rogee/gochat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

HH-445: deploy production observability and runbooks (#96)

Browse Source 
* HH-445: deploy production observability and runbooks

* fix(ops): share production database DSN

* fix(HH-445): enforce database TLS gate

* fix(HH-445): preserve production serve command

* fix(prod): require external database dependencies

* fix(prod): unify database host rejection gates

* test(prod): enforce exact database TLS runbook contract

---------

Co-authored-by: Rogee <rogee@ipao.vip>
This commit is contained in:
Rogee
2026-08-22 19:39:57 +08:00
committed by GitHub
co-authored by rogee
parent 61376a57fd
commit fb83285617
28 changed files with 1622 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/scripts/db_backup.sh
+19
View File
@@ -5,6 +5,9 @@
set -euo pipefail
umask 077
script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
"$script_dir/database_client_entrypoint.sh" --check
dsn=${GOCHAT_DATABASE_DSN:?GOCHAT_DATABASE_DSN is required}
storage=${GOCHAT_STORAGE_PATH:?GOCHAT_STORAGE_PATH is required}
connector=${GOCHAT_CONNECTOR_BACKUP_FILE:?GOCHAT_CONNECTOR_BACKUP_FILE is required}
@@ -12,6 +15,7 @@ backup_dir=${GOCHAT_BACKUP_DIR:-/var/backups/gochat}
offsite_dir=${GOCHAT_BACKUP_OFFSITE_DIR:?GOCHAT_BACKUP_OFFSITE_DIR is required}
passphrase_file=${GOCHAT_BACKUP_PASSPHRASE_FILE:?GOCHAT_BACKUP_PASSPHRASE_FILE is required}
retention_days=${GOCHAT_BACKUP_RETENTION_DAYS:-30}
metrics_file=${GOCHAT_BACKUP_METRICS_FILE:-}
version=${GOCHAT_VERSION:-unknown}
timestamp=$(date -u +%Y%m%dT%H%M%SZ)
@@ -59,4 +63,19 @@ openssl enc -d -aes-256-cbc -pbkdf2 -pass "file:$passphrase_file" -in "$bundle"
cp "$bundle" "$bundle.sha256" "$offsite_dir/"
find "$backup_dir" "$offsite_dir" -maxdepth 1 -type f -name 'gochat-*.tar.enc*' -mtime "+$retention_days" -delete
if [[ -n $metrics_file ]]; then
install -d -m 0755 "$(dirname "$metrics_file")"
metrics_tmp=$metrics_file.tmp
{
echo '# HELP gochat_backup_last_success_timestamp_seconds Unix time of the last verified off-site backup.'
echo '# TYPE gochat_backup_last_success_timestamp_seconds gauge'
echo "gochat_backup_last_success_timestamp_seconds $created_at_epoch"
echo '# HELP gochat_backup_rpo_target_seconds Maximum allowed age of the latest backup.'
echo '# TYPE gochat_backup_rpo_target_seconds gauge'
echo 'gochat_backup_rpo_target_seconds 86400'
} >"$metrics_tmp"
chmod 0644 "$metrics_tmp"
mv "$metrics_tmp" "$metrics_file"
fi
echo "backup=$bundle offsite=$offsite_dir/$(basename "$bundle") version=$version created_at=$timestamp"