mirror of
https://github.com/cole-maxwell1/todo-hetzner.git
synced 2026-10-27 19:02:49 -05:00
cole-maxwell1
d118f52387
Fail before host changes when required deployment variables are missing. Precreate the PostgreSQL temporary directory and escape Bash syntax during Jinja rendering.
57 lines
2.1 KiB
Django/Jinja
57 lines
2.1 KiB
Django/Jinja
#!/bin/bash
|
|
set -Eeuo pipefail
|
|
source /etc/wal-g/db-sync.env
|
|
|
|
expected_pgdata="/var/lib/pgsql/data"
|
|
if [[ "$PGDATA" != "$expected_pgdata" || ! -d "$PGDATA" || "$(stat -c %U "$PGDATA")" != "postgres" ]]; then
|
|
echo "Refusing destructive restore for unexpected PGDATA: $PGDATA" >&2
|
|
exit 1
|
|
fi
|
|
if [[ "$WALG_S3_PREFIX" != s3://*/prod ]]; then
|
|
echo "Refusing restore from a non-production prefix" >&2
|
|
exit 1
|
|
fi
|
|
|
|
systemctl --user --machine="${APP_USER}@" stop app-todo.service || true
|
|
systemctl stop "$POSTGRES_SERVICE"
|
|
|
|
shopt -s dotglob nullglob
|
|
contents=("$PGDATA"/*)
|
|
{% raw %}
|
|
if (( ${#contents[@]} > 0 )); then
|
|
{% endraw %}
|
|
rm -rf --one-file-system -- "${contents[@]}"
|
|
fi
|
|
|
|
sudo -u postgres --preserve-env=AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_ENDPOINT,AWS_REGION,AWS_S3_FORCE_PATH_STYLE,WALG_S3_PREFIX,WALG_COMPRESSION_METHOD \
|
|
/usr/local/bin/wal-g backup-fetch "$PGDATA" LATEST
|
|
chown -R postgres:postgres "$PGDATA"
|
|
chmod 0700 "$PGDATA"
|
|
install -o postgres -g postgres -m 0600 /etc/todo-postgresql/postgresql.conf "$PGDATA/postgresql.conf"
|
|
install -o postgres -g postgres -m 0600 /etc/todo-postgresql/pg_hba.conf "$PGDATA/pg_hba.conf"
|
|
|
|
cat >"$PGDATA/postgresql.auto.conf" <<'RECOVERY'
|
|
restore_command = '/usr/local/sbin/wal-g-postgres wal-fetch %f %p'
|
|
recovery_target_timeline = 'latest'
|
|
RECOVERY
|
|
touch "$PGDATA/recovery.signal"
|
|
chown postgres:postgres "$PGDATA/postgresql.auto.conf" "$PGDATA/recovery.signal"
|
|
|
|
systemctl start "$POSTGRES_SERVICE"
|
|
for _ in {1..120}; do
|
|
if sudo -u postgres psql --dbname=postgres --tuples-only --no-align --command="SELECT NOT pg_is_in_recovery()" 2>/dev/null | grep -qx t; then
|
|
break
|
|
fi
|
|
sleep 2
|
|
done
|
|
if ! sudo -u postgres psql --dbname=postgres --tuples-only --no-align --command="SELECT NOT pg_is_in_recovery()" | grep -qx t; then
|
|
echo "PostgreSQL did not complete recovery" >&2
|
|
exit 1
|
|
fi
|
|
|
|
sudo -u postgres psql --dbname=postgres --set="role=$APP_DB_USER" --set="password=$APP_DB_PASSWORD" <<'SQL'
|
|
SELECT format('ALTER ROLE %I LOGIN PASSWORD %L', :'role', :'password') \gexec
|
|
SQL
|
|
|
|
systemctl --user --machine="${APP_USER}@" start app-todo.service
|