first commit

scripts/ops/verify-backup.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" || $# -ne 1 ]]; then
+  cat <<'USAGE'
+Usage:
+  scripts/ops/verify-backup.sh <backup-dir>
+
+Checks:
+  - postgres.sql.gz integrity
+  - checksums.sha256 verification
+USAGE
+  exit 0
+fi
+
+BACKUP_DIR="$1"
+
+if [[ ! -d "$BACKUP_DIR" ]]; then
+  echo "[error] backup directory not found: $BACKUP_DIR" >&2
+  exit 1
+fi
+if [[ ! -f "$BACKUP_DIR/postgres.sql.gz" ]]; then
+  echo "[error] missing postgres.sql.gz in $BACKUP_DIR" >&2
+  exit 1
+fi
+if [[ ! -f "$BACKUP_DIR/checksums.sha256" ]]; then
+  echo "[error] missing checksums.sha256 in $BACKUP_DIR" >&2
+  exit 1
+fi
+
+echo "[step] validating postgres.sql.gz stream..."
+gunzip -t "$BACKUP_DIR/postgres.sql.gz"
+
+echo "[step] validating checksums..."
+(cd "$BACKUP_DIR" && sha256sum -c checksums.sha256)
+
+echo "[ok] backup verified: $BACKUP_DIR"