wangjia
b42a70ff3b
backup.yml 原 runs-on ubuntu-latest 无对应 runner、落盘 NAS 路径在 mac runner 不存在，长期跑不起来。 改为 runs-on mac + scripts/ci/backup-db.sh：复用 lib-forgejo 的 ssh 封装连 EC2， 在 EC2 端从 production.env 读 DSN 密码 mysqldump（零额外 secret），流回本机 ~/jiu-db-backups gzip 落盘、保留 30 天、完整性校验，恢复每日 02:00 定时 + Telegram 成败通知。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx
42 lines
1.7 KiB
Bash
42 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
# backup-db.sh — dump the production MySQL (jiu_db) from EC2 and keep a gzip
|
|
# snapshot on the mac (host) runner's local disk (~/jiu-db-backups), retaining
|
|
# the last 30 days. The DB password is read on EC2 from production.env's
|
|
# DATABASE_DSN, so no DB-password secret is needed.
|
|
#
|
|
# Requires env (same as deploy-server): EC2_SSH_KEY, EC2_HOST, EC2_USER.
|
|
set -euo pipefail
|
|
|
|
# shellcheck source=scripts/ci/lib-forgejo.sh
|
|
. "$(dirname "$0")/lib-forgejo.sh"
|
|
|
|
BACKUP_DIR="${HOME}/jiu-db-backups"
|
|
mkdir -p "${BACKUP_DIR}"
|
|
FILENAME="jiu_db_$(date +%Y%m%d_%H%M%S).sql.gz"
|
|
DEST="${BACKUP_DIR}/${FILENAME}"
|
|
|
|
setup_ssh
|
|
trap teardown_ssh EXIT
|
|
|
|
echo "==> backup-db: dumping jiu_db from ${EC2_HOST}"
|
|
# On EC2: parse the DSN password from production.env, then mysqldump the
|
|
# container to stdout; stream back over ssh and gzip locally. The heredoc is
|
|
# single-quoted, so it runs verbatim on EC2 (no local expansion). ${SSH} carries
|
|
# no -t, keeping stdout a clean dump stream.
|
|
${SSH} "${EC2_USER}@${EC2_HOST}" 'bash -s' <<'ENDSSH' | gzip > "${DEST}"
|
|
set -euo pipefail
|
|
PW=$(python3 -c 'import re;e=open("/opt/jiu/config/production.env").read();d=re.search(r"DATABASE_DSN=(.*)",e).group(1).strip().strip(chr(34)).strip(chr(39));print(re.match(r"[^:]+:([^@]+)@",d).group(1))')
|
|
exec docker exec -e MYSQL_PWD="${PW}" jiu_mysql mysqldump -uroot --single-transaction --no-tablespaces jiu_db
|
|
ENDSSH
|
|
|
|
# Integrity + sanity + retention.
|
|
gzip -t "${DEST}"
|
|
SIZE=$(stat -f%z "${DEST}" 2>/dev/null || stat -c%s "${DEST}")
|
|
if [ "${SIZE}" -lt 100000 ]; then
|
|
echo "==> backup-db: dump suspiciously small (${SIZE} bytes), aborting" >&2
|
|
rm -f "${DEST}"
|
|
exit 1
|
|
fi
|
|
find "${BACKUP_DIR}" -name '*.sql.gz' -mtime +30 -delete
|
|
echo "==> backup-db: saved ${DEST} (${SIZE} bytes)"
|