158 lines
6.7 KiB
Bash
Executable File
158 lines
6.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# A backup is published only after every source, archive and remote readback passed.
|
|
set -Eeuo pipefail
|
|
SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
|
|
LIB_DIR="$SCRIPT_DIR/../lib/app-backup"
|
|
[[ -f $LIB_DIR/common.sh ]] || LIB_DIR="$SCRIPT_DIR/../lib"
|
|
# shellcheck source=lib/common.sh
|
|
source "$LIB_DIR/common.sh"
|
|
CONFIG_FILE=/etc/app-backup/app-backup.conf
|
|
CHECK=false
|
|
SKIP_RETENTION=false
|
|
while (( $# )); do
|
|
case $1 in
|
|
--config) CONFIG_FILE=${2:?Missing config path}; shift 2 ;;
|
|
--check) CHECK=true; shift ;;
|
|
--no-retention) SKIP_RETENTION=true; shift ;;
|
|
--help) echo 'Usage: app-backup.sh [--config FILE] [--check] [--no-retention]'; exit 0 ;;
|
|
*) die "Unknown argument: $1" ;;
|
|
esac
|
|
done
|
|
OPERATION=backup
|
|
load_config
|
|
init_runtime
|
|
build_plan
|
|
preflight
|
|
if [[ $CHECK == true ]]; then
|
|
echo 'Preflight passed. Directory metadata probed; no application backup, service stop or upload performed.'
|
|
exit 0
|
|
fi
|
|
STAGING_DIR=$(mktemp -d "$STAGING_ROOT/${RUN_ID}.XXXXXX")
|
|
mkdir -p "$STAGING_DIR"/{db,files,meta}
|
|
PARTIAL_DIR="$ARCHIVE_DIR/.partial-$RUN_ID"
|
|
mkdir -m 700 -- "$PARTIAL_DIR"
|
|
PLAN="$STAGING_DIR/meta/plan.tsv"
|
|
printf 'meta\tmetadata\n' > "$PLAN"
|
|
printf '%s\n' "$RUN_ID" > "$STAGING_DIR/meta/run-id.txt"
|
|
# The config may contain secrets or executable substitutions; never copy it into reports.
|
|
printf 'format=2\ncompressor=%s\n' "$COMPRESSOR" > "$STAGING_DIR/meta/format.txt"
|
|
quiesce
|
|
|
|
for i in "${!DB_LABELS[@]}"; do
|
|
assert_services_quiescent
|
|
label=${DB_LABELS[i]}
|
|
out="$STAGING_DIR/db/${label#db-}.sql"
|
|
echo "-- Dump: ${DB_NAMES[i]}"
|
|
# Defaults-extra-file must be the first option. lock-all-tables also covers MyISAM;
|
|
# this can block ALL server databases during each dump (see documentation).
|
|
"$DB_DUMP_BIN" --defaults-extra-file="${DB_CNFS[i]}" --lock-all-tables \
|
|
--quick --routines --events --triggers --hex-blob --default-character-set=utf8mb4 \
|
|
"${DB_NAMES[i]}" > "$out.partial"
|
|
assert_services_quiescent
|
|
[[ -s $out.partial ]] || die "Empty database dump: $label"
|
|
mv -- "$out.partial" "$out"
|
|
printf '%s\t%s\n' "$label" "${DB_NAMES[i]}" >> "$PLAN"
|
|
done
|
|
for i in "${!LABELS[@]}"; do
|
|
assert_services_quiescent
|
|
label=${LABELS[i]}; src=${SOURCES[i]}; root=${ROOTS[i]}
|
|
check_space "$STAGING_ROOT"
|
|
mkdir -p -- "$STAGING_DIR/$root"
|
|
exclusions "$label"
|
|
echo "-- Copy: $label ($src)"
|
|
# Never accept vanished-file (24) or partial-copy (23) as success.
|
|
# Parent retains both locks; rsync itself needs neither inherited descriptor.
|
|
rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$src/" "$STAGING_DIR/$root/" 8>&- 9>&-
|
|
assert_services_quiescent
|
|
printf '%s\t%s\n' "$label" "$src" >> "$PLAN"
|
|
done
|
|
# The full consistency window includes all dumps AND copies. Compression/upload
|
|
# use this frozen private staging tree, so application downtime ends here.
|
|
assert_services_quiescent
|
|
echo '-- Copy window complete; writer guards verified'
|
|
resume_services || die 'Failed to resume original service state'
|
|
|
|
while IFS=$'\t' read -r label _; do
|
|
if [[ $label == meta ]]; then root=meta
|
|
elif [[ $label == db-* ]]; then root="db/${label#db-}.sql"
|
|
else root="files/$label"; fi
|
|
check_space "$ARCHIVE_DIR"
|
|
echo "-- Archive: $label"
|
|
if [[ $COMPRESSOR == zstd ]]; then
|
|
out="$PARTIAL_DIR/$label.tar.zst"
|
|
tar --numeric-owner --acls --xattrs --selinux -C "$STAGING_DIR" -cf - -- "$root" |
|
|
zstd -T"$ZSTD_THREADS" -"$ZSTD_LEVEL" -q -c > "$out.partial"
|
|
else
|
|
out="$PARTIAL_DIR/$label.tar.gz"
|
|
tar --numeric-owner --acls --xattrs --selinux -C "$STAGING_DIR" -cf - -- "$root" |
|
|
gzip -6 -c > "$out.partial"
|
|
fi
|
|
mv -- "$out.partial" "$out"
|
|
done < "$PLAN"
|
|
helper create "$PARTIAL_DIR" "$RUN_ID" "$PLAN"
|
|
RUN_DIR="$ARCHIVE_DIR/$RUN_ID"
|
|
mv -- "$PARTIAL_DIR" "$RUN_DIR"
|
|
sync -f "$ARCHIVE_DIR"
|
|
echo "-- Complete local backup: $RUN_DIR"
|
|
|
|
if [[ $ENABLE_UPLOAD == true ]]; then
|
|
remote_run="${RCLONE_REMOTE_BASE%/}/$RUN_ID"
