89 lines
3.0 KiB
Bash
89 lines
3.0 KiB
Bash
|
#!/bin/bash
|
||
|
|
# Vault Raft Snapshot Backup Script
|
||
|
|
# Creates automated backups of Vault cluster
|
||
|
|
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
# Load IP configuration
|
||
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
|
|
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
|
||
|
|
source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
|
||
|
|
|
||
|
|
|
||
|
|
# Colors
|
||
|
|
RED='\033[0;31m'
|
||
|
|
GREEN='\033[0;32m'
|
||
|
|
YELLOW='\033[1;33m'
|
||
|
|
BLUE='\033[0;34m'
|
||
|
|
NC='\033[0m'
|
||
|
|
|
||
|
|
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
|
||
|
|
log_success() { echo -e "${GREEN}[✓]${NC} $1"; }
|
||
|
|
log_warn() { echo -e "${YELLOW}[⚠]${NC} $1"; }
|
||
|
|
log_error() { echo -e "${RED}[✗]${NC} $1"; }
|
||
|
|
|
||
|
|
# Configuration
|
||
|
|
PROXMOX_HOST_1="${PROXMOX_HOST_1:-192.168.11.11}"
|
||
|
|
VAULT_CONTAINER="${VAULT_CONTAINER:-8640}"
|
||
|
|
VAULT_TOKEN="${VAULT_TOKEN:-}"
|
||
|
|
BACKUP_DIR="${BACKUP_DIR:-/home/intlc/projects/proxmox/.secure/vault-backups}"
|
||
|
|
RETENTION_DAYS="${RETENTION_DAYS:-30}"
|
||
|
|
|
||
|
|
if [ -z "$VAULT_TOKEN" ]; then
|
||
|
|
log_error "VAULT_TOKEN environment variable is required"
|
||
|
|
log_info "Usage: VAULT_TOKEN=<token> ./scripts/vault-backup.sh"
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Create backup directory
|
||
|
|
mkdir -p "$BACKUP_DIR"
|
||
|
|
chmod 700 "$BACKUP_DIR"
|
||
|
|
|
||
|
|
# Generate backup filename
|
||
|
|
BACKUP_FILE="$BACKUP_DIR/vault-snapshot-$(date +%Y%m%d-%H%M%S).snapshot"
|
||
|
|
|
||
|
|
echo "═══════════════════════════════════════════════════════════"
|
||
|
|
echo " Vault Raft Snapshot Backup"
|
||
|
|
echo "═══════════════════════════════════════════════════════════"
|
||
|
|
echo ""
|
||
|
|
|
||
|
|
log_info "Creating Raft snapshot..."
|
||
|
|
log_info "Backup file: $BACKUP_FILE"
|
||
|
|
|
||
|
|
# Create snapshot
|
||
|
|
if ssh root@"$PROXMOX_HOST_1" "pct exec $VAULT_CONTAINER -- bash -c 'export VAULT_ADDR=http://127.0.0.1:8200 && export VAULT_TOKEN=$VAULT_TOKEN && vault operator raft snapshot save -'" > "$BACKUP_FILE" 2>/dev/null; then
|
||
|
|
BACKUP_SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
|
||
|
|
log_success "Snapshot created successfully ($BACKUP_SIZE)"
|
||
|
|
else
|
||
|
|
log_error "Failed to create snapshot"
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Compress backup
|
||
|
|
log_info "Compressing backup..."
|
||
|
|
if gzip "$BACKUP_FILE"; then
|
||
|
|
BACKUP_FILE="${BACKUP_FILE}.gz"
|
||
|
|
BACKUP_SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
|
||
|
|
log_success "Backup compressed ($BACKUP_SIZE)"
|
||
|
|
else
|
||
|
|
log_warn "Compression failed, keeping uncompressed backup"
|
||
|
|
fi
|
||
|
|
|
||
|
|
# Clean up old backups
|
||
|
|
log_info "Cleaning up backups older than $RETENTION_DAYS days..."
|
||
|
|
find "$BACKUP_DIR" -name "vault-snapshot-*.snapshot*" -type f -mtime +$RETENTION_DAYS -delete
|
||
|
|
DELETED_COUNT=$(find "$BACKUP_DIR" -name "vault-snapshot-*.snapshot*" -type f | wc -l)
|
||
|
|
log_success "Retained $DELETED_COUNT backup(s)"
|
||
|
|
|
||
|
|
# Create backup index
|
||
|
|
BACKUP_INDEX="$BACKUP_DIR/backup-index.txt"
|
||
|
|
echo "$(date -Iseconds) | $BACKUP_FILE | $(du -h "$BACKUP_FILE" | cut -f1)" >> "$BACKUP_INDEX"
|
||
|
|
log_success "Backup index updated"
|
||
|
|
|
||
|
|
echo ""
|
||
|
|
log_success "✅ Backup completed successfully"
|
||
|
|
log_info "Backup location: $BACKUP_FILE"
|
||
|
|
log_info "To restore: vault operator raft snapshot restore $BACKUP_FILE"
|
||
|
|
|
||
|
|
echo ""
|