \
+    --no-owner \
+    --no-acl \
+    --file="$temporary_path"
+
+pg_restore --list "$temporary_path" >/dev/null
+mv "$temporary_path" "$backup_path"
+
+(
+    cd "$backup_directory"
+    sha256sum "$backup_name" > "$backup_name.sha256"
+)
+
+s3_directory="s3://$BACKUP_S3_BUCKET"
+if [ -n "$backup_prefix" ]; then
+    s3_directory="$s3_directory/$backup_prefix"
+fi
+
+echo "Uploading backup to $s3_directory/"
+aws_cli s3 cp \
+    "$backup_path" \
+    "$s3_directory/$backup_name" \
+    --sse AES256 \
+    --only-show-errors
+aws_cli s3 cp \
+    "$checksum_path" \
+    "$s3_directory/$backup_name.sha256" \
+    --sse AES256 \
+    --only-show-errors
+
+touch "$backup_directory/.last-success"
+
+find "$backup_directory" -type f \
+    \( -name "*.dump" -o -name "*.dump.sha256" \) \
+    -mtime "+$retention_days" \
+    -delete
+
+echo "Database backup completed: $backup_name"