89 lines
3.2 KiB
Bash
89 lines
3.2 KiB
Bash
 
|
#!/bin/bash
|
||
|
|
# Nightly logical backup of the webmail database.
|
||
|
|
#
|
||
|
|
# Runs as a long-lived sidecar: sleeps until BACKUP_AT, dumps, verifies, prunes,
|
||
|
|
# repeats. `docker compose run --rm backup once` takes a single backup now (this
|
||
|
|
# is what `deploy/webmail.sh backup` does, e.g. immediately before an update).
|
||
|
|
#
|
||
|
|
# Why logical dumps and not just a NAS snapshot: a btrfs/Hyper Backup snapshot of
|
||
|
|
# a *running* Postgres data directory is crash-consistent, which usually replays
|
||
|
|
# fine but is not guaranteed and cannot be restored into a different Postgres
|
||
|
|
# version. A pg_dump is version-portable and verifiable. Keep both.
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
BACKUP_DIR="${BACKUP_DIR:-/backups}"
|
||
|
|
BACKUP_AT="${BACKUP_AT:-03:30}"
|
||
|
|
BACKUP_KEEP_DAYS="${BACKUP_KEEP_DAYS:-14}"
|
||
|
|
DB="${PGDATABASE:-webmail}"
|
||
|
|
|
||
|
|
log() { echo "[backup $(date -Is)] $*"; }
|
||
|
|
|
||
|
|
take_backup() {
|
||
|
|
local stamp out globals
|
||
|
|
stamp="$(date +%Y%m%d-%H%M%S)"
|
||
|
|
out="${BACKUP_DIR}/${DB}-${stamp}.dump"
|
||
|
|
globals="${BACKUP_DIR}/globals-${stamp}.sql"
|
||
|
|
|
||
|
|
log "dumping ${DB} -> $(basename "$out")"
|
||
|
|
# -Fc: compressed custom format, restorable selectively with pg_restore.
|
||
|
|
if ! pg_dump --format=custom --compress=6 --file="${out}.partial" "$DB"; then
|
||
|
|
log "ERROR: pg_dump failed; leaving no partial file"
|
||
|
|
rm -f "${out}.partial"
|
||
|
|
return 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Verify the archive is readable before it counts as a backup.
|
||
|
|
if ! pg_restore --list "${out}.partial" >/dev/null 2>&1; then
|
||
|
|
log "ERROR: dump failed verification (pg_restore --list); discarding"
|
||
|
|
rm -f "${out}.partial"
|
||
|
|
return 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
mv "${out}.partial" "$out"
|
||
|
|
chmod 600 "$out"
|
||
|
|
|
||
|
|
# Roles/passwords live outside the database; tiny, and makes a restore onto a
|
||
|
|
# bare Postgres one step shorter.
|
||
|
|
pg_dumpall --globals-only --file="$globals" 2>/dev/null || true
|
||
|
|
[ -f "$globals" ] && chmod 600 "$globals"
|
||
|
|
|
||
|
|
ln -sfn "$(basename "$out")" "${BACKUP_DIR}/latest.dump"
|
||
|
|
log "ok: $(du -h "$out" | cut -f1) $(basename "$out")"
|
||
|
|
|
||
|
|
log "pruning dumps older than ${BACKUP_KEEP_DAYS} days"
|
||
|
|
find "$BACKUP_DIR" -maxdepth 1 -name "${DB}-*.dump" -mtime "+${BACKUP_KEEP_DAYS}" -print -delete || true
|
||
|
|
find "$BACKUP_DIR" -maxdepth 1 -name "globals-*.sql" -mtime "+${BACKUP_KEEP_DAYS}" -print -delete || true
|
||
|
|
}
|
||
|
|
|
||
|
|
seconds_until() {
|
||
|
|
local target now next
|
||
|
|
target="$1"
|
||
|
|
now=$(date +%s)
|
||
|
|
next=$(date -d "today ${target}" +%s 2>/dev/null || echo 0)
|
||
|
|
if [ "$next" -le "$now" ]; then
|
||
|
|
next=$(date -d "tomorrow ${target}" +%s)
|
||
|
|
fi
|
||
|
|
echo $(( next - now ))
|
||
|
|
}
|
||
|
|
|
||
|
|
if [ "${1:-}" = "once" ]; then
|
||
|
|
take_backup
|
||
|
|
exit $?
|
||
|
|
fi
|
||
|
|
|
||
|
|
log "backup sidecar started; schedule ${BACKUP_AT} daily, retention ${BACKUP_KEEP_DAYS} days"
|
||
|
|
|
||
|
|
# Baseline on first start: if there is no dump from the last 24 h, take one now
|
||
|
|
# rather than leaving a fresh install unprotected until the first scheduled run.
|
||
|
|
if ! find "$BACKUP_DIR" -maxdepth 1 -name "${DB}-*.dump" -mtime -1 | grep -q .; then
|
||
|
|
log "no recent dump found; taking a baseline backup"
|
||
|
|
take_backup || log "baseline backup failed; will retry on schedule"
|
||
|
|
fi
|
||
|
|
|
||
|
|
while true; do
|
||
|
|
wait_s="$(seconds_until "$BACKUP_AT")"
|
||
|
|
log "next backup in ${wait_s}s (at ${BACKUP_AT})"
|
||
|
|
sleep "$wait_s"
|
||
|
|
take_backup || log "scheduled backup failed; continuing"
|
||
|
|
done
|