545 lines
12 KiB
Bash
Executable File
545 lines
12 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
umask 077
|
||
|
||
###############################################################################
|
||
# backup-bdd-recette.sh
|
||
#
|
||
# Ce script réalise une sauvegarde logique de plusieurs bases PostgreSQL
|
||
# définies dans le fichier .env, exporte également la liste des rôles/users,
|
||
# puis transfère l’ensemble vers une machine distante de stockage.
|
||
#
|
||
# Fonctionnement global :
|
||
# 1. charge la configuration depuis le fichier .env ;
|
||
# 2. vérifie les dépendances nécessaires ;
|
||
# 3. prépare les chemins, logs et variables de connexion ;
|
||
# 4. empêche l’exécution simultanée grâce à un verrou ;
|
||
# 5. crée les dossiers de destination sur la machine distante ;
|
||
# 6. exporte les rôles PostgreSQL ;
|
||
# 7. dump chaque base au format personnalisé PostgreSQL ;
|
||
# 8. transfère chaque fichier vers le serveur distant ;
|
||
# 9. applique une rotation distante sur 10 jours ;
|
||
# 10. envoie un bilan sur Discord :
|
||
# - 1 message global si tout est OK ;
|
||
# - en cas d’erreur partielle :
|
||
# * USERS OK -> message simple ;
|
||
# * USERS KO -> message détaillé ;
|
||
# * DB OK -> message simple ;
|
||
# * DB KO -> message détaillé.
|
||
###############################################################################
|
||
|
||
#######################################
|
||
# Chargement du .env
|
||
#######################################
|
||
|
||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
ENV_FILE="${SCRIPT_DIR}/.env"
|
||
|
||
if [[ ! -f "$ENV_FILE" ]]; then
|
||
echo "ERROR: fichier .env introuvable : $ENV_FILE" >&2
|
||
exit 1
|
||
fi
|
||
|
||
set -a
|
||
# shellcheck disable=SC1090
|
||
source "$ENV_FILE"
|
||
set +a
|
||
|
||
#######################################
|
||
# Vérification des variables requises
|
||
#######################################
|
||
|
||
: "${ENV_NAME:?Variable ENV_NAME manquante}"
|
||
: "${PGHOST:?Variable PGHOST manquante}"
|
||
: "${PGPORT:?Variable PGPORT manquante}"
|
||
: "${PGUSER:?Variable PGUSER manquante}"
|
||
: "${PGPASSWORD:?Variable PGPASSWORD manquante}"
|
||
: "${DBS:?Variable DBS manquante}"
|
||
: "${BACKUP_REMOTE_USER:?Variable BACKUP_REMOTE_USER manquante}"
|
||
: "${BACKUP_REMOTE_HOST:?Variable BACKUP_REMOTE_HOST manquante}"
|
||
: "${BACKUP_REMOTE_DIR:?Variable BACKUP_REMOTE_DIR manquante}"
|
||
: "${SSH_KEY:?Variable SSH_KEY manquante}"
|
||
: "${SSH_TIMEOUT:?Variable SSH_TIMEOUT manquante}"
|
||
: "${BACKUP_LOG_DIR:?Variable BACKUP_LOG_DIR manquante}"
|
||
|
||
#######################################
|
||
# Configuration principale
|
||
#######################################
|
||
|
||
read -r -a DBS_ARRAY <<< "$DBS"
|
||
|
||
validate_db_name() {
|
||
local db_name="$1"
|
||
|
||
[[ -n "$db_name" ]] || {
|
||
echo "ERROR: nom de base vide dans DBS" >&2
|
||
exit 1
|
||
}
