mi
39 lines
1.2 KiB
Bash
39 lines
1.2 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
cd "$(dirname "$0")/../.."
|
|
CONFIG_FILE=${CONFIG_FILE:-.env}
|
|
SECRETS_LAUNCHER=${SECRETS_LAUNCHER:-deployment/secrets/han-secrets}
|
|
|
|
if [ "${HAN_SECRETS_ACTIVE:-0}" != "1" ]; then
|
|
[ -x "$SECRETS_LAUNCHER" ] || {
|
|
echo "Secret launcher is required: $SECRETS_LAUNCHER" >&2
|
|
exit 66
|
|
}
|
|
exec "$SECRETS_LAUNCHER" run --config "$CONFIG_FILE" -- "$0" "$@"
|
|
fi
|
|
|
|
if [ -z "${PG_BACKUP_DSN_FILE:-}" ] || [ ! -r "$PG_BACKUP_DSN_FILE" ]; then
|
|
echo "PG_BACKUP_DSN_FILE is required from the secret launcher." >&2
|
|
exit 64
|
|
fi
|
|
PG_BACKUP_DSN=$(cat "$PG_BACKUP_DSN_FILE")
|
|
case "$PG_BACKUP_DSN" in
|
|
*sslmode=verify-full*sslrootcert=*) ;;
|
|
*) echo "PG_BACKUP_DSN must enforce sslmode=verify-full and sslrootcert." >&2; exit 64 ;;
|
|
esac
|
|
|
|
output_dir=${1:-/opt/han-chat/backups}
|
|
umask 077
|
|
mkdir -p "$output_dir"
|
|
stamp=$(date -u +%Y%m%dT%H%M%SZ)
|
|
archive="$output_dir/han-chat-$stamp.dump"
|
|
|
|
PGDATABASE="$PG_BACKUP_DSN" pg_dump \
|
|
--format=custom --no-owner --no-privileges --file="$archive"
|
|
unset PG_BACKUP_DSN
|
|
pg_restore --list "$archive" >/dev/null
|
|
sha256sum "$archive" > "$archive.sha256"
|
|
chmod 600 "$archive" "$archive.sha256"
|
|
echo "Logical backup verified: $archive"
|
|
echo "This supplements, but does not replace, provider backup/PITR and restore rehearsal."
|