twooeyandClaude Sonnet 5
f65581bc50
Two separate leaks were causing the same cosmetic-but-annoying warning to
survive every previous fix attempt:
1. Compose's own `secrets:` block reads the referenced file's *content*
as part of its config model, and applies the same interpolation
warning to it — even with DB_PASSWORD fully removed from every ${VAR}
and --env-file path. Switched from Compose's native `secrets:` to plain
bind mounts at the same /run/secrets/* paths: a bind mount only ever
touches the file's path, never its content, so it's immune. (Verified
this precisely with an isolated repro before rolling it out — the two
mechanisms behave differently even though they look equivalent.)
2. caddy's `env_file: .env.staging` (a leftover from the since-removed
basic-auth setup) loaded the *raw*, unfiltered env file directly,
bypassing deploy.sh/backup.sh/restore.sh's filtered-copy mechanism
entirely. Caddy only ever needed SITE_DOMAIN; switched to passing that
one value directly instead of the whole file.
Also fixed Caddyfile.staging: the site address had no explicit scheme, so
Caddy's automatic-HTTPS logic still applied to a private IP (registering
its own internal CA and redirecting HTTP->HTTPS) — not the "plain HTTP
only" behavior I'd assumed and told the user earlier. Prefixed with
`http://` to genuinely disable automatic HTTPS for this LAN-only box.
Verified end-to-end: fresh deploy with dollar-sign DB passwords produces
zero warnings, serves HTTP 200 on plain http:// with no redirect, and the
DB connection genuinely authenticates.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
51 lines
2.1 KiB
Bash
Executable File
51 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Off-host database + uploads backup (design doc §01, launch gate: "A full
|
|
# backup has been restored successfully into staging" — see restore.sh).
|
|
set -euo pipefail
|
|
|
|
ENVIRONMENT="${1:?Usage: backup.sh <staging|production>}"
|
|
export ENVIRONMENT
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
ENV_FILE=".env.${ENVIRONMENT}"
|
|
# shellcheck source=lib/env.sh
|
|
source "$REPO_ROOT/deploy/lib/env.sh"
|
|
|
|
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
|
|
BACKUP_DIR="$(env_get "$ENV_FILE" BACKUP_DIR)"
|
|
BACKUP_REMOTE="$(env_get "$ENV_FILE" BACKUP_REMOTE)"
|
|
BACKUP_RETENTION_DAYS="$(env_get "$ENV_FILE" BACKUP_RETENTION_DAYS)"
|
|
BACKUP_DIR="${BACKUP_DIR:-./backups}/${ENVIRONMENT}"
|
|
mkdir -p "$BACKUP_DIR"
|
|
|
|
# See deploy.sh for why: Compose warns on any $-shaped value in --env-file
|
|
# even when unused, so DB_PASSWORD/DB_ROOT_PASSWORD are filtered out of the
|
|
# copy Compose actually sees.
|
|
COMPOSE_ENV_FILE="$(mktemp)"
|
|
trap 'rm -f "$COMPOSE_ENV_FILE"' EXIT
|
|
grep -Ev '^(DB_PASSWORD|DB_ROOT_PASSWORD)=' "$ENV_FILE" > "$COMPOSE_ENV_FILE"
|
|
|
|
COMPOSE="docker compose -p bookstore-${ENVIRONMENT} -f docker-compose.yml -f docker-compose.${ENVIRONMENT}.yml --env-file ${COMPOSE_ENV_FILE}"
|
|
|
|
echo "==> dumping database"
|
|
$COMPOSE exec -T db sh -c "exec mariadb-dump -u\"\$MARIADB_USER\" -p\"\$(cat /run/secrets/db_password)\" \"\$MARIADB_DATABASE\"" \
|
|
| gzip > "$BACKUP_DIR/db-${TIMESTAMP}.sql.gz"
|
|
|
|
echo "==> archiving uploads"
|
|
$COMPOSE run --rm -T wordpress tar -czf - -C /var/www/html/wp-content uploads \
|
|
> "$BACKUP_DIR/uploads-${TIMESTAMP}.tar.gz"
|
|
|
|
if [[ -n "${BACKUP_REMOTE:-}" ]]; then
|
|
echo "==> syncing to off-host storage ($BACKUP_REMOTE)"
|
|
rclone copy "$BACKUP_DIR/db-${TIMESTAMP}.sql.gz" "$BACKUP_REMOTE/${ENVIRONMENT}/"
|
|
rclone copy "$BACKUP_DIR/uploads-${TIMESTAMP}.tar.gz" "$BACKUP_REMOTE/${ENVIRONMENT}/"
|
|
else
|
|
echo "==> BACKUP_REMOTE not set — backup stayed local only; configure rclone before launch"
|
|
fi
|
|
|
|
echo "==> pruning local backups older than ${BACKUP_RETENTION_DAYS:-14} days"
|
|
find "$BACKUP_DIR" -type f -mtime "+${BACKUP_RETENTION_DAYS:-14}" -delete
|
|
|
|
echo "==> backup complete: $BACKUP_DIR"
|