From eb5ede75f0b16e5dc4c67427a6de34ebbce4c34e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kov=C3=A1cs=20Zolt=C3=A1n?= <kovacsz@marcusconsulting.hu>
Date: Thu, 6 Mar 2025 18:55:00 +0100
Subject: [PATCH] Additional export backups feature.

---
 .metadata                                  | Bin 14515 -> 14916 bytes
 .templates/nginx/nginx_xport.inc           |  18 ++++
 configs/.gitignore                         |   1 +
 configs/xport_backup                       |   3 +
 storage/.gitignore                         |   5 +
 storage/backups/.gitignore                 |   5 +
 storage/backups/export/.gitignore          |   4 +
 storage/backups/export/.rotate_folder.conf |   9 ++
 tools/backup.d/xport_backup.sh             | 105 +++++++++++++++++++++
 9 files changed, 150 insertions(+)
 create mode 100644 .templates/nginx/nginx_xport.inc
 create mode 100644 configs/xport_backup
 create mode 100644 storage/.gitignore
 create mode 100644 storage/backups/.gitignore
 create mode 100644 storage/backups/export/.gitignore
 create mode 100644 storage/backups/export/.rotate_folder.conf
 create mode 100644 tools/backup.d/xport_backup.sh

diff --git a/.metadata b/.metadata
index 782f4981d0916888ae17a983ae5935956afdf6a2..13935af2ee82e076418b6da56bbf5305e9544e27 100644
GIT binary patch
delta 467
zcmdm7c%)=QGaHZagOlkDK=7E$S7>q~x9H@4W!1?BBD|ZgvF%`*+{Q1!mReDeUsN*L
zP)b5*0#vcW)0@&DO&c0FcW^eb@?3?AYyACSHTfg2_T=|ktdp;sXiU!I?|@5Q+V#*1
zWWyvm*~tbLypwI@1Q{JCH}H$WY?#Nd$Skt<<m5tr(an(pw^@0P-G{hMbOE#eVh1r%
z6ak=77LycNHg{;7F-~^j5|fGtyHhVSFPR~`DnBO^N^UuMa&n-A%;cjwl{~&s1DB}I
z5!~#h%gn^Xa1Ua|v8*f7lO4pwHy7v!GU_Jh=cQ$)7wdyfj895T&MqxLF?8Bph_;~G
zc5`s3CFodA{w=4nS>12}<K#36epX1J2?~lcuipmplI-O3M&c+An8Yk24+&coqmjdS
va-f;$<N#Kw$rHFGCR-ZM;5i7jS7~D>+vJDx>XUy9@K0W#V7ocMB$)*OG%ugw

delta 259
zcmX?7vbk_WGaHZR+7syvKw#y#nRD_)QPIf_=3<lW#MviLVBwg2Uy*n7HMSj0o3C)z
zu<|5j%?B&JTfWzHk}O1Jq#WPm3#^=z=kd=&k)NC>p)xr~z<BdJf!nOicf|}R2g-;{
z-XOuV`Hk315yr4dY6_DBSfw@#=r}V@=Hp<SJWscZ`S%PRu(DoG!OaeO&l!2veO&{#
z@$IArsmTwtq&NE+_%cqOpu)ZRzTt1i$$gw0lT}T`nO-$aW>k|0nKxNLhja3MZvM%q
lOlI&*`t>pu<h7+e0g52^ZeUfMY^rEGSwT&0GrO5B3jlX#SSbJi

diff --git a/.templates/nginx/nginx_xport.inc b/.templates/nginx/nginx_xport.inc
new file mode 100644
index 0000000..66362d6
--- /dev/null
+++ b/.templates/nginx/nginx_xport.inc
@@ -0,0 +1,18 @@
+    # Includable nginx configuration.
+    #
+    # Export backups feature.
+    # Needs
+    #   setfacl -m u:www-data:r    [...]/configs/xport_backup
+    #   setfacl -m u:www-data:rx   [...]/storage/backups
+    #   setfacl -d -m u:www-data:r [...]/storage/backups/export
+    # ACLs.
