tangsongdayo/Mebbling
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 1 Wiki Activity

feat: secure offsite backups

Browse Source
This commit is contained in:
tangsongdayo
2026-07-19 13:01:20 +08:00
parent 1e01f3295e
commit 21395c19e9
6 changed files with 53 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/backup.sh
+17 -1
View File
@@ -3,6 +3,7 @@ set -euo pipefail
# Creates a consistent SQLite backup through the running web container, then archives Hub uploads.
# Optional: BACKUP_RETENTION_DAYS=30 BACKUP_OFFSITE_DIR=/mnt/backup/mebbling ./scripts/backup.sh
# For encrypted remote copies: BACKUP_AGE_RECIPIENT=age1... BACKUP_RCLONE_REMOTE='remote:bucket/mebbling' ./scripts/backup.sh
root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$root_dir"
stamp="$(date +%Y%m%d-%H%M%S)"
@@ -23,12 +24,27 @@ docker compose exec -T -e BACKUP_PATH="/app/data/backups/$stamp/hub.db" web node
'
tar -tzf "$backup_dir/uploads.tar.gz" >/dev/null
(cd "$backup_dir" && sha256sum hub.db uploads.tar.gz > SHA256SUMS)
"$root_dir/scripts/verify-backup.sh" "$backup_dir"
archive="$backup_dir/backup.tar.gz"
tar -czf "$archive" -C "$backup_dir" hub.db uploads.tar.gz SHA256SUMS
offsite_payload="$backup_dir"
if [[ -n "${BACKUP_AGE_RECIPIENT:-}" ]]; then
command -v age >/dev/null || { echo "age is required when BACKUP_AGE_RECIPIENT is set" >&2; exit 2; }
age -r "$BACKUP_AGE_RECIPIENT" -o "$archive.age" "$archive"
offsite_payload="$archive.age"
fi
if [[ -n "${BACKUP_OFFSITE_DIR:-}" ]]; then
destination="$BACKUP_OFFSITE_DIR/$stamp"; mkdir -p "$destination"
cp -a "$backup_dir/." "$destination/"
if [[ "$offsite_payload" == "$backup_dir" ]]; then cp -a "$backup_dir/." "$destination/"; else cp -a "$offsite_payload" "$destination/"; fi
printf 'Copied verified backup to: %s\n' "$destination"
fi
if [[ -n "${BACKUP_RCLONE_REMOTE:-}" ]]; then
command -v rclone >/dev/null || { echo "rclone is required when BACKUP_RCLONE_REMOTE is set" >&2; exit 2; }
if [[ "$offsite_payload" == "$backup_dir" ]]; then rclone copy "$backup_dir" "$BACKUP_RCLONE_REMOTE/$stamp"; else rclone copy "$offsite_payload" "$BACKUP_RCLONE_REMOTE/$stamp"; fi
printf 'Copied verified backup using rclone to: %s/%s\n' "$BACKUP_RCLONE_REMOTE" "$stamp"
fi
if [[ -n "${BACKUP_RETENTION_DAYS:-}" ]]; then
[[ "$BACKUP_RETENTION_DAYS" =~ ^[0-9]+$ ]] || { echo "BACKUP_RETENTION_DAYS must be a non-negative integer" >&2; exit 2; }
find data/backups -mindepth 1 -maxdepth 1 -type d -mtime "+$BACKUP_RETENTION_DAYS" -exec rm -rf {} +