|
|
# Upload COMPLETE last. An interrupted upload cannot look like a valid set.
|
|
rc copy "$RUN_DIR" "$remote_run" --exclude /COMPLETE --exclude /UPLOADED --immutable
|
|
rc check "$RUN_DIR" "$remote_run" --download --exclude /COMPLETE --exclude /UPLOADED
|
|
rc copyto "$RUN_DIR/COMPLETE" "$remote_run/COMPLETE" --immutable
|
|
marker=$(rc cat "$remote_run/COMPLETE")
|
|
[[ $marker == "$(cat "$RUN_DIR/COMPLETE")" ]] || die 'Remote completion marker mismatch'
|
|
date -u -Is > "$RUN_DIR/UPLOADED"
|
|
sync -f "$RUN_DIR"
|
|
echo '-- Remote backup fully read back and verified'
|
|
fi
|
|
|
|
if [[ $SKIP_RETENTION == true ]]; then
|
|
echo "SUCCESS: $RUN_ID (retention skipped for acceptance run)"
|
|
exit 0
|
|
fi
|
|
|
|
# Retention works on complete v2 sets only, after a new successful backup.
|
|
# Older flat archives, partial runs and unknown folders are deliberately preserved.
|
|
valid="$STAGING_DIR/local-retention.txt"
|
|
: > "$valid"
|
|
for dir in "$ARCHIVE_DIR/${ARCHIVE_PREFIX}_"*; do
|
|
[[ -d $dir && ! -L $dir && -f $dir/COMPLETE ]] || continue
|
|
[[ $ENABLE_UPLOAD != true || -f $dir/UPLOADED ]] || continue
|
|
if helper metadata "$dir" >/dev/null 2>&1; then basename -- "$dir" >> "$valid"; fi
|
|
done
|
|
helper candidates "$ARCHIVE_PREFIX" "$LOCAL_RETENTION_DAYS" "$RETENTION_KEEP_LAST" < "$valid" > "$valid.delete"
|
|
while IFS= read -r name; do
|
|
[[ $name != "$RUN_ID" ]] || continue
|
|
echo "-- Local retention: $name"
|
|
rm -rf -- "${ARCHIVE_DIR:?}/$name"
|
|
done < "$valid.delete"
|
|
if [[ $ENABLE_UPLOAD == true && $ENABLE_REMOTE_RETENTION == true ]]; then
|
|
rc lsf "$RCLONE_REMOTE_BASE" --dirs-only --max-depth 1 > "$STAGING_DIR/remote-dirs.txt"
|
|
: > "$STAGING_DIR/remote-valid.txt"
|
|
mkdir "$STAGING_DIR/remote-meta"
|
|
while IFS= read -r name; do
|
|
name=${name%/}
|
|
[[ $name =~ ^${ARCHIVE_PREFIX}_[0-9]{4}-[0-9]{2}-[0-9]{2}_[0-9]{2}-[0-9]{2}-[0-9]{2}_[0-9a-f]{8}$ ]] || continue
|
|
# Missing markers are expected for interrupted uploads; these are NEVER purged.
|
|
if rc cat "$RCLONE_REMOTE_BASE/$name/COMPLETE" > "$STAGING_DIR/remote-meta/COMPLETE" 2>/dev/null &&
|
|
rc cat "$RCLONE_REMOTE_BASE/$name/manifest.json" > "$STAGING_DIR/remote-meta/manifest.json" 2>/dev/null &&
|
|
helper metadata "$STAGING_DIR/remote-meta" >/dev/null 2>&1; then
|
|
echo "$name" >> "$STAGING_DIR/remote-valid.txt"
|
|
fi
|
|
done < "$STAGING_DIR/remote-dirs.txt"
|
|
helper candidates "$ARCHIVE_PREFIX" "$REMOTE_RETENTION_DAYS" "$RETENTION_KEEP_LAST" < "$STAGING_DIR/remote-valid.txt" > "$STAGING_DIR/remote-delete.txt"
|
|
while IFS= read -r name; do
|
|
[[ $name != "$RUN_ID" ]] || continue
|
|
echo "-- Remote retention: $name"
|
|
rc purge "$RCLONE_REMOTE_BASE/$name"
|
|
done < "$STAGING_DIR/remote-delete.txt"
|
|
fi
|
|
# Per-run filenames need age-based cleanup, not rotating an empty successor file.
|
|
for operation in backup restore; do
|
|
find "$LOG_DIR" -maxdepth 1 -type f -name "${operation}_${ARCHIVE_PREFIX}_*.log" \
|
|
-mtime "+${LOG_RETENTION_DAYS}" ! -name "$(basename "$LOG_FILE")" -delete
|
|
done
|
|
echo "SUCCESS: $RUN_ID"
|