From eaa54b767b45a7a4ae48a32d5cd9c0edd0373fb0 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 07:46:56 +0200 Subject: [PATCH 01/31] feat(backup): add automated DB backup script, rsync support and Gitea CI secret integration --- .env.example | 15 ++ .gitea/workflows/ci-prod.yml | 25 ++++ scripts/backup_db.sh | 259 +++++++++++++++++++++++++++++++++++ 3 files changed, 299 insertions(+) create mode 100755 scripts/backup_db.sh diff --git a/.env.example b/.env.example index 2ef2222..9e0c81f 100644 --- a/.env.example +++ b/.env.example @@ -17,6 +17,21 @@ SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE=true # Expéditeur E-mail (doit être un expéditeur validé dans Brevo) APP_MAIL_FROM=astalange1933@gmail.com +# Configuration Sauvegarde Automatique & API Brevo (v3) +BREVO_API_KEY=xkeysib-votre_cle_api_brevo +NOTIFICATION_EMAIL=astalange1933@gmail.com +BACKUP_DIR=/var/backups/as-talange +RETENTION_DAYS=7 + +# Optionnel: Transfert automatique de la sauvegarde de la BDD vers le VPS via SCP/SSH +ENABLE_REMOTE_COPY=false +REMOTE_HOST=votre-vps-ip-ou-domaine +REMOTE_USER=root +REMOTE_PORT=22 +REMOTE_BACKUP_DIR=/var/backups/as-talange +SSH_KEY_PATH=/home/user/.ssh/id_rsa + # Configuration Captcha (si applicable) CAPTCHA_SITEKEY= CAPTCHA_SECRET= + diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 093682e..5b19b6d 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -49,14 +49,26 @@ jobs: env: PROD_DB_USER: ${{ secrets.PROD_DB_USER }} PROD_DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }} + PROD_DB_NAME: ${{ secrets.PROD_DB_NAME }} CAPTCHA_SECRET: ${{ secrets.CAPTCHA_SECRET }} CAPTCHA_SITEKEY: ${{ secrets.CAPTCHA_SITEKEY }} MAIL_USERNAME: ${{ secrets.MAIL_USERNAME }} MAIL_PASSWORD: ${{ secrets.MAIL_PASSWORD }} MAIL_FROM: ${{ secrets.MAIL_FROM }} + BREVO_API_KEY: ${{ secrets.BREVO_API_KEY }} + NOTIFICATION_EMAIL: ${{ secrets.NOTIFICATION_EMAIL }} + BACKUP_DIR: ${{ secrets.BACKUP_DIR }} + RETENTION_DAYS: ${{ secrets.RETENTION_DAYS }} + ENABLE_REMOTE_COPY: ${{ secrets.ENABLE_REMOTE_COPY }} + REMOTE_HOST: ${{ secrets.REMOTE_HOST }} + REMOTE_USER: ${{ secrets.REMOTE_USER }} + REMOTE_PORT: ${{ secrets.REMOTE_PORT }} + REMOTE_BACKUP_DIR: ${{ secrets.REMOTE_BACKUP_DIR }} + SSH_KEY_PATH: ${{ secrets.SSH_KEY_PATH }} run: | echo "POSTGRES_USER=${PROD_DB_USER:-myuser}" > .env echo "POSTGRES_PASSWORD=${PROD_DB_PASSWORD:-mypassword}" >> .env + [ -n "${PROD_DB_NAME}" ] && echo "POSTGRES_DB=${PROD_DB_NAME}" >> .env echo "CAPTCHA_SECRET=${CAPTCHA_SECRET:-1x0000000000000000000000000000000AA}" >> .env echo "CAPTCHA_SITEKEY=${CAPTCHA_SITEKEY:-1x00000000000000000000AA}" >> .env if [ -n "${MAIL_USERNAME}" ]; then @@ -70,6 +82,19 @@ jobs: echo "APP_MAIL_FROM=${MAIL_FROM}" >> .env fi fi + # Configuration des sauvegardes de BDD + [ -n "${BREVO_API_KEY}" ] && echo "BREVO_API_KEY=${BREVO_API_KEY}" >> .env + [ -n "${NOTIFICATION_EMAIL}" ] && echo "NOTIFICATION_EMAIL=${NOTIFICATION_EMAIL}" >> .env + [ -n "${BACKUP_DIR}" ] && echo "BACKUP_DIR=${BACKUP_DIR}" >> .env + [ -n "${RETENTION_DAYS}" ] && echo "RETENTION_DAYS=${RETENTION_DAYS}" >> .env + if [ "${ENABLE_REMOTE_COPY}" = "true" ]; then + echo "ENABLE_REMOTE_COPY=true" >> .env + [ -n "${REMOTE_HOST}" ] && echo "REMOTE_HOST=${REMOTE_HOST}" >> .env + [ -n "${REMOTE_USER}" ] && echo "REMOTE_USER=${REMOTE_USER}" >> .env + [ -n "${REMOTE_PORT}" ] && echo "REMOTE_PORT=${REMOTE_PORT}" >> .env + [ -n "${REMOTE_BACKUP_DIR}" ] && echo "REMOTE_BACKUP_DIR=${REMOTE_BACKUP_DIR}" >> .env + [ -n "${SSH_KEY_PATH}" ] && echo "SSH_KEY_PATH=${SSH_KEY_PATH}" >> .env + fi docker compose down app || true docker compose up -d --build app diff --git a/scripts/backup_db.sh b/scripts/backup_db.sh new file mode 100755 index 0000000..0e9b36a --- /dev/null +++ b/scripts/backup_db.sh @@ -0,0 +1,259 @@ +#!