115 lines
5.2 KiB
Bash
Executable file
115 lines
5.2 KiB
Bash
Executable file
#!/bin/sh
|
|
set -eu
|
|
|
|
[ "$(id -u)" = "0" ] || { echo "FAIL must_run_as_root"; exit 1; }
|
|
umask 077
|
|
|
|
rclone_image='rclone/rclone@sha256:623378ad0ff3ebd5cebf77720843c0e02edfe46e2d5b5ac6bed54c6371780dfb'
|
|
restic_image='restic/restic@sha256:424a4e1fcc6fe2557b5614239dc71a2c793acb33a83ea217171bd7edc1862dcb'
|
|
base=/volume1/xtao-data/backup-controller
|
|
ssd=/volume2/xtao-backup/backup-controller
|
|
bin="$base/bin"
|
|
tmp=$(mktemp -d /tmp/xtao-backup-controller.XXXXXX)
|
|
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
|
|
|
|
mkdir -p "$bin" "$base/canary-source" "$ssd/restores" "$ssd/logs"
|
|
chmod 700 "$base" "$bin" "$base/canary-source" "$ssd" "$ssd/restores" "$ssd/logs"
|
|
|
|
/usr/local/bin/xtao-secret-agent raw-field --entry external/google-drive/offsite-backup --field rclone_token_json > "$tmp/token.json"
|
|
/usr/local/bin/xtao-secret-agent raw-field --entry external/google-drive/offsite-backup --field root_folder_id > "$tmp/root_folder_id"
|
|
/usr/local/bin/xtao-secret-agent raw-field --entry external/google-drive/offsite-backup --field oauth_client_id > "$tmp/oauth_client_id"
|
|
/usr/local/bin/xtao-secret-agent raw-field --entry external/google-drive/offsite-backup --field oauth_client_secret > "$tmp/oauth_client_secret"
|
|
/usr/local/bin/xtao-secret-agent raw-field --entry backup/google-drive/restic-repository --field password > "$tmp/restic.pass"
|
|
chmod 600 "$tmp/token.json" "$tmp/root_folder_id" "$tmp/oauth_client_id" "$tmp/oauth_client_secret" "$tmp/restic.pass"
|
|
|
|
python3 - "$tmp/token.json" "$tmp/root_folder_id" "$tmp/oauth_client_id" "$tmp/oauth_client_secret" "$tmp/rclone.conf" <<'PY'
|
|
import json, pathlib, sys
|
|
token_path, root_path, client_id_path, client_secret_path, config_path = map(pathlib.Path, sys.argv[1:])
|
|
token = token_path.read_text(encoding="utf-8").strip()
|
|
json.loads(token)
|
|
root = root_path.read_text(encoding="utf-8").strip()
|
|
if not root or root == "CODEX_GENERATE":
|
|
raise SystemExit("FAIL invalid_root_folder_id")
|
|
client_id = client_id_path.read_text(encoding="utf-8").strip()
|
|
client_secret = client_secret_path.read_text(encoding="utf-8").strip()
|
|
client_lines = ""
|
|
if client_id and client_id != "NONE":
|
|
client_lines += f"client_id = {client_id}\n"
|
|
if client_secret:
|
|
client_lines += f"client_secret = {client_secret}\n"
|
|
config_path.write_text(
|
|
"[xtao-gdrive]\n"
|
|
"type = drive\n"
|
|
"scope = drive.file\n"
|
|
f"{client_lines}"
|
|
f"root_folder_id = {root}\n"
|
|
f"token = {token}\n",
|
|
encoding="utf-8",
|
|
)
|
|
PY
|
|
chmod 600 "$tmp/rclone.conf"
|
|
|
|
if [ ! -x "$bin/rclone" ]; then
|
|
cid=$(/usr/local/bin/docker create --entrypoint /bin/sh "$rclone_image" -c true)
|
|
/usr/local/bin/docker cp "$cid:/usr/local/bin/rclone" "$tmp/rclone"
