lekss361/gendesign
1
0
Fork 0
Code Issues 143 Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request 'fix(ops): выгрузка бэкапа в S3 не проходила TLS — у aws-cli свой CA-бандл (#2203)' (#3009) from fix/backup-s3-ca-bundle into main
All checks were successful
Deploy / changes (push) Successful in 9s
Details
Deploy / build-backend (push) Has been skipped
Details
Deploy / build-worker (push) Has been skipped
Details
Deploy / build-frontend (push) Has been skipped
Details
Deploy / deploy-caddy (push) Has been skipped
Details
Deploy Trade-In / changes (push) Successful in 12s
Details
Deploy Trade-In / build-browser (push) Successful in 40s
Details
Deploy / deploy (push) Successful in 1m19s
Details
Deploy / deploy-status (push) Successful in 2s
Details
Deploy / perimeter-smoke (push) Successful in 11s
Details
Deploy Trade-In / build-frontend (push) Successful in 2m59s
Details
Deploy Trade-In / test (push) Successful in 3m38s
Details
Deploy Trade-In / build-backend (push) Successful in 33s
Details
Deploy Trade-In / deploy (push) Successful in 2m16s
Details
Deploy Trade-In / deploy-status (push) Successful in 1s
Details
Deploy Trade-In / perimeter-smoke (push) Successful in 10s
Details

Browse source
This commit is contained in:
lekss361 2026-08-20 20:14:16 +00:00
commit 1663f22795
2 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ops/backup.sh
View file

@ -157,9 +157,14 @@ log "Globals dump OK: ${globals_out} ($(du -h "$globals_out" | cut -f1))"
if [[ -n "${S3_ENDPOINT:-}" && -n "${S3_BUCKET:-}" && -n "${S3_ACCESS_KEY:-}" && -n "${S3_SECRET_KEY:-}" ]]; then if [[ -n "${S3_ENDPOINT:-}" && -n "${S3_BUCKET:-}" && -n "${S3_ACCESS_KEY:-}" && -n "${S3_SECRET_KEY:-}" ]]; then
for f in "$out" "$globals_out"; do for f in "$out" "$globals_out"; do
log "Uploading to s3://${S3_BUCKET}/$(basename "$f")" log "Uploading to s3://${S3_BUCKET}/$(basename "$f")"
# aws-cli v2 ships its own CA bundle (baked into botocore) instead of
# trusting the system store, and it's missing the root that Selectel's
# cert chains up to — so uploads fail with CERTIFICATE_VERIFY_FAILED
# unless we point it at the container's system store, which has it.
docker run --rm \ docker run --rm \
-e AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" \ -e AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" \
-e AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \ -e AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \
-e AWS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
-v "$LOCAL_BACKUP_DIR":/backup:ro \ -v "$LOCAL_BACKUP_DIR":/backup:ro \
amazon/aws-cli:latest \ amazon/aws-cli:latest \
--endpoint-url "$S3_ENDPOINT" \ --endpoint-url "$S3_ENDPOINT" \

5
tradein-mvp/deploy/backup-tradein-db.sh
View file

@ -122,9 +122,14 @@ log "Globals ok: $globals_out ($(du -h "$globals_out" | cut -f1))"
if [[ -n "${S3_ENDPOINT:-}" && -n "${S3_BUCKET:-}" && -n "${S3_ACCESS_KEY:-}" && -n "${S3_SECRET_KEY:-}" ]]; then if [[ -n "${S3_ENDPOINT:-}" && -n "${S3_BUCKET:-}" && -n "${S3_ACCESS_KEY:-}" && -n "${S3_SECRET_KEY:-}" ]]; then
for f in "$out" "$globals_out"; do for f in "$out" "$globals_out"; do
log "Заливаю в s3://${S3_BUCKET}/$(basename "$f")" log "Заливаю в s3://${S3_BUCKET}/$(basename "$f")"
# У aws-cli v2 свой CA-бандл (вшит в botocore), а не системное хранилище —
# в нём нет корня, которым подписан сертификат Selectel. Без переменной
# ниже выгрузка падает на CERTIFICATE_VERIFY_FAILED; системное хранилище
# контейнера этот корень содержит.
docker run --rm \ docker run --rm \
-e AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" \ -e AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" \
-e AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \ -e AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \
-e AWS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
-v "$BACKUP_DIR":/backup:ro \ -v "$BACKUP_DIR":/backup:ro \
amazon/aws-cli:latest \ amazon/aws-cli:latest \
--endpoint-url "$S3_ENDPOINT" \ --endpoint-url "$S3_ENDPOINT" \