83be088263
Deliverable 1: ops/backup.sh and tradein-mvp/deploy/backup-tradein-db.sh now write a sentinel file on every verified-good run. A new ops/check-backup- staleness.sh (separate cron entry, hourly) alerts via the existing Telegram channel (same TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID idiom as ops/uptime- healthcheck.sh, transition-tracked so it doesn't spam) if a sentinel goes stale. Shared logic (notify/sentinel/state) factored into ops/lib-backup.sh so it isn't triplicated; the two existing scripts' own hardening (integrity checks, retention, etc.) is untouched. Deliverable 2: ops/backup-forgejo.sh — Forgejo (git.gendsgn.ru) has no backup today. Dumps the shared-postgres `forgejo` DB + tars the bare-repo tree, both off-box to s3://gendsgn-backups/forgejo/ under a SEPARATE, narrower S3 key (root-of-bucket writer key stays out of this). The key doesn't exist yet — the script refuses to run and exits non-zero, loudly, until the four FORGEJO_S3_* vars are filled in (see the example env file and PR description for the exact bucket policy JSON to create it with). Refs #2203, #2989
55 lines
3.1 KiB
Text
55 lines
3.1 KiB
Text
# Environment file for ops/backup.sh (MAIN gendesign DB backup, #71).
|
|
#
|
|
# Install on the prod VM as a ROOT-OWNED, chmod-600 file that is NOT in git:
|
|
# sudo cp /opt/gendesign/ops/gendesign-backup.default.example /etc/default/gendesign-backup
|
|
# sudo chmod 600 /etc/default/gendesign-backup
|
|
# sudo $EDITOR /etc/default/gendesign-backup # fill in real S3 credentials
|
|
#
|
|
# backup.sh sources this file if present. With NO S3 vars set, dumps stay
|
|
# local-only under /opt/gendesign/backups (retention KEEP=7). Fill these in to
|
|
# also push each dump off-box to S3 (recommended — local-only dies with the VM).
|
|
# backup.sh now also dumps cluster globals (roles/GRANTs, via `pg_dumpall
|
|
# --globals-only`) alongside the main dump — same S3 vars, same bucket, no
|
|
# separate config needed (#2203).
|
|
#
|
|
# tradein-mvp/deploy/backup-tradein-db.sh (separate DB, separate cron job)
|
|
# prefers its OWN env file at /etc/default/tradein-backup, but falls back to
|
|
# THIS file if that one doesn't exist — so filling in the S3 vars here also
|
|
# enables off-box upload for the tradein DB backup, unless you want the two
|
|
# DBs going to different buckets/creds (then create /etc/default/tradein-backup
|
|
# with its own S3_* vars instead).
|
|
#
|
|
# To rehearse a restore from a dump this script produced (safe, throwaway
|
|
# container, never touches prod) see ops/restore-drill.sh.
|
|
#
|
|
# Missed-run alerting (#2203): ops/check-backup-staleness.sh (separate cron
|
|
# entry, see its header) alerts when a backup's sentinel goes stale. It reads
|
|
# TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID from THIS file (not from
|
|
# /etc/default/gendesign-uptime — deliberately a separate config so backup
|
|
# alerting doesn't depend on the uptime watchdog's env file existing).
|
|
# SAME variable names as ops/gendesign-uptime.default.example — point both
|
|
# files at the same bot/chat if you want one Telegram destination for
|
|
# everything, or use different bots/chats if you'd rather split the noise.
|
|
# Without these two set, ops/check-backup-staleness.sh still logs, just
|
|
# doesn't send a Telegram alert.
|
|
|
|
# --- S3 off-site upload (Selectel S3-compatible). All four required to enable. ---
|
|
#S3_ENDPOINT=https://s3.ru-1.storage.selcloud.ru
|
|
#S3_BUCKET=gendesign-backups
|
|
#S3_ACCESS_KEY=REPLACE_WITH_REAL_ACCESS_KEY
|
|
#S3_SECRET_KEY=REPLACE_WITH_REAL_SECRET_KEY
|
|
|
|
# --- missed-run alerting (Telegram, shared bot with uptime watchdog) ---
|
|
#TELEGRAM_BOT_TOKEN=123456789:AA-REPLACE_WITH_REAL_BOT_TOKEN
|
|
#TELEGRAM_CHAT_ID=123456789
|
|
|
|
# --- optional overrides (defaults are sensible; uncomment only to change) ---
|
|
#KEEP=7 # how many recent local dumps to retain (applies to both
|
|
# the main dump series and the globals dump series)
|
|
#MIN_DUMP_BYTES=51200 # sanity floor for the MAIN dump; a dump smaller than
|
|
# this is treated as failed. No equivalent floor for the
|
|
# globals dump — a handful of roles legitimately gzips to
|
|
# well under this. tradein-backup.sh has its own,
|
|
# separate MIN_DUMP_BYTES (default 10240) — set in
|
|
# /etc/default/tradein-backup, not here.
|
|
#LOCAL_BACKUP_DIR=/opt/gendesign/backups
|