|
|
/usr/local/bin/docker rm "$cid" >/dev/null
|
|
install -m 700 "$tmp/rclone" "$bin/rclone"
|
|
fi
|
|
|
|
canary_name="phase02-canary-$(date -u +%Y%m%dT%H%M%SZ).txt"
|
|
printf 'xtao backup controller canary %s\n' "$canary_name" > "$tmp/canary.txt"
|
|
sha256sum "$tmp/canary.txt" | awk '{print $1}' > "$tmp/canary.sha256"
|
|
|
|
/usr/local/bin/docker run --rm --network bridge \
|
|
-v "$tmp:/config/rclone" \
|
|
-v "$tmp:/work" \
|
|
"$rclone_image" copyto /work/canary.txt "xtao-gdrive:phase02-canary/$canary_name" >/dev/null
|
|
/usr/local/bin/docker run --rm --network bridge \
|
|
-v "$tmp:/config/rclone" \
|
|
-v "$tmp:/work" \
|
|
"$rclone_image" copyto "xtao-gdrive:phase02-canary/$canary_name" /work/canary.download >/dev/null
|
|
sha256sum "$tmp/canary.download" | awk '{print $1}' > "$tmp/canary.download.sha256"
|
|
cmp "$tmp/canary.sha256" "$tmp/canary.download.sha256"
|
|
/usr/local/bin/docker run --rm --network bridge \
|
|
-v "$tmp:/config/rclone" \
|
|
"$rclone_image" deletefile "xtao-gdrive:phase02-canary/$canary_name" >/dev/null
|
|
|
|
sample="$base/canary-source/sample.txt"
|
|
printf 'xtao restic restore sample %s\n' "$canary_name" > "$sample"
|
|
sha256sum "$sample" | awk '{print $1}' > "$tmp/sample.sha256"
|
|
|
|
restic_env="-e RCLONE_CONFIG=/config/rclone/rclone.conf -e RESTIC_PASSWORD_FILE=/secrets/restic.pass -e RESTIC_REPOSITORY=rclone:xtao-gdrive:restic/nas"
|
|
set +e
|
|
/usr/local/bin/docker run --rm --network bridge \
|
|
-v "$tmp:/config/rclone" \
|
|
-v "$tmp/restic.pass:/secrets/restic.pass:ro" \
|
|
-v "$bin/rclone:/usr/local/bin/rclone:ro" \
|
|
$restic_env \
|
|
"$restic_image" init >/tmp/xtao-restic-init.out 2>&1
|
|
rc=$?
|
|
set -e
|
|
if [ "$rc" -ne 0 ] && ! grep -Eq 'already initialized|config file already exists' /tmp/xtao-restic-init.out; then
|
|
cat /tmp/xtao-restic-init.out
|
|
echo "FAIL restic_init"
|
|
exit 2
|
|
fi
|
|
/usr/local/bin/docker run --rm --network bridge \
|
|
-v "$tmp:/config/rclone" \
|
|
-v "$tmp/restic.pass:/secrets/restic.pass:ro" \
|
|
-v "$bin/rclone:/usr/local/bin/rclone:ro" \
|
|
-v "$base/canary-source:/data/canary-source:ro" \
|
|
$restic_env \
|
|
"$restic_image" backup /data/canary-source >/tmp/xtao-restic-backup.out
|
|
restore="$tmp/restore"
|
|
mkdir -p "$restore"
|
|
/usr/local/bin/docker run --rm --network bridge \
|
|
-v "$tmp:/config/rclone" \
|
|
-v "$tmp/restic.pass:/secrets/restic.pass:ro" \
|
|
-v "$bin/rclone:/usr/local/bin/rclone:ro" \
|
|
-v "$restore:/restore" \
|
|
$restic_env \
|
|
"$restic_image" restore latest --target /restore >/tmp/xtao-restic-restore.out
|
|
sha256sum "$restore/data/canary-source/sample.txt" | awk '{print $1}' > "$tmp/restore.sha256"
|
|
cmp "$tmp/sample.sha256" "$tmp/restore.sha256"
|
|
cp "$tmp/restore.sha256" "$ssd/logs/last-restore.sha256"
|
|
echo "PASS backup_controller gdrive_canary=PASS restic_backup_restore=PASS values=redacted"
|