/usr/bin/env bash +# ============================================================================== +# Script de sauvegarde automatisée de la base de données PostgreSQL AS Talange +# Exécution : Sur le serveur distant / interne hébergeant la base de données +# Rétention : 7 jours glissants (en local et sur le serveur de stockage VPS) +# Transfert : Copie sécurisée via SCP/SSH vers le serveur VPS (optionnel) +# Notification : Email de bilan (Succès/Échec + Logs) via l'API Brevo +# ============================================================================== + +set -u + +# Localisation du répertoire du script et du projet +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +PROJECT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)" + +# Chargement du fichier .env si présent dans le projet +if [ -f "${PROJECT_DIR}/.env" ]; then + set -a + source "${PROJECT_DIR}/.env" + set +a +fi + +# Variables de configuration (avec valeurs par défaut) +BACKUP_DIR="${BACKUP_DIR:-${PROJECT_DIR}/backups}" +RETENTION_DAYS="${RETENTION_DAYS:-7}" + +DB_NAME="${POSTGRES_DB:-astalange}" +DB_USER="${POSTGRES_USER:-myuser}" +DB_PASSWORD="${POSTGRES_PASSWORD:-mypassword}" +DB_HOST="${POSTGRES_HOST:-localhost}" +DB_PORT="${POSTGRES_PORT:-5432}" +CONTAINER_NAME="${DOCKER_CONTAINER_NAME:-astalange_db}" + +# Configuration du transfert distant vers le VPS (optionnel) +ENABLE_REMOTE_COPY="${ENABLE_REMOTE_COPY:-false}" +REMOTE_HOST="${REMOTE_HOST:-}" +REMOTE_USER="${REMOTE_USER:-root}" +REMOTE_PORT="${REMOTE_PORT:-22}" +REMOTE_BACKUP_DIR="${REMOTE_BACKUP_DIR:-/var/backups/as-talange}" +SSH_KEY_PATH="${SSH_KEY_PATH:-${HOME}/.ssh/id_rsa}" + +# Configuration Brevo +BREVO_API_KEY="${BREVO_API_KEY:-}" +BREVO_SENDER_EMAIL="${APP_MAIL_FROM:-astalange1933@gmail.com}" +BREVO_SENDER_NAME="${BREVO_SENDER_NAME:-AS Talange Backup}" +RECIPIENT_EMAIL="${NOTIFICATION_EMAIL:-astalange1933@gmail.com}" + +# Fichier journal temporaire pour cette exécution +TIMESTAMP=$(date +"%Y-%m-%d_%H%M%S") +DATE_HUMAN=$(date +"%d/%m/%Y à %H:%M:%S") +LOG_FILE=$(mktemp /tmp/astalange_backup_${TIMESTAMP}_XXXXXX.log) +DUMP_FILENAME="astalange_db_backup_${TIMESTAMP}.sql.gz" +DUMP_PATH="${BACKUP_DIR}/${DUMP_FILENAME}" + +STATUS="SUCCESS" +DUMP_SIZE="0 KB" + +log() { + echo "[$(date +'%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" +} + +log "======================================================================" +log " Démarrage du script de sauvegarde AS Talange (Serveur BDD)" +log "======================================================================" +log "Date d'exécution : ${DATE_HUMAN}" +log "Dossier local de sauvegarde : ${BACKUP_DIR}" +log "Fichier cible : ${DUMP_FILENAME}" +log "Rétention : ${RETENTION_DAYS} jours" + +# 1. Création du répertoire de sauvegarde local si nécessaire +if ! mkdir -p "$BACKUP_DIR" >> "$LOG_FILE" 2>&1; then + log "ERREUR: Impossible de créer le dossier de sauvegarde local ${BACKUP_DIR}" + STATUS="FAILURE" +fi + +# 2. Déroulement du Dump PostgreSQL +if [ "$STATUS" = "SUCCESS" ]; then + log "Démarrage de l'extraction (dump) de la base de données..." + + # Vérification si le conteneur Docker est actif + if command -v docker >/dev/null 2>&1 && docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then + log "Mode détection: Conteneur Docker '${CONTAINER_NAME}' trouvé. Utilisation de pg_dump via docker exec." + docker exec -e