|
||
|
||
[[ "$db_name" =~ ^[a-zA-Z0-9_]+$ ]] || {
|
||
echo "ERROR: nom de base invalide dans DBS : $db_name" >&2
|
||
exit 1
|
||
}
|
||
}
|
||
|
||
for DB in "${DBS_ARRAY[@]}"; do
|
||
validate_db_name "$DB"
|
||
done
|
||
|
||
IA_SSH="${BACKUP_REMOTE_USER}@${BACKUP_REMOTE_HOST}"
|
||
RETENTION_DAYS=10
|
||
BACKUP_REMOTE_SSH_PORT="${BACKUP_REMOTE_SSH_PORT:-22}"
|
||
BACKUP_KNOWN_HOSTS_STRICT="${BACKUP_KNOWN_HOSTS_STRICT:-yes}"
|
||
BACKUP_KNOWN_HOSTS_FILE="${BACKUP_KNOWN_HOSTS_FILE:-${HOME}/.ssh/known_hosts}"
|
||
|
||
[[ "$BACKUP_REMOTE_SSH_PORT" =~ ^[0-9]+$ ]] || {
|
||
echo "ERROR: BACKUP_REMOTE_SSH_PORT invalide" >&2
|
||
exit 1
|
||
}
|
||
|
||
[[ "$PGPORT" =~ ^[0-9]+$ ]] || {
|
||
echo "ERROR: PGPORT invalide" >&2
|
||
exit 1
|
||
}
|
||
|
||
[[ "$SSH_TIMEOUT" =~ ^[0-9]+$ ]] || {
|
||
echo "ERROR: SSH_TIMEOUT invalide" >&2
|
||
exit 1
|
||
}
|
||
|
||
[[ "$PGUSER" =~ ^[a-zA-Z0-9_][a-zA-Z0-9_-]*$ ]] || {
|
||
echo "ERROR: PGUSER invalide" >&2
|
||
exit 1
|
||
}
|
||
|
||
case "${BACKUP_KNOWN_HOSTS_STRICT,,}" in
|
||
yes|y|oui|o|true|1) BACKUP_KNOWN_HOSTS_STRICT="yes" ;;
|
||
no|n|non|false|0) BACKUP_KNOWN_HOSTS_STRICT="no" ;;
|
||
*)
|
||
echo "ERROR: BACKUP_KNOWN_HOSTS_STRICT invalide" >&2
|
||
exit 1
|
||
;;
|
||
esac
|
||
|
||
mkdir -p "$(dirname "$BACKUP_KNOWN_HOSTS_FILE")"
|
||
chmod 700 "$(dirname "$BACKUP_KNOWN_HOSTS_FILE")" || true
|
||
touch "$BACKUP_KNOWN_HOSTS_FILE"
|
||
chmod 600 "$BACKUP_KNOWN_HOSTS_FILE" || true
|
||
|
||
SSH_OPTS=(
|
||
-i "$SSH_KEY"
|
||
-p "$BACKUP_REMOTE_SSH_PORT"
|
||
-o IdentitiesOnly=yes
|
||
-o BatchMode=yes
|
||
-o ConnectTimeout="${SSH_TIMEOUT}"
|
||
-o StrictHostKeyChecking="${BACKUP_KNOWN_HOSTS_STRICT}"
|
||
-o UserKnownHostsFile="${BACKUP_KNOWN_HOSTS_FILE}"
|
||
)
|
||
|
||
SCP_OPTS=(
|
||
-i "$SSH_KEY"
|
||
-P "$BACKUP_REMOTE_SSH_PORT"
|
||
-o IdentitiesOnly=yes
|
||
-o BatchMode=yes
|
||
-o ConnectTimeout="${SSH_TIMEOUT}"
|
||
-o StrictHostKeyChecking="${BACKUP_KNOWN_HOSTS_STRICT}"
|
||
-o UserKnownHostsFile="${BACKUP_KNOWN_HOSTS_FILE}"
|
||
)
|
||
|
||
LOG_DIR="${BACKUP_LOG_DIR}"
|
||
mkdir -p "$LOG_DIR"
|
||
|
||
TS="$(date +'%Y-%m-%d_%H-%M-%S')"
|
||
BACKUP_DIR_NAME="backup_${TS}"
|
||
LOG_FILE="${LOG_DIR}/${BACKUP_DIR_NAME}.log"
|
||
|
||
TMP_DIR="$(mktemp -d /tmp/pg_dump_XXXXXX)" || {
|
||
echo "ERROR: impossible de créer le dossier temporaire" >&2
|
||
exit 1
|
||
}
|
||
|
||
exec > >(tee -a "$LOG_FILE") 2>&1
|
||
|
||
log() { echo "---- $(date +'%Y-%m-%d %H:%M:%S') ---- $*"; }
|
||
|
||
require_cmd() {
|
||
command -v "$1" >/dev/null 2>&1
|
||
}
|
||
|
||
safe_remove_dir() {
|
||
local dir="${1:-}"
|
||
[[ -n "$dir" ]] || return 0
|
||
[[ "$dir" == /tmp/pg_dump_* ]] || {
|
||
log "WARNING: suppression refusée pour le chemin inattendu : $dir"
|
||
return 1
|
||
}
|
||
rm -rf -- "$dir"
|
||
}
|
||
|
||
export PGPASSWORD
|
||
|
||
#######################################
|
||
# Vérification dépendances minimales
|
||
