feat: harden production data and backups

2026-09-06 14:08:07 +07:00
parent a4bd395856
commit 870d9cc7f9
17 changed files with 215 additions and 36 deletions
@@ -0,0 +1,26 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -ne 1 ]; then
+  echo "Usage: $0 ABSOLUTE_BACKUP_DIRECTORY" >&2
+  exit 2
+fi
+
+case "$1" in
+  /*) ;;
+  *) echo "Backup directory must be an absolute path" >&2; exit 2 ;;
+esac
+
+backup_root=${1%/}
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+target="$backup_root/$stamp"
+mkdir -p "$target"
+chmod 700 "$target"
+export BACKUP_DIRECTORY="$backup_root"
+
+compose="docker compose --env-file .env.production -f compose.production.yaml"
+$compose exec -T db sh -c 'pg_dump --format=custom --no-owner --no-acl -U "$POSTGRES_USER" -d "$POSTGRES_DB"' > "$target/postgres.dump"
+$compose run --rm storage-tool tar -czf "/backup/$stamp/minio.tar.gz" -C /data .
+sha256sum "$target/postgres.dump" "$target/minio.tar.gz" > "$target/SHA256SUMS"
+chmod 600 "$target/postgres.dump" "$target/minio.tar.gz" "$target/SHA256SUMS"
+echo "Backup created: $target"