PGPASSWORD="${DB_PASSWORD}" "${CONTAINER_NAME}" pg_dump -U "${DB_USER}" -d "${DB_NAME}" | gzip > "$DUMP_PATH" 2>> "$LOG_FILE" + DUMP_EXIT_CODE=${PIPESTATUS[0]} + else + log "Mode détection: Exécution directe de pg_dump (hôte local)." + PGPASSWORD="${DB_PASSWORD}" pg_dump -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER}" -d "${DB_NAME}" | gzip > "$DUMP_PATH" 2>> "$LOG_FILE" + DUMP_EXIT_CODE=${PIPESTATUS[0]} + fi + + if [ ${DUMP_EXIT_CODE} -eq 0 ] && [ -s "$DUMP_PATH" ]; then + DUMP_SIZE=$(du -h "$DUMP_PATH" | cut -f1) + log "✅ Dump généré avec succès ! Taille du fichier : ${DUMP_SIZE}" + else + log "❌ ERREUR lors de l'extraction de la base de données (code de sortie: ${DUMP_EXIT_CODE})." + STATUS="FAILURE" + rm -f "$DUMP_PATH" + fi +fi + +# 3. Transfert sécurisé RSYNC / SCP vers le serveur VPS (Optionnel) +if [ "$STATUS" = "SUCCESS" ] && [ "$ENABLE_REMOTE_COPY" = "true" ] && [ -n "$REMOTE_HOST" ]; then + log "Transfert du dump vers le serveur VPS distant (${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_BACKUP_DIR})..." + + SSH_CMD="ssh -i ${SSH_KEY_PATH} -p ${REMOTE_PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=10" + + # Création du dossier distant si nécessaire + $SSH_CMD "${REMOTE_USER}@${REMOTE_HOST}" "mkdir -p ${REMOTE_BACKUP_DIR}" >> "$LOG_FILE" 2>&1 + + TRANSFER_SUCCESS=false + + # Privilégier rsync si disponible + if command -v rsync >/dev/null 2>&1; then + log "Utilisation de RSYNC pour le transfert..." + RSYNC_CMD="rsync -avz -e \"ssh -i ${SSH_KEY_PATH} -p ${REMOTE_PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=10\"" + if eval $RSYNC_CMD "$DUMP_PATH" "${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_BACKUP_DIR}/${DUMP_FILENAME}" >> "$LOG_FILE" 2>&1; then + TRANSFER_SUCCESS=true + fi + fi + + # Fallback vers SCP si rsync échoue ou n'est pas installé + if [ "$TRANSFER_SUCCESS" = "false" ]; then + log "Utilisation de SCP pour le transfert..." + SCP_CMD="scp -i ${SSH_KEY_PATH} -P ${REMOTE_PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=10" + if $SCP_CMD "$DUMP_PATH" "${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_BACKUP_DIR}/${DUMP_FILENAME}" >> "$LOG_FILE" 2>&1; then + TRANSFER_SUCCESS=true + fi + fi + + if [ "$TRANSFER_SUCCESS" = "true" ]; then + log "✅ Copie distante vers le VPS réussie !" + + # Nettoyage des sauvegardes distantes sur le VPS (> 7 jours) + log "Nettoyage des sauvegardes distantes de plus de ${RETENTION_DAYS} jours sur le VPS..." + $SSH_CMD "${REMOTE_USER}@${REMOTE_HOST}" "find ${REMOTE_BACKUP_DIR} -type f -name 'astalange_db_backup_*.sql.gz' -mtime +${RETENTION_DAYS} -delete" >> "$LOG_FILE" 2>&1 + else + log "❌ ERREUR lors du transfert (rsync/scp) vers le serveur VPS." + STATUS="FAILURE" + fi +fi + +# 4. Nettoyage des anciennes sauvegardes locales (> 7 jours) +if [ "$STATUS" = "SUCCESS" ]; then + log "Nettoyage des sauvegardes locales de plus de ${RETENTION_DAYS} jours..." + DELETED_FILES=$(find "$BACKUP_DIR" -type f -name "astalange_db_backup_*.sql.gz" -mtime +${RETENTION_DAYS} -print) + if [ -n "$DELETED_FILES" ]; then + log "Fichiers locaux supprimés (obsolètes) :" + echo "$DELETED_FILES" | tee -a "$LOG_FILE" + find "$BACKUP_DIR" -type f -name "astalange_db_backup_*.sql.gz" -mtime +${RETENTION_DAYS} -delete >> "$LOG_FILE" 2>&1 + else + log "Aucune sauvegarde locale obsolète à supprimer." + fi +fi + +log "======================================================================" +log " Fin du traitement de sauvegarde. Statut global : ${STATUS}" +log "======================================================================" + +# 