+    location /export {
+        root $PAR_SERVICE/storage/backups;
+        auth_basic "Export backups area";
+        auth_basic_user_file $PAR_SERVICE/configs/xport_backup;
+        allow all;
+        autoindex on;
+        autoindex_exact_size off;
+        autoindex_format html;
+        autoindex_localtime on;
+    }
diff --git a/configs/.gitignore b/configs/.gitignore
index 5daa722..7b9b5b6 100644
--- a/configs/.gitignore
+++ b/configs/.gitignore
@@ -1,4 +1,5 @@
 # Ignore everything else in this directory.
 *
 !certs
+!xport_backup
 !.gitignore
diff --git a/configs/xport_backup b/configs/xport_backup
new file mode 100644
index 0000000..af5f082
--- /dev/null
+++ b/configs/xport_backup
@@ -0,0 +1,3 @@
+# Credentials file for exported backups feature.
+# Needs username:apr1-hashed password entries, one per line.
+# Use https://htpasswd.utils.com/ or some similar to fill in.
diff --git a/storage/.gitignore b/storage/.gitignore
new file mode 100644
index 0000000..171ea04
--- /dev/null
+++ b/storage/.gitignore
@@ -0,0 +1,5 @@
+# Ignore everything in this directory except this folders.
+*
+!.gitignore
+!backups
+!volumes
diff --git a/storage/backups/.gitignore b/storage/backups/.gitignore
new file mode 100644
index 0000000..c8a5ef2
--- /dev/null
+++ b/storage/backups/.gitignore
@@ -0,0 +1,5 @@
+# Ignore everything in this directory except these files.
+*
+!.gitignore
+!export
+!tarballs
diff --git a/storage/backups/export/.gitignore b/storage/backups/export/.gitignore
new file mode 100644
index 0000000..4a4fa60
--- /dev/null
+++ b/storage/backups/export/.gitignore
@@ -0,0 +1,4 @@
+# Ignore everything in this directory except this file.
+*
+!.gitignore
+!.rotate_folder.conf
diff --git a/storage/backups/export/.rotate_folder.conf b/storage/backups/export/.rotate_folder.conf
new file mode 100644
index 0000000..581a596
--- /dev/null
+++ b/storage/backups/export/.rotate_folder.conf
@@ -0,0 +1,9 @@
+# This is a shell script excerpt for configuration purposes only.
+# Handle with care! Please don't put code here, only variables.
+
+CLASSES_PATTERN="^([^.]*)\..*\.$HOSTNAME\.(dmp|sql\.gz|tgz|log)$"
+DOIT="yes"                      # if empty the script makes a dry run
+RETAIN_DAYS=7                   # retains all files created within that many days
+RETAIN_WEEKS=0                  # retains one file per week/month,
+RETAIN_MONTHS=0                 # created within that many weeks/months
+
diff --git a/tools/backup.d/xport_backup.sh b/tools/backup.d/xport_backup.sh
new file mode 100644
index 0000000..953277d
--- /dev/null
+++ b/tools/backup.d/xport_backup.sh
@@ -0,0 +1,105 @@
+#!/bin/bash
+#
+# Optional additional backup operation, intended to export an (almost)
+# up-to-date downloadable copy for our customers about their data
+# handled by us. The script synchronizes some of the existing backup
+# files to an export folder that can be downloaded from the web.
+#
+# Uses the rotate_folder tool to select files to synchronize.
+# This tool must be somewhere in the path.
+#
+# Author: Kovács Zoltán <kovacsz@marcusconsulting.hu>
+# License: GNU/GPL v3+ (https://www.gnu.org/licenses/gpl-3.0.en.html)
+# 2025-03-06 v0.1 Initial release
+
+# Accepted environment variables and their defaults.
+PAR_BASEDIR=${PAR_BASEDIR:-""}                  # Service's base folder
+PAR_DUMPDIR=${PAR_DUMPDIR:-""}                  # Absolute path to DB dumps
+PAR_EXPORTDIR=${PAR_EXPORTDIR:-""}              # Absolute path to export dir
+PAR_RETAINDAYS=${PAR_RETAINDAYS:-"1"}		# Days to retain the copies
+PAR_TARBALLDIR=${PAR_TARBALLDIR:-""}            # Absolute path to tgz dumps
+
+# Other initialisations.
+CLASSES_PATTERN="^([^.]*)\..*\.$HOSTNAME\.(dmp|sql\.gz|tgz|log)$"
+DUMPPATH="storage/backups/dumps"                # Default path to DB dumps
+EXPORTPATH="storage/backups/export"             # Default path to export dir
+TARBALLPATH="storage/backups/tarballs"          # Default path to tgz dumps
+USER=${USER:-LOGNAME}                           # Fix for cron enviroment only
+YMLFILE="docker-compose.yml"
+
+# Messages.
