first commit

scripts/ops/backup-prod.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENV_FILE="${1:-$ROOT_DIR/.env.production}"
+BACKUP_ROOT="${2:-$ROOT_DIR/backups}"
+COMPOSE_FILE="$ROOT_DIR/infra/docker-compose.prod.yml"
+
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  cat <<'USAGE'
+Usage:
+  scripts/ops/backup-prod.sh [env-file] [backup-root]
+
+Examples:
+  scripts/ops/backup-prod.sh
+  scripts/ops/backup-prod.sh .env.production /var/backups/productier
+
+Behavior:
+  - Validates production env configuration.
+  - Creates a timestamped backup directory.
+  - Dumps PostgreSQL to postgres.sql.gz.
+  - Syncs S3-compatible object data to s3/ via rustfs-init container.
+  - Writes SHA256 checksums and metadata.json.
+USAGE
+  exit 0
+fi
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "[error] env file not found: $ENV_FILE" >&2
+  exit 1
+fi
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "[error] docker CLI is required" >&2
+  exit 1
+fi
+
+node "$ROOT_DIR/scripts/check-production-env.mjs" "$ENV_FILE"
+
+timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
+backup_dir="$BACKUP_ROOT/$timestamp"
+tmp_backup_dir="$BACKUP_ROOT/.tmp-$timestamp-$$"
+mkdir -p "$tmp_backup_dir/s3"
+
+echo "[info] writing backup to $backup_dir"
+
+echo "[step] backing up postgres..."
+docker compose --env-file "$ENV_FILE" -f "$COMPOSE_FILE" exec -T postgres \
+  pg_dump -U productier -d productier --format=plain --no-owner --no-privileges \
+  | gzip -9 > "$tmp_backup_dir/postgres.sql.gz"
+
+echo "[step] backing up object storage..."
+docker compose --env-file "$ENV_FILE" -f "$COMPOSE_FILE" run --rm --no-deps \
+  -v "$tmp_backup_dir/s3:/backup" \
+  --entrypoint /bin/sh \
+  rustfs-init \
+  -lc 'set -euo pipefail; endpoint="http://rustfs:9000"; aws --endpoint-url "$endpoint" s3 sync "s3://${S3_BUCKET:-productier}" /backup --no-progress'
+
+echo "[step] writing checksums..."
+(
+  cd "$tmp_backup_dir"
+  sha256sum postgres.sql.gz > checksums.sha256
+  if find s3 -type f -print -quit | grep -q .; then
+    find s3 -type f -print0 | sort -z | xargs -0 sha256sum >> checksums.sha256
+  fi
+)
+
+cat > "$tmp_backup_dir/metadata.json" <<EOF
+{
+  "createdAt": "$timestamp",
+  "envFile": "$(basename "$ENV_FILE")",
+  "postgresDump": "postgres.sql.gz",
+  "objectStorageDir": "s3",
+  "composeFile": "infra/docker-compose.prod.yml"
+}
+EOF
+
+mv "$tmp_backup_dir" "$backup_dir"
+
+echo "[ok] backup complete: $backup_dir"