5. Envoi de l'email de rapport via Brevo API +send_email_notification() { + if [ -z "${BREVO_API_KEY}" ]; then + log "ATTENTION: BREVO_API_KEY n'est pas définie. Envoi d'email ignoré." + return 0 + fi + + log "Envoi du rapport par email via l'API Brevo à ${RECIPIENT_EMAIL}..." + + if [ "$STATUS" = "SUCCESS" ]; then + SUBJECT="[AS Talange] ✅ Backup Base de Données Réussi - $(date +'%d/%m/%Y')" + HEADER_BG="#28a745" + STATUS_LABEL="SUCCÈS" + else + SUBJECT="[AS Talange] ❌ ECHEC du Backup Base de Données - $(date +'%d/%m/%Y')" + HEADER_BG="#dc3545" + STATUS_LABEL="ÉCHEC" + fi + + LOG_CONTENT=$(cat "$LOG_FILE") + + PYTHON_JSON_GEN=$(python3 -c ' +import json, sys + +status_label = sys.argv[1] +header_bg = sys.argv[2] +timestamp = sys.argv[3] +dump_name = sys.argv[4] +dump_size = sys.argv[5] +log_content = sys.argv[6] +sender_name = sys.argv[7] +sender_email = sys.argv[8] +recipient_email = sys.argv[9] +subject = sys.argv[10] + +html = f""" + + + + +
+
+

Sauvegarde Base de Données AS Talange

+

Statut : {status_label}

+
+
+ + + + +
Date :{timestamp}
Fichier Dump :{dump_name}
Taille :{dump_size}
+ +

Logs d'exécution :

+ 
{log_content}
+
+
+ Script automatique de sauvegarde AS Talange - Rétention 7 jours +
+
+ + +""" + +payload = { + "sender": {"name": sender_name, "email": sender_email}, + "to": [{"email": recipient_email}], + "subject": subject, + "htmlContent": html +} + +print(json.dumps(payload)) +' "$STATUS_LABEL" "$HEADER_BG" "$DATE_HUMAN" "$DUMP_FILENAME" "${DUMP_SIZE:-N/A}" "$LOG_CONTENT" "$BREVO_SENDER_NAME" "$BREVO_SENDER_EMAIL" "$RECIPIENT_EMAIL" "$SUBJECT" 2>/dev/null) + + if [ -n "$PYTHON_JSON_GEN" ]; then + RESPONSE=$(curl -s -w "\nHTTP_CODE:%{http_code}" -X POST "https://api.brevo.com/v3/smtp/email" \ + -H "accept: application/json" \ + -H "api-key: ${BREVO_API_KEY}" \ + -H "content-type: application/json" \ + -d "$PYTHON_JSON_GEN") + + HTTP_CODE=$(echo "$RESPONSE" | grep "HTTP_CODE:" | cut -d: -f2) + if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then + log "✅ Email envoyé avec succès via l'API Brevo !" + else + log "❌ ERREUR lors de l'envoi de l'email via Brevo (Code HTTP: ${HTTP_CODE}). Réponse: ${RESPONSE}" + fi + else + log "❌ ERREUR: Échec de la génération du payload JSON pour l'email." + fi +} + +send_email_notification + +# Nettoyage du fichier log temporaire +rm -f "$LOG_FILE" + +if [ "$STATUS" = "FAILURE" ]; then + exit 1 +fi + +exit 0 From 0a56d83e2e1fe02e5a948b23edbb4a992a513ab6 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 07:54:18 +0200 Subject: [PATCH 02/31] feat(ci): add step to deploy backup script and env to DB server (10.8.0.3) via rsync --- .gitea/workflows/ci-prod.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 5b19b6d..a26cc1a 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -114,3 +114,29 @@ jobs: echo "Application failed to start or login page is not accessible." docker logs astalange_app exit 1 + + - name: Deploy Backup Script & Config to DB Server (10.8.0.3) + env: + DB_SERVER_HOST: ${{ secrets.PROD_DB_HOST }} + DB_SERVER_USER: ${{ secrets.PROD_DB_SSH_USER }} + SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }} + run: | + TARGET_HOST="${DB_SERVER_HOST:-10.8.0.3}" + TARGET_USER="${DB_SERVER_USER:-root}" + DEST_DIR="/opt/as-talange" + + if [ -n "${SSH_KEY}" ]; then + apk add --no-cache openssh-client rsync + mkdir -p ~/.ssh + echo "${SSH_KEY}" > ~/.ssh/id_rsa + chmod 600 ~/.ssh/id_rsa + + echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." + ssh -o StrictHostKeyChecking=no "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" + rsync -avz -e "ssh -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" + rsync -avz -e "ssh -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" + ssh -o StrictHostKeyChecking=no "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" + echo "Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" + else + echo "NOTICE: PROD_DB_SSH_KEY secret not defined, skipping remote deployment of backup script to DB Server." + fi From deba5fafeabb5ec4ec4695c0ef1c7fd592101b55 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 08:03:03 +0200 Subject: [PATCH 03/31] fix(ci): check all SSH key secret variants and force rsync deployment to DB server --- .gitea/workflows/ci-prod.yml | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index a26cc1a..bf8a9ac 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -119,24 +119,27 @@ jobs: env: DB_SERVER_HOST: ${{ secrets.PROD_DB_HOST }} DB_SERVER_USER: ${{ secrets.PROD_DB_SSH_USER }} - SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }} + PROD_DB_SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }} + SSH_KEY_PATH_SECRET: ${{ secrets.SSH_KEY_PATH }} + SSH_KEY_SECRET: ${{ secrets.SSH_KEY }} run: | TARGET_HOST="${DB_SERVER_HOST:-10.8.0.3}" TARGET_USER="${DB_SERVER_USER:-root}" DEST_DIR="/opt/as-talange" - if [ -n "${SSH_KEY}" ]; then - apk add --no-cache openssh-client rsync + apk add --no-cache openssh-client rsync + + KEY_CONTENT="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" + + if [ -n "${KEY_CONTENT}" ] && [ "${KEY_CONTENT:0:1}" = "-" ]; then mkdir -p ~/.ssh - echo "${SSH_KEY}" > ~/.ssh/id_rsa + echo "${KEY_CONTENT}" > ~/.ssh/id_rsa chmod 600 ~/.ssh/id_rsa - - echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." - ssh -o StrictHostKeyChecking=no "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" - rsync -avz -e "ssh -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" - rsync -avz -e "ssh -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" - ssh -o StrictHostKeyChecking=no "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" - echo "Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" - else - echo "NOTICE: PROD_DB_SSH_KEY secret not defined, skipping remote deployment of backup script to DB Server." fi + + echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." + ssh -o StrictHostKeyChecking=no "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" + rsync -avz -e "ssh -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" + rsync -avz -e "ssh -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" + ssh -o StrictHostKeyChecking=no "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" + echo "Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" From 272a4ad8e283a3e2f098f5220acb12b03f61f22d Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 10:04:34 +0200 Subject: [PATCH 04/31] fix(ci): preserve SSH key linebreaks with printf and add custom port support --- .gitea/workflows/ci-prod.yml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index bf8a9ac..83a54eb 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -119,27 +119,31 @@ jobs: env: DB_SERVER_HOST: ${{ secrets.PROD_DB_HOST }} DB_SERVER_USER: ${{ secrets.PROD_DB_SSH_USER }} + REMOTE_PORT: ${{ secrets.REMOTE_PORT }} PROD_DB_SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }} SSH_KEY_PATH_SECRET: ${{ secrets.SSH_KEY_PATH }} SSH_KEY_SECRET: ${{ secrets.SSH_KEY }} run: | TARGET_HOST="${DB_SERVER_HOST:-10.8.0.3}" TARGET_USER="${DB_SERVER_USER:-root}" + PORT="${REMOTE_PORT:-22}" DEST_DIR="/opt/as-talange" apk add --no-cache openssh-client rsync