#######################################
|
||
|
||
for cmd in ssh scp curl jq pg_dump pg_dumpall mktemp; do
|
||
require_cmd "$cmd" || {
|
||
echo "ERROR: commande manquante : $cmd" >&2
|
||
exit 1
|
||
}
|
||
done
|
||
|
||
[[ -f "$SSH_KEY" ]] || {
|
||
echo "ERROR: clé SSH introuvable : $SSH_KEY" >&2
|
||
exit 1
|
||
}
|
||
|
||
[[ -r "$SSH_KEY" ]] || {
|
||
echo "ERROR: clé SSH non lisible : $SSH_KEY" >&2
|
||
exit 1
|
||
}
|
||
|
||
[[ ! -L "$SSH_KEY" ]] || {
|
||
echo "ERROR: la clé SSH ne doit pas être un lien symbolique : $SSH_KEY" >&2
|
||
exit 1
|
||
}
|
||
|
||
chmod 600 "$SSH_KEY" || true
|
||
|
||
#######################################
|
||
# Configuration Discord
|
||
#######################################
|
||
|
||
DISCORD_WEBHOOK_URL="${DISCORD_WEBHOOK_URL:-}"
|
||
DISCORD_PING="${DISCORD_PING:-@here}"
|
||
|
||
discord_send() {
|
||
local msg="$1"
|
||
[[ -z "${DISCORD_WEBHOOK_URL:-}" ]] && return 0
|
||
|
||
local payload
|
||
payload="$(jq -n --arg content "$msg" '{content: $content}')" || {
|
||
log "ERROR: impossible de construire le payload JSON Discord"
|
||
return 1
|
||
}
|
||
|
||
curl -fsS \
|
||
-H "Content-Type: application/json" \
|
||
-d "$payload" \
|
||
"$DISCORD_WEBHOOK_URL" >/dev/null || true
|
||
}
|
||
|
||
#######################################
|
||
# Message global OK
|
||
#######################################
|
||
|
||
discord_msg_global_ok() {
|
||
local msg
|
||
msg="$(cat <<EOF
|
||
**BACKUP BDD ${ENV_NAME} 🟢**
|
||
Name: ${BACKUP_DIR_NAME}
|
||
Dumps transfer: ✅
|
||
Users transfer: ✅
|
||
EOF
|
||
)"
|
||
discord_send "$msg"
|
||
}
|
||
|
||
#######################################
|
||
# Messages USERS
|
||
#######################################
|
||
|
||
discord_msg_users_ok_simple() {
|
||
local msg
|
||
msg="$(cat <<EOF
|
||
**BACKUP BDD ${ENV_NAME} 🟢**
|
||
Users backup validé
|
||
EOF
|
||
)"
|
||
discord_send "$msg"
|
||
}
|
||
|
||
discord_msg_users_error() {
|
||
local export_ok="$1"
|
||
local transfer_ok="$2"
|
||
local details="$3"
|
||
|
||
local export_disp transfer_disp
|
||
export_disp=$([[ -n "$export_ok" ]] && echo "✅" || echo "❌")
|
||
transfer_disp=$([[ -n "$transfer_ok" ]] && echo "✅" || echo "❌")
|
||
|
||
local msg
|
||
if [[ -n "$details" ]]; then
|
||
msg="$(cat <<EOF
|
||
**${DISCORD_PING} BACKUP BDD ${ENV_NAME} 🔴**
|
||
Name: ${BACKUP_DIR_NAME}
|
||
Users export: ${export_disp}
|
||
Users transfer: ${transfer_disp}
|
||
Details: ${details}
|
||
EOF
|
||
)"
|
||
else
|
||
msg="$(cat <<EOF
|
||
**${DISCORD_PING} BACKUP BDD ${ENV_NAME} 🔴**
|
||
Name: ${BACKUP_DIR_NAME}
|
||
Users export: ${export_disp}
|
||
Users transfer: ${transfer_disp}
|
||
EOF
|
||
)"
|
||
fi
|
||
|
||
discord_send "$msg"
|
||
}
|
||
|
||
#######################################
|
||
# Messages DB
|
||
#######################################
|
||
|
||
discord_msg_db_ok_simple() {
|
||
local db="$1"
|
||
local msg
|
||
msg="$(cat <<EOF
|
||
