OPS - PLATFORM: add Synology runtime backup workflow

2026-05-14 14:35:51 +03:00
parent 932b9bc7ec
commit d3af184096
3 changed files with 135 additions and 0 deletions
@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NAS_ROOT="${NAS_ROOT:-/Volumes/docker/nodedc-platform}"
+NAS_PLATFORM_DIR="${NAS_PLATFORM_DIR:-/volume1/docker/nodedc-platform/platform}"
+BACKUP_ROOT="${BACKUP_ROOT:-${NAS_ROOT}/backups}"
+TIMESTAMP="${TIMESTAMP:-$(date +%Y%m%d-%H%M%S)}"
+BACKUP_DIR="${BACKUP_DIR:-${BACKUP_ROOT}/platform-current-${TIMESTAMP}}"
+DOCKER_BIN="${DOCKER_BIN:-/usr/local/bin/docker}"
+COMPOSE_FILE="${COMPOSE_FILE:-${NAS_PLATFORM_DIR}/docker-compose.platform-http.yml}"
+ENV_FILE="${ENV_FILE:-${NAS_PLATFORM_DIR}/.env.synology}"
+
+mkdir -p "${BACKUP_DIR}/files/platform" \
+  "${BACKUP_DIR}/files/launcher" \
+  "${BACKUP_DIR}/files/authentik"
+
+rsync_dir() {
+  local source="$1"
+  local destination="$2"
+
+  if [[ -e "${source}" ]]; then
+    rsync -a --delete "${source}" "${destination}"
+  else
+    echo "skip missing: ${source}" | tee -a "${BACKUP_DIR}/warnings.log" >&2
+  fi
+}
+
+rsync_file() {
+  local source="$1"
+  local destination="$2"
+
+  if [[ -f "${source}" ]]; then
+    rsync -a "${source}" "${destination}"
+  else
+    echo "skip missing: ${source}" | tee -a "${BACKUP_DIR}/warnings.log" >&2
+  fi
+}
+
+rsync_dir "${NAS_ROOT}/launcher/server-storage/" "${BACKUP_DIR}/files/launcher/server-storage/"
+rsync_dir "${NAS_ROOT}/launcher/uploads/" "${BACKUP_DIR}/files/launcher/uploads/"
+rsync_dir "${NAS_ROOT}/authentik/custom-templates/" "${BACKUP_DIR}/files/authentik/custom-templates/"
+rsync_dir "${NAS_ROOT}/platform/authentik/" "${BACKUP_DIR}/files/platform/authentik/"
+
+rsync_file "${NAS_ROOT}/platform/.env.synology" "${BACKUP_DIR}/files/platform/"
+rsync_file "${NAS_ROOT}/platform/.env.synology.example" "${BACKUP_DIR}/files/platform/"
+rsync_file "${NAS_ROOT}/platform/docker-compose.platform-http.yml" "${BACKUP_DIR}/files/platform/"
+rsync_file "${NAS_ROOT}/platform/Caddyfile.http" "${BACKUP_DIR}/files/platform/"
+
+cat > "${BACKUP_DIR}/manifest.txt" <<EOF
+NODE.DC platform current backup
+timestamp=${TIMESTAMP}
+nas_root=${NAS_ROOT}
+backup_dir=${BACKUP_DIR}
+
+Contains:
+- Launcher runtime snapshot: launcher/server-storage
+- Launcher uploads: launcher/uploads
+- Authentik custom templates: authentik/custom-templates
+- Platform runtime config: platform/.env.synology, compose, Caddyfile
+
+Secrets:
+- files/platform/.env.synology contains live secrets.
+- Keep this backup private.
+EOF
+
+cat > "${BACKUP_DIR}/run-authentik-db-dump-on-synology.sh" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+
+BACKUP_DIR="/volume1/docker/nodedc-platform/backups/$(basename "${BACKUP_DIR}")"
+cd "${NAS_PLATFORM_DIR}"
+
+sudo "${DOCKER_BIN}" compose \\
+  --env-file "${ENV_FILE}" \\
+  -f "${COMPOSE_FILE}" \\
+  exec -T postgresql-authentik \\
+  sh -lc 'pg_dump -U "\${POSTGRES_USER:-authentik}" -d "\${POSTGRES_DB:-authentik}" --format=custom --no-owner --no-acl' \\
+  > "\${BACKUP_DIR}/authentik-postgres.dump"
+
+sudo "${DOCKER_BIN}" compose \\
+  --env-file "${ENV_FILE}" \\
+  -f "${COMPOSE_FILE}" \\
+  exec -T postgresql-authentik \\
+  sh -lc 'pg_restore --list /dev/stdin >/dev/null' \\
+  < "\${BACKUP_DIR}/authentik-postgres.dump"
+
+if command -v sha256sum >/dev/null 2>&1; then
+  (cd "\${BACKUP_DIR}" && sha256sum authentik-postgres.dump > SHA256SUMS)
+else
+  (cd "\${BACKUP_DIR}" && shasum -a 256 authentik-postgres.dump > SHA256SUMS)
+fi
+
+echo "authentik-db-dump-ok: \${BACKUP_DIR}/authentik-postgres.dump"
+EOF
+chmod +x "${BACKUP_DIR}/run-authentik-db-dump-on-synology.sh"
+
+find "${BACKUP_DIR}" -name @eaDir -prune -o -type d -exec chmod 700 {} \;
+find "${BACKUP_DIR}" -name @eaDir -prune -o -type f -exec chmod 600 {} \;
+chmod 700 "${BACKUP_DIR}/run-authentik-db-dump-on-synology.sh"
+
+if [[ -x "${DOCKER_BIN}" && "${NAS_ROOT}" == /volume1/* ]]; then
+  "${BACKUP_DIR}/run-authentik-db-dump-on-synology.sh"
+else
+  cat <<EOF
+file-backup-ok: ${BACKUP_DIR}
+
+DB dump was not run from this host.
+Run on Synology:
+
+bash /volume1/docker/nodedc-platform/backups/$(basename "${BACKUP_DIR}")/run-authentik-db-dump-on-synology.sh
+EOF
+fi