feat: verify production backup restore

deploy/backup.sh

@@ -14,13 +14,20 @@ esac
 backup_root=${1%/}
 stamp=$(date -u +%Y%m%dT%H%M%SZ)
 target="$backup_root/$stamp"
+if [ -e "$target" ]; then
+  echo "Backup target already exists: $target" >&2
+  exit 1
+fi
 mkdir -p "$target"
 chmod 700 "$target"
 export BACKUP_DIRECTORY="$backup_root"
 
-compose="docker compose --env-file .env.production -f compose.production.yaml"
+env_file=${COMPOSE_ENV_FILE:-.env.production}
+compose="docker compose --env-file $env_file -f compose.production.yaml"
 $compose exec -T db sh -c 'pg_dump --format=custom --no-owner --no-acl -U "$POSTGRES_USER" -d "$POSTGRES_DB"' > "$target/postgres.dump"
-$compose run --rm storage-tool tar -czf "/backup/$stamp/minio.tar.gz" -C /data .
-sha256sum "$target/postgres.dump" "$target/minio.tar.gz" > "$target/SHA256SUMS"
+$compose run --rm --entrypoint /bin/sh storage-tool -c 'mc alias set local http://minio:9000 "$S3_ACCESS_KEY" "$S3_SECRET_KEY" >/dev/null && mc mb --ignore-existing "local/$S3_BUCKET" >/dev/null && mc mirror --overwrite "local/$S3_BUCKET" "/backup/'"$stamp"'/minio" && chmod -R a+rwX "/backup/'"$stamp"'/minio"'
+tar -czf "$target/minio.tar.gz" -C "$target" minio
+rm -rf "$target/minio"
+(cd "$target" && sha256sum postgres.dump minio.tar.gz > SHA256SUMS)
 chmod 600 "$target/postgres.dump" "$target/minio.tar.gz" "$target/SHA256SUMS"
 echo "Backup created: $target"