KEY_CONTENT="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" - if [ -n "${KEY_CONTENT}" ] && [ "${KEY_CONTENT:0:1}" = "-" ]; then + if [ -n "${KEY_CONTENT}" ]; then mkdir -p ~/.ssh - echo "${KEY_CONTENT}" > ~/.ssh/id_rsa + printf "%s\n" "${KEY_CONTENT}" > ~/.ssh/id_rsa chmod 600 ~/.ssh/id_rsa fi - echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." - ssh -o StrictHostKeyChecking=no "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" - rsync -avz -e "ssh -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" - rsync -avz -e "ssh -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" - ssh -o StrictHostKeyChecking=no "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" + SSH_CMD="ssh -p ${PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=10" + + echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}) on port ${PORT}..." + $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" + rsync -avz -e "${SSH_CMD}" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" + rsync -avz -e "${SSH_CMD}" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" + $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" echo "Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" From 47b27d3cfda7858716675e1396b84d773ec2bdac Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 12:51:10 +0200 Subject: [PATCH 05/31] fix(ci): run rsync DB script deployment with host network (--net=host) to fix VPN timeout --- .gitea/workflows/ci-prod.yml | 40 +++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 17 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 83a54eb..32817d6 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -128,22 +128,28 @@ jobs: TARGET_USER="${DB_SERVER_USER:-root}" PORT="${REMOTE_PORT:-22}" DEST_DIR="/opt/as-talange" - - apk add --no-cache openssh-client rsync - KEY_CONTENT="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" - - if [ -n "${KEY_CONTENT}" ]; then - mkdir -p ~/.ssh - printf "%s\n" "${KEY_CONTENT}" > ~/.ssh/id_rsa - chmod 600 ~/.ssh/id_rsa - fi - SSH_CMD="ssh -p ${PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=10" - - echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}) on port ${PORT}..." - $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" - rsync -avz -e "${SSH_CMD}" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" - rsync -avz -e "${SSH_CMD}" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" - $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" - echo "Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" + docker run --rm --net=host -v "$(pwd):/workspace" -w /workspace \ + -e TARGET_HOST="${TARGET_HOST}" \ + -e TARGET_USER="${TARGET_USER}" \ + -e PORT="${PORT}" \ + -e DEST_DIR="${DEST_DIR}" \ + -e KEY_CONTENT="${KEY_CONTENT}" \ + alpine:latest sh -c ' + apk add --no-cache openssh-client rsync && \ + if [ -n "$KEY_CONTENT" ]; then \ + mkdir -p ~/.ssh && \ + printf "%s\n" "$KEY_CONTENT" > ~/.ssh/id_rsa && \ + chmod 600 ~/.ssh/id_rsa ; \ + elif [ -f /root/.ssh/id_rsa ]; then \ + mkdir -p ~/.ssh && cp /root/.ssh/id_rsa ~/.ssh/id_rsa && chmod 600 ~/.ssh/id_rsa ; \ + fi && \ + SSH_CMD="ssh -p ${PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ + echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \ + $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ + rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ + rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ + $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \ + echo "Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" + ' From 41f8b676025948c7e0d72a038080b9ef577c9087 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 12:59:24 +0200 Subject: [PATCH 06/31] fix(ci): strip carriage returns from SSH key and force IdentitiesOnly=yes to fix libcrypto unsupported error --- .gitea/workflows/ci-prod.