lekss361/gendesign
1
0
Fork 0
Code Issues 108 Pull requests 18 Projects Releases Packages Wiki Activity Actions 3

fix(ops): выгрузка бэкапа в S3 не проходила TLS — у aws-cli свой CA-бандл (#2203)
All checks were successful
CI Trade-In / changes (pull_request) Successful in 11s
Details
CI / changes (pull_request) Successful in 13s
Details
CI Trade-In / backend-tests (pull_request) Has been skipped
Details
CI Trade-In / browser-tests (pull_request) Has been skipped
Details
CI Trade-In / frontend-checks (pull_request) Has been skipped
Details
CI / backend-tests (pull_request) Has been skipped
Details
CI / openapi-codegen-check (pull_request) Has been skipped
Details
CI / frontend-tests (pull_request) Has been skipped
Details

Browse source 
aws-cli v2 (образ amazon/aws-cli:latest) использует собственный набор
корневых сертификатов из botocore, а не системное хранилище контейнера.
В нём нет корня, которым подписан сертификат Selectel S3
(s3.ru-1.storage.selcloud.ru), поэтому docker run падал на
SSL validation failed / CERTIFICATE_VERIFY_FAILED: self-signed
certificate in certificate chain — и ночной S3-upload не проходил
каждый раз, хотя ключи и bucket были верны.

Проверено на проде: без AWS_CA_BUNDLE — SSL validation failed; с
AWS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt (системное хранилище
контейнера, содержит нужный GlobalSign-корень) — upload 11 МБ проходит,
код возврата 0, объект подтверждён чтением вторым ключом.

Правка — одна переменная окружения в docker run в обоих скриптах:
- ops/backup.sh (main DB backup)
- tradein-mvp/deploy/backup-tradein-db.sh (tradein DB backup, #3004)
This commit is contained in:
bot-backend 2026-08-20 23:09:28 +03:00
parent 9b72e50d18
commit 74d503fe36
2 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ops/backup.sh
View file

@ -157,9 +157,14 @@ log "Globals dump OK: ${globals_out} ($(du -h "$globals_out" | cut -f1))"
if [[ -n "${S3_ENDPOINT:-}" && -n "${S3_BUCKET:-}" && -n "${S3_ACCESS_KEY:-}" && -n "${S3_SECRET_KEY:-}" ]]; then if [[ -n "${S3_ENDPOINT:-}" && -n "${S3_BUCKET:-}" && -n "${S3_ACCESS_KEY:-}" && -n "${S3_SECRET_KEY:-}" ]]; then
for f in "$out" "$globals_out"; do for f in "$out" "$globals_out"; do
log "Uploading to s3://${S3_BUCKET}/$(basename "$f")" log "Uploading to s3://${S3_BUCKET}/$(basename "$f")"
# aws-cli v2 ships its own CA bundle (baked into botocore) instead of
# trusting the system store, and it's missing the root that Selectel's
# cert chains up to — so uploads fail with CERTIFICATE_VERIFY_FAILED
# unless we point it at the container's system store, which has it.
docker run --rm \ docker run --rm \
-e AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" \ -e AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" \
-e AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \ -e AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \
-e AWS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
-v "$LOCAL_BACKUP_DIR":/backup:ro \ -v "$LOCAL_BACKUP_DIR":/backup:ro \
amazon/aws-cli:latest \ amazon/aws-cli:latest \
--endpoint-url "$S3_ENDPOINT" \ --endpoint-url "$S3_ENDPOINT" \

5
tradein-mvp/deploy/backup-tradein-db.sh
View file

@ -122,9 +122,14 @@ log "Globals ok: $globals_out ($(du -h "$globals_out" | cut -f1))"
if [[ -n "${S3_ENDPOINT:-}" && -n "${S3_BUCKET:-}" && -n "${S3_ACCESS_KEY:-}" && -n "${S3_SECRET_KEY:-}" ]]; then if [[ -n "${S3_ENDPOINT:-}" && -n "${S3_BUCKET:-}" && -n "${S3_ACCESS_KEY:-}" && -n "${S3_SECRET_KEY:-}" ]]; then
for f in "$out" "$globals_out"; do for f in "$out" "$globals_out"; do
log "Заливаю в s3://${S3_BUCKET}/$(basename "$f")" log "Заливаю в s3://${S3_BUCKET}/$(basename "$f")"
# У aws-cli v2 свой CA-бандл (вшит в botocore), а не системное хранилище —
# в нём нет корня, которым подписан сертификат Selectel. Без переменной
# ниже выгрузка падает на CERTIFICATE_VERIFY_FAILED; системное хранилище
# контейнера этот корень содержит.
docker run --rm \ docker run --rm \
-e AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" \ -e AWS_ACCESS_KEY_ID="$S3_ACCESS_KEY" \
-e AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \ -e AWS_SECRET_ACCESS_KEY="$S3_SECRET_KEY" \
-e AWS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt \
-v "$BACKUP_DIR":/backup:ro \ -v "$BACKUP_DIR":/backup:ro \
amazon/aws-cli:latest \ amazon/aws-cli:latest \
--endpoint-url "$S3_ENDPOINT" \ --endpoint-url "$S3_ENDPOINT" \