129 lines
3.5 KiB
Bash
129 lines
3.5 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
usage() {
|
|
cat <<'EOF'
|
|
Usage:
|
|
backup-upload-s3.sh
|
|
|
|
Environment:
|
|
DEPLOY_ROOT Deployment directory. Defaults to ~/qlockify-deployment.
|
|
S3_BACKUP_BUCKET S3 bucket name.
|
|
S3_BACKUP_PREFIX S3 object prefix. Defaults to qlockify.
|
|
S3_BACKUP_REGION S3 region. Defaults to us-east-1.
|
|
S3_BACKUP_ENDPOINT_URL Optional S3-compatible endpoint URL.
|
|
S3_BACKUP_ACCESS_KEY_ID S3 access key.
|
|
S3_BACKUP_SECRET_ACCESS_KEY S3 secret key.
|
|
BACKUP_ENCRYPTION_PASSPHRASE Passphrase used to encrypt backup archives.
|
|
BACKUP_LOCAL_KEEP_LATEST Set to 1 to keep latest encrypted archive locally.
|
|
EOF
|
|
}
|
|
|
|
log() {
|
|
printf '[backup-s3] %s\n' "$*"
|
|
}
|
|
|
|
fail() {
|
|
printf '[backup-s3] %s\n' "$*" >&2
|
|
exit 1
|
|
}
|
|
|
|
require_var() {
|
|
local name="$1"
|
|
[[ -n "${!name:-}" ]] || fail "$name is required"
|
|
}
|
|
|
|
load_env() {
|
|
local env_path="$1"
|
|
[[ -f "$env_path" ]] || fail "Deployment env file not found: $env_path"
|
|
set -a
|
|
# shellcheck disable=SC1090
|
|
. "$env_path"
|
|
set +a
|
|
}
|
|
|
|
aws_s3() {
|
|
if [[ -n "${S3_BACKUP_ENDPOINT_URL:-}" ]]; then
|
|
aws --endpoint-url "$S3_BACKUP_ENDPOINT_URL" s3 "$@"
|
|
else
|
|
aws s3 "$@"
|
|
fi
|
|
}
|
|
|
|
normalize_prefix() {
|
|
local value="${1:-qlockify}"
|
|
value="${value#/}"
|
|
value="${value%/}"
|
|
printf '%s' "$value"
|
|
}
|
|
|
|
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
|
|
usage
|
|
exit 0
|
|
fi
|
|
|
|
command -v aws >/dev/null 2>&1 || fail "aws CLI is required"
|
|
command -v openssl >/dev/null 2>&1 || fail "openssl is required"
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
DEPLOY_ROOT="${DEPLOY_ROOT:-$(cd "$SCRIPT_DIR/.." && pwd)}"
|
|
DEPLOY_ENV="$DEPLOY_ROOT/.env"
|
|
BACKUP_SCRIPT="$SCRIPT_DIR/backup.sh"
|
|
|
|
[[ -x "$BACKUP_SCRIPT" ]] || fail "Backup script is not executable: $BACKUP_SCRIPT"
|
|
load_env "$DEPLOY_ENV"
|
|
|
|
S3_BACKUP_PREFIX="$(normalize_prefix "${S3_BACKUP_PREFIX:-qlockify}")"
|
|
S3_BACKUP_REGION="${S3_BACKUP_REGION:-us-east-1}"
|
|
|
|
require_var S3_BACKUP_BUCKET
|
|
require_var S3_BACKUP_ACCESS_KEY_ID
|
|
require_var S3_BACKUP_SECRET_ACCESS_KEY
|
|
require_var BACKUP_ENCRYPTION_PASSPHRASE
|
|
|
|
export AWS_ACCESS_KEY_ID="$S3_BACKUP_ACCESS_KEY_ID"
|
|
export AWS_SECRET_ACCESS_KEY="$S3_BACKUP_SECRET_ACCESS_KEY"
|
|
export AWS_DEFAULT_REGION="$S3_BACKUP_REGION"
|
|
export AWS_EC2_METADATA_DISABLED=true
|
|
|
|
WORK_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$WORK_DIR"' EXIT
|
|
|
|
PLAIN_DIR="$WORK_DIR/plain"
|
|
mkdir -p "$PLAIN_DIR"
|
|
|
|
log "Creating local backup archive"
|
|
DEPLOY_ROOT="$DEPLOY_ROOT" "$BACKUP_SCRIPT" "$PLAIN_DIR"
|
|
|
|
shopt -s nullglob
|
|
archives=("$PLAIN_DIR"/*.tar.gz)
|
|
shopt -u nullglob
|
|
[[ "${#archives[@]}" -eq 1 ]] || fail "Expected exactly one backup archive, found ${#archives[@]}"
|
|
|
|
ARCHIVE_PATH="${archives[0]}"
|
|
ARCHIVE_NAME="$(basename "$ARCHIVE_PATH")"
|
|
ENCRYPTED_NAME="$ARCHIVE_NAME.enc"
|
|
ENCRYPTED_PATH="$WORK_DIR/$ENCRYPTED_NAME"
|
|
S3_URI="s3://$S3_BACKUP_BUCKET/$S3_BACKUP_PREFIX/$ENCRYPTED_NAME"
|
|
|
|
log "Encrypting backup archive"
|
|
openssl enc -aes-256-cbc -salt -pbkdf2 -iter 200000 \
|
|
-in "$ARCHIVE_PATH" \
|
|
-out "$ENCRYPTED_PATH" \
|
|
-pass env:BACKUP_ENCRYPTION_PASSPHRASE
|
|
|
|
rm -f "$ARCHIVE_PATH"
|
|
|
|
log "Uploading encrypted backup to $S3_URI"
|
|
aws_s3 cp "$ENCRYPTED_PATH" "$S3_URI" --only-show-errors
|
|
|
|
if [[ "${BACKUP_LOCAL_KEEP_LATEST:-1}" == "1" ]]; then
|
|
LATEST_DIR="$DEPLOY_ROOT/backups/latest"
|
|
mkdir -p "$LATEST_DIR"
|
|
find "$LATEST_DIR" -type f -name '*.tar.gz.enc' -delete
|
|
cp "$ENCRYPTED_PATH" "$LATEST_DIR/$ENCRYPTED_NAME"
|
|
log "Kept latest encrypted backup locally: $LATEST_DIR/$ENCRYPTED_NAME"
|
|
fi
|
|
|
|
log "S3 backup upload completed: $S3_URI"
|