feat: harden control-plane deployment

2026-09-12 11:09:42 +08:00
parent 13c31fc902
commit 0d29b828bb
22 changed files with 1213 additions and 71 deletions
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: $0 backup <data-file> <backup-dir> | restore <backup-file> <data-file>" >&2
+  exit 2
+}
+
+[ "$#" -eq 3 ] || usage
+command=$1
+source=$2
+target=$3
+
+case "$command" in
+  backup)
+    [ -f "$source" ] || { echo "data file does not exist: $source" >&2; exit 1; }
+    mkdir -p "$target"
+    name="$(basename "$source").$(date -u +%Y%m%dT%H%M%SZ).manual.json"
+    temporary="$target/.wxagent-backup-$$.tmp"
+    trap 'rm -f "$temporary"' EXIT
+    install -m 600 "$source" "$temporary"
+    mv -f "$temporary" "$target/$name"
+    sha256sum "$target/$name"
+    ;;
+  restore)
+    [ -f "$source" ] || { echo "backup file does not exist: $source" >&2; exit 1; }
+    directory=$(dirname "$target")
+    mkdir -p "$directory"
+    lock="$target.lock"
+    exec 9>"$lock"
+    flock -n 9 || { echo "data file is in use; stop the active control plane first" >&2; exit 1; }
+    temporary="$directory/.wxagent-restore-$$.tmp"
+    trap 'rm -f "$temporary"' EXIT
+    install -m 600 "$source" "$temporary"
+    python3 -m json.tool "$temporary" >/dev/null
+    mv -f "$temporary" "$target"
+    sha256sum "$target"
+    ;;
+  *)
+    usage
+    ;;
+esac