**BACKUP BDD ${ENV_NAME} 🟢**
|
||
Backup validé : ${db}
|
||
EOF
|
||
)"
|
||
discord_send "$msg"
|
||
}
|
||
|
||
discord_msg_db_error() {
|
||
local db="$1"
|
||
local dump_ok="$2"
|
||
local transfer_ok="$3"
|
||
local details="$4"
|
||
|
||
local dump_disp transfer_disp
|
||
dump_disp=$([[ -n "$dump_ok" ]] && echo "✅" || echo "❌")
|
||
transfer_disp=$([[ -n "$transfer_ok" ]] && echo "✅" || echo "❌")
|
||
|
||
local msg
|
||
if [[ -n "$details" ]]; then
|
||
msg="$(cat <<EOF
|
||
**${DISCORD_PING} BACKUP BDD ${ENV_NAME} 🔴**
|
||
Name: ${BACKUP_DIR_NAME}
|
||
Database: ${db}
|
||
Dump: ${dump_disp}
|
||
Transfer: ${transfer_disp}
|
||
Details: ${details}
|
||
EOF
|
||
)"
|
||
else
|
||
msg="$(cat <<EOF
|
||
**${DISCORD_PING} BACKUP BDD ${ENV_NAME} 🔴**
|
||
Name: ${BACKUP_DIR_NAME}
|
||
Database: ${db}
|
||
Dump: ${dump_disp}
|
||
Transfer: ${transfer_disp}
|
||
EOF
|
||
)"
|
||
fi
|
||
|
||
discord_send "$msg"
|
||
}
|
||
|
||
#######################################
|
||
# Variables de statut globales
|
||
#######################################
|
||
|
||
DUMPS_OK=true
|
||
USERS_OK=true
|
||
|
||
USERS_EXPORT_OK=true
|
||
USERS_TRANSFER_OK=true
|
||
USERS_DETAILS=""
|
||
|
||
declare -A DB_DUMP_OK
|
||
declare -A DB_TRANSFER_OK
|
||
declare -A DB_DETAILS
|
||
|
||
#######################################
|
||
# Verrou d’exécution
|
||
#######################################
|
||
|
||
LOCK_DIR="/tmp/pg_multi_dump_stream.lock.d"
|
||
|
||
if ! mkdir "$LOCK_DIR" 2>/dev/null; then
|
||
log "ERROR: Backup déjà en cours"
|
||
discord_msg_users_error "" "" "Lock already exists"
|
||
exit 1
|
||
fi
|
||
|
||
cleanup() {
|
||
rm -rf -- "$LOCK_DIR"
|
||
safe_remove_dir "$TMP_DIR" || true
|
||
}
|
||
trap cleanup EXIT
|
||
|
||
#######################################
|
||
# Préparation du dossier distant
|
||
#######################################
|
||
|
||
log "Creating remote directories"
|
||
|
||
MKDIR_CMD="mkdir -p '${BACKUP_REMOTE_DIR}/user'"
|
||
for DB in "${DBS_ARRAY[@]}"; do
|
||
MKDIR_CMD+=" '${BACKUP_REMOTE_DIR}/${DB}'"
|
||
done
|
||
|
||
if ! ssh "${SSH_OPTS[@]}" "$IA_SSH" "$MKDIR_CMD"; then
|
||
log "ERROR: remote mkdir failed"
|
||
discord_msg_users_error "" "" "Remote mkdir failed"
|
||
exit 1
|
||
fi
|
||
|
||
#######################################
|
||
# Export des rôles PostgreSQL
|
||
#######################################
|
||
|
||
ROLES_FILE="${TMP_DIR}/user_${TS}.sql"
|
||
|
||
set +e
|
||
|
||
log "Export des rôles PostgreSQL"
|
||
|
||
pg_dumpall \
|
||
-h "$PGHOST" \
|
||
-p "$PGPORT" \
|
||
-U "$PGUSER" \
|
||
--globals-only \
|
||
> "$ROLES_FILE"
|
||
|
||
RET=$?
|
||
|
||
if [[ $RET -ne 0 ]]; then
|
||
USERS_OK=
|
||
USERS_EXPORT_OK=
|
||
USERS_DETAILS="roles export failed"
|
||
else
|
||
log "Export des rôles OK : $ROLES_FILE"
|
||
fi
|
||
|
||
if [[ -n "${USERS_EXPORT_OK:-}" ]]; then
|
||
scp "${SCP_OPTS[@]}" "$ROLES_FILE" "$IA_SSH:${BACKUP_REMOTE_DIR}/user/"
|
||
RET=$?
