wangjia
20dbb5f363
实现 xtrabackup + binlog 增量备份、age 加密异地存储与月度 DR 演练。 ## 交付内容 ### deploy/backup/ —— 备份容器 - Dockerfile：Ubuntu 22.04 + xtrabackup 8.0 + age v1.2.0 + AWS CLI v2 + pg_client - entrypoint.sh：初始化 AWS 凭据 / age 公钥，启动 crond - crontab.txt：全量 02:00 / 增量每 15min / DR 演练每月 1 日 - scripts/lib.sh：日志 / age 加密 / S3 上传 / 连接测试等共用函数 - scripts/backup-full.sh：MySQL xtrabackup 全量 + pg_dump 全量 + SQLite 备份 - scripts/backup-inc.sh：MySQL xtrabackup 增量 + binlog flush & 归档 + pg_dump 快照 - scripts/restore.sh：从 S3 下载、解密、prepare / pg_restore 完整恢复 - scripts/dr-drill.sh：月度演练 —— RPO 验证 / 备份完整性 / MySQL 临时容器恢复 / RTO 度量 - scripts/verify-rpo-rto.sh：实时 RPO/RTO 状态检查（S3 最新备份时间戳） - backup.env.example：配置模板（MySQL / PG / S3 / age 公钥） ### 修改已有文件 - deploy/docker-compose.yml：新增 pangolin-backup 服务 - deploy/scripts/gen-secrets.sh：幂等生成 age 密钥对 + backup.env 模板 - .gitignore：排除 age 私钥 / backup.env - deploy/README.md：容器一览 + 备份快速命令 ### docs/备份与灾备.md S3 初始化、IAM 权限设计、age 密钥管理、MySQL 权限、DR 恢复步骤、RTO 测量标准 ## 设计要点 - RPO ≤ 15min：每 15min xtrabackup 增量 + binlog flush + pg_dump 快照 - RTO ≤ 4h：月度演练度量，估算恢复时长约 2h - 独立身份账号：备份 IAM 仅有 s3:PutObject，与生产账号完全隔离 - age 加密：公钥存服务器，私钥离线保存，S3 中无明文 - 无 crontab：cron 在容器内运行，绕过 ec2-user crontab 限制 - 幂等部署：backup.env 存在则跳过，age 密钥对存在则跳过 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
111 lines
3.2 KiB
Bash
111 lines
3.2 KiB
Bash
#!/usr/bin/env bash
|
|
# lib.sh —— 共用函数库，被所有备份脚本 source
|
|
|
|
# ---------- 日志 ----------
|
|
log_info() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [INFO] $*"; }
|
|
log_warn() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [WARN] $*" >&2; }
|
|
log_error() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [ERROR] $*" >&2; }
|
|
log_ok() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [OK] $*"; }
|
|
|
|
# ---------- 默认值 ----------
|
|
: "${BACKUP_DIR:=/backup}"
|
|
: "${MYSQL_HOST:=127.0.0.1}"
|
|
: "${MYSQL_PORT:=3306}"
|
|
: "${PG_HOST:=127.0.0.1}"
|
|
: "${PG_PORT:=5432}"
|
|
: "${BACKUP_AWS_REGION:=ap-southeast-1}"
|
|
: "${AWS_PROFILE:=backup}"
|
|
|
|
# ---------- 通知（Webhook，可选） ----------
|
|
notify() {
|
|
local level="$1"
|
|
local msg="$2"
|
|
log_info "[NOTIFY] ${level}: ${msg}"
|
|
if [ -n "${NOTIFY_WEBHOOK_URL:-}" ]; then
|
|
curl -fsS -X POST "${NOTIFY_WEBHOOK_URL}" \
|
|
-H 'Content-Type: application/json' \
|
|
-d "{\"level\":\"${level}\",\"msg\":$(printf '%s' "${msg}" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))')}" \
|
|
--max-time 10 || true
|
|
fi
|
|
}
|
|
|
|
# ---------- age 加密 ----------
|
|
# 用法: age_encrypt <input_file> <output_file>
|
|
age_encrypt() {
|
|
local src="$1"
|
|
local dst="$2"
|
|
local pubkey_file="${AGE_PUBLIC_KEY_FILE:-/etc/age-public.txt}"
|
|
if [ ! -f "${pubkey_file}" ]; then
|
|
log_error "age 公钥文件不存在: ${pubkey_file}"
|
|
return 1
|
|
fi
|
|
age --encrypt --recipient "$(cat "${pubkey_file}")" -o "${dst}" "${src}"
|
|
}
|
|
|
|
# ---------- S3 上传 ----------
|
|
# 用法: s3_upload <local_file> <s3_path_suffix>
|
|
s3_upload() {
|
|
local src="$1"
|
|
local suffix="$2"
|
|
local dst="s3://${BACKUP_S3_BUCKET}/${BACKUP_S3_PREFIX}/${suffix}"
|
|
log_info "上传 $(basename "${src}") → ${dst}"
|
|
AWS_PROFILE="${AWS_PROFILE}" aws s3 cp \
|
|
--no-progress \
|
|
--storage-class STANDARD_IA \
|
|
"${src}" "${dst}"
|
|
log_ok "上传完成: ${dst}"
|
|
}
|
|
|
|
# ---------- 加密并上传 ----------
|
|
# 用法: encrypt_and_upload <input_file> <s3_suffix>
|
|
encrypt_and_upload() {
|
|
local src="$1"
|
|
local suffix="$2"
|
|
local enc_file="${BACKUP_DIR}/encrypt/$(basename "${src}").age"
|
|
|
|
mkdir -p "${BACKUP_DIR}/encrypt"
|
|
log_info "age 加密: ${src}"
|
|
age_encrypt "${src}" "${enc_file}"
|
|
|
|
s3_upload "${enc_file}" "${suffix}.age"
|
|
|
|
# 删除本地加密临时文件（原始文件由调用方管理）
|
|
rm -f "${enc_file}"
|
|
}
|
|
|
|
# ---------- MySQL 连接测试 ----------
|
|
mysql_ping() {
|
|
mysql \
|
|
--host="${MYSQL_HOST}" \
|
|
--port="${MYSQL_PORT}" \
|
|
--user="${MYSQL_USER:-root}" \
|
|
--password="${MYSQL_PASSWORD}" \
|
|
--connect-timeout=5 \
|
|
-e "SELECT 1" > /dev/null 2>&1
|
|
}
|
|
|
|
# ---------- PostgreSQL 连接测试 ----------
|
|
pg_ping() {
|
|
PGPASSWORD="${PG_PASSWORD:-}" pg_isready \
|
|
--host="${PG_HOST}" \
|
|
--port="${PG_PORT}" \
|
|
--username="${PG_USER:-postgres}" \
|
|
--quiet 2>&1
|
|
}
|
|
|
|
# ---------- 计时工具 ----------
|
|
timer_start() { date +%s; }
|
|
timer_elapsed() {
|
|
local start="$1"
|
|
local end
|
|
end=$(date +%s)
|
|
echo $(( end - start ))
|
|
}
|
|
format_duration() {
|
|
local secs="$1"
|
|
local h=$(( secs / 3600 ))
|
|
local m=$(( (secs % 3600) / 60 ))
|
|
local s=$(( secs % 60 ))
|
|
printf '%dh %dm %ds' "${h}" "${m}" "${s}"
|
|
}
|