+MSG_MISSINGDEP="Fatal: missing dependency"
+MSG_MISSINGYML="Fatal: didn't find the docker-compose.yml file"
+MSG_NONWRITE="The target directory isn't writable"
+
+# Checks the dependencies.
+TR=$(which tr 2>/dev/null)
+if [ -z "$TR" ]; then echo "$MSG_MISSINGDEP tr."; exit 1 ; fi
+for item in cp cut date dirname grep hostname readlink rotate_folder tar
+do
+    if [ -n "$(which $item)" ]
+    then export $(echo $item | "$TR" '[:lower:]' '[:upper:]' | "$TR" '-' '_')=$(which $item)
+    else echo "$MSG_MISSINGDEP $item." >&2; exit 1; fi
+done
+
+# Where I'm?
+# https://gist.github.com/TheMengzor/968e5ea87e99d9c41782
+SOURCE="$0"
+while [ -h "$SOURCE" ]; do
+    # resolve $SOURCE until the file is no longer a symlink
+    SCRPATH="$( cd -P "$("$DIRNAME" "$SOURCE" )" && pwd )" #"
+    SOURCE="$("$READLINK" "$SOURCE")"
+    # if $SOURCE was a relative symlink, we need to resolve it
+    # relative to the path where the symlink file was located
+    [[ $SOURCE != /* ]] && SOURCE="$SCRPATH/$SOURCE"
+done; SCRPATH="$( cd -P "$("$DIRNAME" "$SOURCE" )" && pwd )" #"
+
+# Searches the base folder, containing a docker-compose.yml file.
+# Called from the base folder (./)?
+BASE_DIR="$PAR_BASEDIR"
+TEST_DIR="$SCRPATH"
+[[ -z "$BASE_DIR" ]] && [[ -r "$TEST_DIR/$YMLFILE" ]] && BASE_DIR="$TEST_DIR"
+# Called from ./tools?
+TEST_DIR="$("$DIRNAME" "$TEST_DIR")"
+[[ -z "$BASE_DIR" ]] && [[ -r "$TEST_DIR/$YMLFILE" ]] && BASE_DIR="$TEST_DIR"
+# Called from ./tools/*.d?
+TEST_DIR="$("$DIRNAME" "$TEST_DIR")"
+[[ -z "$BASE_DIR" ]] && [[ -r "$TEST_DIR/$YMLFILE" ]] && BASE_DIR="$TEST_DIR"
+# On failure gives it up here.
+if [ -z "$BASE_DIR" -o ! -r "$BASE_DIR/$YMLFILE" ]; then
+    echo "$MSG_MISSINGYML" >&2; exit 1
+fi
+# Sets the absolute paths.
+DUMPDIR="${PAR_DUMPDIR:-$BASE_DIR/$DUMPPATH}"
+EXPORTDIR="${PAR_EXPORTDIR:-$BASE_DIR/$EXPORTPATH}"
+TARBALLDIR="${PAR_TARBALLDIR:-$BASE_DIR/$TARBALLPATH}"
+
+# Exits silently if EXPORTDIR isn't present.
+[[ ! -e "$EXPORTDIR" ]] && exit 0
+# EXPORTDIR must be writable.
+[[ ! -w "$EXPORTDIR" ]] \
+&& echo "$MSG_NONWRITE: $BACKUPDIR" >&2 && exit 1
+
+# Let's select and copy the appropriate backup files.
+#
+# We'll call rotate_folder (dry run) with CLASSES_PATTERN and PAR_RETAINDAYS
+# set above to select relevant files created in the backup folders within last
+# PAR_RETAINDAYS days. These files are synchronized with the cp -u statement.
+#
+# Enumerates the folders.
+for folder in "$DUMPDIR" "$TARBALLDIR"
+do
+    # Selects the appropriate files (which have the "DR" - daily retain - tag).
+    for filename in $((export CLASSES_PATTERN="$CLASSES_PATTERN" \
+                              RETAIN_DAYS="$PAR_RETAINDAYS" RETAIN_WEEKS=0 RETAIN_MONTHS=0; \
+                       "$ROTATE_FOLDER" --noconf -f "$folder") | \
+                      "$GREP" '^DR ' | "$CUT" -d' ' -f2) ""
+    do
+	# Updates the current file.
+	if [ -n "$filename" ]; then
+	    "$CP" -u "$folder/$filename" "$EXPORTDIR/" 2>/dev/null
+	fi
+    done
+done
+
+# That's all, Folks! :)