stan/personal-website
1
0
Fork 0
Code Issues 31 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: create deployment backups with allowed Docker permissions
All checks were successful
Test and deploy staging / staging (push) Successful in 2m26s
Details

Browse Source
This commit is contained in:
Stan Runge
2026-10-08 21:10:21 +00:00
parent c2bc9050c2
commit 8eec207f2d
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
scripts/deploy-remote.sh
View File

@@ -48,14 +48,14 @@ backup_dir=/var/backups/personal-website
backup_stamp=$(date -u +%Y%m%dT%H%M%SZ) backup_stamp=$(date -u +%Y%m%dT%H%M%SZ)
backup_name="${environment_name}-${backup_stamp}-${sha}.dump" backup_name="${environment_name}-${backup_stamp}-${sha}.dump"
sudo docker pull "$backup_image" sudo docker pull "$backup_image"
sudo install -d -m 0700 "$backup_dir" # The deploy account can run Docker, but has no general host-file sudo access.
# A bind volume creates the root-owned directory; restrict it before dumping.
sudo docker run --rm --network backend --env-file "$environment" \ sudo docker run --rm --network backend --env-file "$environment" \
--mount "type=bind,source=$backup_dir,target=/backups" \ --volume "$backup_dir:/backups" \
--env "BACKUP_FILE=$backup_name" "$backup_image" \ --env "BACKUP_FILE=$backup_name" "$backup_image" \
sh -eu -c 'pg_dump --format=custom --no-owner --no-acl --file="/backups/$BACKUP_FILE" "$DB_URL"' sh -eu -c 'chmod 0700 /backups; umask 077; pg_dump --format=custom --no-owner --no-acl --file="/backups/$BACKUP_FILE" "$DB_URL"'
sudo docker run --rm --mount "type=bind,source=$backup_dir,target=/backups" \ sudo docker run --rm --mount "type=bind,source=$backup_dir,target=/backups" \
"$backup_image" pg_restore --list "/backups/$backup_name" >/dev/null "$backup_image" pg_restore --list "/backups/$backup_name" >/dev/null
sudo chmod 0600 "$backup_dir/$backup_name"
echo "Verified $environment_name database backup at $backup_dir/$backup_name" echo "Verified $environment_name database backup at $backup_dir/$backup_name"
run_database_script() { run_database_script() {