wangjia
20dbb5f363
实现 xtrabackup + binlog 增量备份、age 加密异地存储与月度 DR 演练。 ## 交付内容 ### deploy/backup/ —— 备份容器 - Dockerfile：Ubuntu 22.04 + xtrabackup 8.0 + age v1.2.0 + AWS CLI v2 + pg_client - entrypoint.sh：初始化 AWS 凭据 / age 公钥，启动 crond - crontab.txt：全量 02:00 / 增量每 15min / DR 演练每月 1 日 - scripts/lib.sh：日志 / age 加密 / S3 上传 / 连接测试等共用函数 - scripts/backup-full.sh：MySQL xtrabackup 全量 + pg_dump 全量 + SQLite 备份 - scripts/backup-inc.sh：MySQL xtrabackup 增量 + binlog flush & 归档 + pg_dump 快照 - scripts/restore.sh：从 S3 下载、解密、prepare / pg_restore 完整恢复 - scripts/dr-drill.sh：月度演练 —— RPO 验证 / 备份完整性 / MySQL 临时容器恢复 / RTO 度量 - scripts/verify-rpo-rto.sh：实时 RPO/RTO 状态检查（S3 最新备份时间戳） - backup.env.example：配置模板（MySQL / PG / S3 / age 公钥） ### 修改已有文件 - deploy/docker-compose.yml：新增 pangolin-backup 服务 - deploy/scripts/gen-secrets.sh：幂等生成 age 密钥对 + backup.env 模板 - .gitignore：排除 age 私钥 / backup.env - deploy/README.md：容器一览 + 备份快速命令 ### docs/备份与灾备.md S3 初始化、IAM 权限设计、age 密钥管理、MySQL 权限、DR 恢复步骤、RTO 测量标准 ## 设计要点 - RPO ≤ 15min：每 15min xtrabackup 增量 + binlog flush + pg_dump 快照 - RTO ≤ 4h：月度演练度量，估算恢复时长约 2h - 独立身份账号：备份 IAM 仅有 s3:PutObject，与生产账号完全隔离 - age 加密：公钥存服务器，私钥离线保存，S3 中无明文 - 无 crontab：cron 在容器内运行，绕过 ec2-user crontab 限制 - 幂等部署：backup.env 存在则跳过，age 密钥对存在则跳过 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
55 lines
1.9 KiB
Docker
55 lines
1.9 KiB
Docker
FROM ubuntu:22.04
|
|
ARG DEBIAN_FRONTEND=noninteractive
|
|
|
|
# ---------- 基础工具 ----------
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
curl wget ca-certificates gnupg2 lsb-release \
|
|
postgresql-client \
|
|
sqlite3 \
|
|
pigz pv \
|
|
unzip \
|
|
netcat-openbsd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# ---------- AWS CLI v2 ----------
|
|
RUN set -e \
|
|
&& curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip \
|
|
&& unzip -q /tmp/awscliv2.zip -d /tmp/ \
|
|
&& /tmp/aws/install \
|
|
&& rm -rf /tmp/awscliv2.zip /tmp/aws
|
|
|
|
# ---------- age 加密工具 v1.2.0 ----------
|
|
RUN set -e \
|
|
&& AGE_VERSION=v1.2.0 \
|
|
&& wget -q -O /tmp/age.tar.gz \
|
|
"https://github.com/FiloSottile/age/releases/download/${AGE_VERSION}/age-${AGE_VERSION}-linux-amd64.tar.gz" \
|
|
&& tar -xf /tmp/age.tar.gz -C /tmp/ \
|
|
&& install -m 755 /tmp/age/age /usr/local/bin/age \
|
|
&& install -m 755 /tmp/age/age-keygen /usr/local/bin/age-keygen \
|
|
&& rm -rf /tmp/age*
|
|
|
|
# ---------- Percona XtraBackup 8.0 ----------
|
|
RUN set -e \
|
|
&& DISTRO=$(lsb_release -cs) \
|
|
&& wget -q -O /tmp/percona-release.deb \
|
|
"https://repo.percona.com/apt/percona-release_latest.${DISTRO}_all.deb" \
|
|
&& dpkg -i /tmp/percona-release.deb \
|
|
&& percona-release setup pxb80 \
|
|
&& apt-get update && apt-get install -y --no-install-recommends percona-xtrabackup-80 \
|
|
&& rm /tmp/percona-release.deb \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# ---------- 备份脚本 ----------
|
|
COPY scripts/ /scripts/
|
|
COPY entrypoint.sh /entrypoint.sh
|
|
COPY crontab.txt /etc/cron.d/pangolin-backup
|
|
|
|
RUN chmod +x /scripts/*.sh /entrypoint.sh \
|
|
&& chmod 0644 /etc/cron.d/pangolin-backup \
|
|
&& mkdir -p /backup /var/log/backup
|
|
|
|
# cron 日志直接输出到 stdout/stderr
|
|
RUN touch /var/log/backup/cron.log
|
|
|
|
ENTRYPOINT ["/entrypoint.sh"]
|