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 32817d6..77dfbe1 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -140,12 +140,13 @@ jobs: apk add --no-cache openssh-client rsync && \ if [ -n "$KEY_CONTENT" ]; then \ mkdir -p ~/.ssh && \ - printf "%s\n" "$KEY_CONTENT" > ~/.ssh/id_rsa && \ + printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > ~/.ssh/id_rsa && \ + echo "" >> ~/.ssh/id_rsa && \ chmod 600 ~/.ssh/id_rsa ; \ elif [ -f /root/.ssh/id_rsa ]; then \ mkdir -p ~/.ssh && cp /root/.ssh/id_rsa ~/.ssh/id_rsa && chmod 600 ~/.ssh/id_rsa ; \ fi && \ - SSH_CMD="ssh -p ${PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ + SSH_CMD="ssh -p ${PORT} -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ From 8c8df282a4bacca927918c95e430ed4b2e0d3ac7 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 13:16:03 +0200 Subject: [PATCH 07/31] refactor(ci): mount host .ssh directory directly in docker step container --- .gitea/workflows/ci-prod.yml | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 77dfbe1..e17753e 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -120,33 +120,22 @@ jobs: DB_SERVER_HOST: ${{ secrets.PROD_DB_HOST }} DB_SERVER_USER: ${{ secrets.PROD_DB_SSH_USER }} REMOTE_PORT: ${{ secrets.REMOTE_PORT }} - PROD_DB_SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }} - SSH_KEY_PATH_SECRET: ${{ secrets.SSH_KEY_PATH }} - SSH_KEY_SECRET: ${{ secrets.SSH_KEY }} run: | TARGET_HOST="${DB_SERVER_HOST:-10.8.0.3}" TARGET_USER="${DB_SERVER_USER:-root}" PORT="${REMOTE_PORT:-22}" DEST_DIR="/opt/as-talange" - KEY_CONTENT="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" - docker run --rm --net=host -v "$(pwd):/workspace" -w /workspace \ + docker run --rm --net=host \ + -v "$(pwd):/workspace" -w /workspace \ + -v "${HOME}/.ssh:/root/.ssh:ro" \ -e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_USER="${TARGET_USER}" \ -e PORT="${PORT}" \ -e DEST_DIR="${DEST_DIR}" \ - -e KEY_CONTENT="${KEY_CONTENT}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ - if [ -n "$KEY_CONTENT" ]; then \ - mkdir -p ~/.ssh && \ - printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > ~/.ssh/id_rsa && \ - echo "" >> ~/.ssh/id_rsa && \ - chmod 600 ~/.ssh/id_rsa ; \ - elif [ -f /root/.ssh/id_rsa ]; then \ - mkdir -p ~/.ssh && cp /root/.ssh/id_rsa ~/.ssh/id_rsa && chmod 600 ~/.ssh/id_rsa ; \ - fi && \ - SSH_CMD="ssh -p ${PORT} -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ + SSH_CMD="ssh -p ${PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ From 0963e25cfb235a6c6e07370d6d1f86b30723ff38 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 14:05:44 +0200 Subject: [PATCH 08/31] fix(ci): add UserKnownHostsFile=/dev/null and target gitea_ci_key to fix read-only ssh error --- .gitea/workflows/ci-prod.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index e17753e..20ea5cd 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -135,7 +135,15 @@ jobs: -e DEST_DIR="${DEST_DIR}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ - SSH_CMD="ssh -p ${PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ + KEY_ARG="" && \ + if [ -f /root/.ssh/gitea_ci_key ]; then \ + KEY_ARG="-i /root/.ssh/gitea_ci_key -o IdentitiesOnly=yes" ; \ + elif [ -f /root/.ssh/id_ed25519 ]; then \ + KEY_ARG="-i /root/.ssh/id_ed25519 -o IdentitiesOnly=yes" ; \ + elif [ -f /root/.ssh/id_rsa ]; then \ + KEY_ARG="-i /root/.ssh/id_rsa -o IdentitiesOnly=yes" ; \ + fi && \ + SSH_CMD="ssh -p ${PORT} ${KEY_ARG} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ From 02f9674b7aa1315a8bc7e4ac1356c36b19792361 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 14:26:53 +0200 Subject: [PATCH 09/31] fix(ci): mount /home/ubuntu/.ssh and auto-detect gitea_ci_key location --- .gitea/workflows/ci-prod.