89 lines
3.1 KiB
Bash
Executable File
89 lines
3.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Restore Athena's non-reproducible Docker state from the latest /data backup.
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
CHECK_ONLY=false
|
|
if [[ ${1:-} == --check ]]; then
|
|
CHECK_ONLY=true
|
|
shift
|
|
fi
|
|
ARCHIVE=${1:-/data/docker-backups/athena-latest.tar.gz}
|
|
if [[ $ARCHIVE == latest ]]; then
|
|
ARCHIVE=/data/docker-backups/athena-latest.tar.gz
|
|
fi
|
|
|
|
die() { printf 'FEHLER: %s\n' "$*" >&2; exit 1; }
|
|
[[ -s $ARCHIVE ]] || die "Backup fehlt: $ARCHIVE"
|
|
|
|
validate_archive() {
|
|
local listing normalized entry required
|
|
gzip -t "$ARCHIVE" || die "Backup ist beschädigt: $ARCHIVE"
|
|
listing=$(tar -tzf "$ARCHIVE") || die "Backup-Inhalt kann nicht gelesen werden."
|
|
|
|
# docker-volume-backup stores the mounted sources below /backup. GNU tar
|
|
# removes the leading slash while extracting; accept exactly that tree and
|
|
# reject every unrelated or traversing member before extracting as root.
|
|
while IFS= read -r entry; do
|
|
normalized=${entry#./}
|
|
normalized=${normalized#/}
|
|
[[ $normalized == backup || $normalized == backup/* ]] || \
|
|
die "Unerwarteter Pfad im Backup: $entry"
|
|
[[ /$normalized/ != */../* ]] || die "Unsicherer Pfad im Backup: $entry"
|
|
done <<<"$listing"
|
|
|
|
for required in backup/etc-mike-ai backup/volumes; do
|
|
grep -Eq "^/?${required}(/|$)" <<<"$listing" || \
|
|
die "Backup enthält $required nicht."
|
|
done
|
|
}
|
|
|
|
validate_archive
|
|
if [[ $CHECK_ONLY == true ]]; then
|
|
printf 'ATHENA_BACKUP_CHECK_OK %s\n' "$ARCHIVE"
|
|
exit 0
|
|
fi
|
|
|
|
[[ $EUID -eq 0 ]] || die "Bitte als root ausführen."
|
|
command -v docker >/dev/null || die "Docker fehlt. Zuerst ./install.sh ausführen."
|
|
|
|
work=$(mktemp -d /tmp/athena-restore.XXXXXX)
|
|
trap 'rm -rf "$work"' EXIT
|
|
|
|
# GNU tar removes the leading slash and extracts the single validated tree as
|
|
# $work/backup. Keeping that root explicit avoids platform-dependent
|
|
# --strip-components behaviour between GNU tar and bsdtar.
|
|
tar -xzf "$ARCHIVE" -C "$work"
|
|
backup_root=$work/backup
|
|
[[ -d $backup_root/etc-mike-ai ]] || die "Backup enthält etc-mike-ai nicht."
|
|
[[ -d $backup_root/volumes ]] || die "Backup enthält keine Docker-Volumes."
|
|
|
|
# Stop only users of the restored volumes. WireGuard, SSH and networking stay up.
|
|
for container in mike-ai-router mike-ai-profile-controller mike-ai-piper; do
|
|
if [[ $(docker inspect -f '{{.State.Running}}' "$container" 2>/dev/null || true) == true ]]; then
|
|
docker stop "$container" >/dev/null
|
|
fi
|
|
done
|
|
|
|
install -d -m 0700 /etc/mike-ai
|
|
rsync -a --delete "$backup_root/etc-mike-ai/" /etc/mike-ai/
|
|
|
|
restore_volume() {
|
|
local volume=$1 source=$2 mountpoint
|
|
[[ -d $source ]] || return 0
|
|
docker volume create "$volume" >/dev/null
|
|
mountpoint=$(docker volume inspect -f '{{.Mountpoint}}' "$volume")
|
|
[[ -n $mountpoint && -d $mountpoint ]] || die "Volume nicht zugreifbar: $volume"
|
|
rsync -a --delete "$source/" "$mountpoint/"
|
|
}
|
|
|
|
restore_volume mike-ai_piper-data "$backup_root/volumes/piper-data"
|
|
restore_volume mike-ai_router-state "$backup_root/volumes/router-state"
|
|
restore_volume mike-ai_router-images "$backup_root/volumes/router-images"
|
|
|
|
cd "$ROOT_DIR"
|
|
./manage.sh deploy core
|
|
|
|
printf 'ATHENA_RESTORE_OK %s\n' "$ARCHIVE"
|