feat: harden production data and backups

2026-09-06 14:08:07 +07:00
parent a4bd395856
commit 870d9cc7f9
17 changed files with 215 additions and 36 deletions
@@ -0,0 +1,27 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -ne 1 ] || [ "${CONFIRM_RESTORE:-}" != "rf4-spotter" ]; then
+  echo "Usage: CONFIRM_RESTORE=rf4-spotter $0 ABSOLUTE_BACKUP_DIRECTORY/TIMESTAMP" >&2
+  exit 2
+fi
+
+case "$1" in
+  /*) ;;
+  *) echo "Backup directory must be an absolute path" >&2; exit 2 ;;
+esac
+
+source_dir=${1%/}
+test -f "$source_dir/postgres.dump"
+test -f "$source_dir/minio.tar.gz"
+(cd "$source_dir" && sha256sum -c SHA256SUMS)
+backup_root=$(dirname "$source_dir")
+stamp=$(basename "$source_dir")
+export BACKUP_DIRECTORY="$backup_root"
+
+compose="docker compose --env-file .env.production -f compose.production.yaml"
+$compose stop api web minio
+$compose exec -T db sh -c 'pg_restore --clean --if-exists --exit-on-error --no-owner --no-acl -U "$POSTGRES_USER" -d "$POSTGRES_DB"' < "$source_dir/postgres.dump"
+$compose run --rm storage-tool sh -c 'find /data -mindepth 1 -delete && tar -xzf "/backup/'"$stamp"'/minio.tar.gz" -C /data'
+$compose up -d minio api web proxy
+echo "Restore completed from: $source_dir"