123 lines
2.8 KiB
Bash
Executable File
123 lines
2.8 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
umask 077
|
|
|
|
require_variable() {
|
|
variable_name="$1"
|
|
eval "variable_value=\${$variable_name:-}"
|
|
|
|
if [ -z "$variable_value" ]; then
|
|
echo "$variable_name is required." >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
aws_cli() {
|
|
endpoint="${BACKUP_S3_ENDPOINT:-${AWS_ENDPOINT:-}}"
|
|
|
|
if [ -n "$endpoint" ]; then
|
|
aws --endpoint-url "$endpoint" "$@"
|
|
else
|
|
aws "$@"
|
|
fi
|
|
}
|
|
|
|
for variable in \
|
|
AWS_ACCESS_KEY_ID \
|
|
AWS_DEFAULT_REGION \
|
|
AWS_SECRET_ACCESS_KEY \
|
|
BACKUP_S3_BUCKET \
|
|
DB_DATABASE \
|
|
DB_HOST \
|
|
DB_PASSWORD \
|
|
DB_USERNAME
|
|
do
|
|
require_variable "$variable"
|
|
done
|
|
|
|
backup_directory="${BACKUP_DIRECTORY:-/backups}"
|
|
backup_prefix="${BACKUP_S3_PREFIX:-database-backups/postgres}"
|
|
backup_prefix="${backup_prefix#/}"
|
|
backup_prefix="${backup_prefix%/}"
|
|
backup_label="${1:-manual}"
|
|
backup_label="$(printf "%s" "$backup_label" | tr -cd "A-Za-z0-9_-")"
|
|
retention_days="${BACKUP_LOCAL_RETENTION_DAYS:-7}"
|
|
timestamp="$(date -u +"%Y%m%dT%H%M%SZ")"
|
|
database_name="$(printf "%s" "$DB_DATABASE" | tr -cd "A-Za-z0-9_-")"
|
|
backup_name="${timestamp}-${database_name}-${backup_label:-manual}.dump"
|
|
backup_path="$backup_directory/$backup_name"
|
|
temporary_path="$backup_path.partial"
|
|
checksum_path="$backup_path.sha256"
|
|
lock_directory="/tmp/bowli-database-backup.lock"
|
|
|
|
case "$retention_days" in
|
|
""|*[!0-9]*)
|
|
echo "BACKUP_LOCAL_RETENTION_DAYS must be a positive integer." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
if ! mkdir "$lock_directory" 2>/dev/null; then
|
|
echo "Another database backup is already running." >&2
|
|
exit 1
|
|
fi
|
|
|
|
cleanup() {
|
|
rm -f "$temporary_path"
|
|
rmdir "$lock_directory" 2>/dev/null || true
|
|
}
|
|
|
|
trap cleanup EXIT INT TERM
|
|
|
|
mkdir -p "$backup_directory"
|
|
|
|
export PGPASSWORD="$DB_PASSWORD"
|
|
export PGCONNECT_TIMEOUT="${PGCONNECT_TIMEOUT:-10}"
|
|
|
|
echo "Creating PostgreSQL backup: $backup_name"
|
|
pg_dump \
|
|
--host="$DB_HOST" \
|
|
--port="${DB_PORT:-5432}" \
|
|
--username="$DB_USERNAME" \
|
|
--dbname="$DB_DATABASE" \
|
|
--format=custom \
|
|
--compress=9 \
|
|
--no-owner \
|
|
--no-acl \
|
|
--file="$temporary_path"
|
|
|
|
pg_restore --list "$temporary_path" >/dev/null
|
|
mv "$temporary_path" "$backup_path"
|
|
|
|
(
|
|
cd "$backup_directory"
|
|
sha256sum "$backup_name" > "$backup_name.sha256"
|
|
)
|
|
|
|
s3_directory="s3://$BACKUP_S3_BUCKET"
|
|
if [ -n "$backup_prefix" ]; then
|
|
s3_directory="$s3_directory/$backup_prefix"
|
|
fi
|
|
|
|
echo "Uploading backup to $s3_directory/"
|
|
aws_cli s3 cp \
|
|
"$backup_path" \
|
|
"$s3_directory/$backup_name" \
|
|
--sse AES256 \
|
|
--only-show-errors
|
|
aws_cli s3 cp \
|
|
"$checksum_path" \
|
|
"$s3_directory/$backup_name.sha256" \
|
|
--sse AES256 \
|
|
--only-show-errors
|
|
|
|
touch "$backup_directory/.last-success"
|
|
|
|
find "$backup_directory" -type f \
|
|
\( -name "*.dump" -o -name "*.dump.sha256" \) \
|
|
-mtime "+$retention_days" \
|
|
-delete
|
|
|
|
echo "Database backup completed: $backup_name"
|