|
||
|
||
if [[ $RET -ne 0 ]]; then
|
||
USERS_OK=
|
||
USERS_TRANSFER_OK=
|
||
if [[ -n "$USERS_DETAILS" ]]; then
|
||
USERS_DETAILS+=" | roles transfer failed"
|
||
else
|
||
USERS_DETAILS="roles transfer failed"
|
||
fi
|
||
else
|
||
log "Transfert des rôles OK"
|
||
fi
|
||
fi
|
||
|
||
set -e
|
||
|
||
#######################################
|
||
# Dump des bases
|
||
#######################################
|
||
|
||
set +e
|
||
|
||
for DB in "${DBS_ARRAY[@]}"; do
|
||
FILE="${TMP_DIR}/${DB}_${TS}.dump"
|
||
|
||
DB_DUMP_OK["$DB"]=true
|
||
DB_TRANSFER_OK["$DB"]=true
|
||
DB_DETAILS["$DB"]=""
|
||
|
||
log "Dump $DB"
|
||
|
||
pg_dump -h "$PGHOST" -p "$PGPORT" -U "$PGUSER" -Fc -d "$DB" -f "$FILE"
|
||
RET=$?
|
||
|
||
if [[ $RET -ne 0 ]]; then
|
||
DUMPS_OK=
|
||
DB_DUMP_OK["$DB"]=
|
||
DB_TRANSFER_OK["$DB"]=
|
||
DB_DETAILS["$DB"]="dump failed"
|
||
continue
|
||
fi
|
||
|
||
scp "${SCP_OPTS[@]}" "$FILE" "$IA_SSH:${BACKUP_REMOTE_DIR}/${DB}/"
|
||
RET=$?
|
||
|
||
if [[ $RET -ne 0 ]]; then
|
||
DUMPS_OK=
|
||
DB_TRANSFER_OK["$DB"]=
|
||
DB_DETAILS["$DB"]="transfer failed"
|
||
fi
|
||
done
|
||
|
||
set -e
|
||
|
||
#######################################
|
||
# Rotation distante
|
||
#######################################
|
||
|
||
log "Starting remote rotation: delete backups older than ${RETENTION_DAYS} days"
|
||
|
||
set +e
|
||
|
||
ssh "${SSH_OPTS[@]}" "$IA_SSH" "find '${BACKUP_REMOTE_DIR}/user' -type f -name 'user_*.sql' -mtime +${RETENTION_DAYS} -delete"
|
||
RET=$?
|
||
|
||
if [[ $RET -ne 0 ]]; then
|
||
log "ERROR: remote rotation failed for users"
|
||
else
|
||
log "Remote rotation OK for users"
|
||
fi
|
||
|
||
for DB in "${DBS_ARRAY[@]}"; do
|
||
ssh "${SSH_OPTS[@]}" "$IA_SSH" "find '${BACKUP_REMOTE_DIR}/${DB}' -type f -name '${DB}_*.dump' -mtime +${RETENTION_DAYS} -delete"
|
||
RET=$?
|
||
|
||
if [[ $RET -ne 0 ]]; then
|
||
log "ERROR: remote rotation failed for ${DB}"
|
||
else
|
||
log "Remote rotation OK for ${DB}"
|
||
fi
|
||
done
|
||
|
||
set -e
|
||
|
||
log "Remote rotation finished"
|
||
|
||
#######################################
|
||
# Nettoyage local
|
||
#######################################
|
||
|
||
safe_remove_dir "$TMP_DIR" || true
|
||
|
||
#######################################
|
||
# Bilan final Discord
|
||
#######################################
|
||
|
||
MODE_KO=
|
||
|
||
[[ -z "${DUMPS_OK:-}" ]] && MODE_KO=true
|
||
[[ -z "${USERS_OK:-}" ]] && MODE_KO=true
|
||
|
||
if [[ -z "${MODE_KO:-}" ]]; then
|
||
discord_msg_global_ok
|
||
exit 0
|
||
fi
|
||
|
||
if [[ -n "${USERS_EXPORT_OK:-}" && -n "${USERS_TRANSFER_OK:-}" ]]; then
|
||
discord_msg_users_ok_simple
|
||
else
|
||
discord_msg_users_error "${USERS_EXPORT_OK:+true}" "${USERS_TRANSFER_OK:+true}" "$USERS_DETAILS"
|
||
fi
|
||
|
||
for DB in "${DBS_ARRAY[@]}"; do
|
||
if [[ -n "${DB_DUMP_OK[$DB]:-}" && -n "${DB_TRANSFER_OK[$DB]:-}" ]]; then
|
||
discord_msg_db_ok_simple "$DB"
|
||
else
|
||
discord_msg_db_error "$DB" "${DB_DUMP_OK[$DB]:+true}" "${DB_TRANSFER_OK[$DB]:+true}" "${DB_DETAILS[$DB]}"
|
||
fi
|
||
done
|
||
|
||
exit 2
|