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 20ea5cd..7429d6f 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -128,6 +128,7 @@ jobs: docker run --rm --net=host \ -v "$(pwd):/workspace" -w /workspace \ + -v "/home/ubuntu/.ssh:/home/ubuntu/.ssh:ro" \ -v "${HOME}/.ssh:/root/.ssh:ro" \ -e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_USER="${TARGET_USER}" \ @@ -136,13 +137,11 @@ jobs: alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ KEY_ARG="" && \ - if [ -f /root/.ssh/gitea_ci_key ]; then \ - KEY_ARG="-i /root/.ssh/gitea_ci_key -o IdentitiesOnly=yes" ; \ - elif [ -f /root/.ssh/id_ed25519 ]; then \ - KEY_ARG="-i /root/.ssh/id_ed25519 -o IdentitiesOnly=yes" ; \ - elif [ -f /root/.ssh/id_rsa ]; then \ - KEY_ARG="-i /root/.ssh/id_rsa -o IdentitiesOnly=yes" ; \ - fi && \ + for k in /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \ + if [ -f "$k" ]; then \ + KEY_ARG="-i $k -o IdentitiesOnly=yes" && break ; \ + fi ; \ + done && \ SSH_CMD="ssh -p ${PORT} ${KEY_ARG} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ From 2472407ccaf86ad2958de3a942b11bd12a9984a7 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 14:29:20 +0200 Subject: [PATCH 10/31] fix(ci): prioritize /root/.ssh/gitea_ci_key mount --- .gitea/workflows/ci-prod.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 7429d6f..12fa128 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -128,8 +128,8 @@ jobs: docker run --rm --net=host \ -v "$(pwd):/workspace" -w /workspace \ + -v "/root/.ssh:/root/.ssh:ro" \ -v "/home/ubuntu/.ssh:/home/ubuntu/.ssh:ro" \ - -v "${HOME}/.ssh:/root/.ssh:ro" \ -e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_USER="${TARGET_USER}" \ -e PORT="${PORT}" \ @@ -137,7 +137,7 @@ jobs: alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ KEY_ARG="" && \ - for k in /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \ + for k in /root/.ssh/gitea_ci_key /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/id_ed25519 /root/.ssh/id_rsa; do \ if [ -f "$k" ]; then \ KEY_ARG="-i $k -o IdentitiesOnly=yes" && break ; \ fi ; \ From 747cf1a0fabf8e8d765e6d498514084bece91dad Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 14:40:44 +0200 Subject: [PATCH 11/31] refactor(ci): simplify SSH step to directly copy and use /root/.ssh/gitea_ci_key with 600 permissions --- .gitea/workflows/ci-prod.yml | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 12fa128..173666f 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -129,20 +129,16 @@ jobs: docker run --rm --net=host \ -v "$(pwd):/workspace" -w /workspace \ -v "/root/.ssh:/root/.ssh:ro" \ - -v "/home/ubuntu/.ssh:/home/ubuntu/.ssh:ro" \ -e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_USER="${TARGET_USER}" \ -e PORT="${PORT}" \ -e DEST_DIR="${DEST_DIR}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ - KEY_ARG="" && \ - for k in /root/.ssh/gitea_ci_key /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/id_ed25519 /root/.ssh/id_rsa; do \ - if [ -f "$k" ]; then \ - KEY_ARG="-i $k -o IdentitiesOnly=yes" && break ; \ - fi ; \ - done && \ - SSH_CMD="ssh -p ${PORT} ${KEY_ARG} -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ + mkdir -p ~/.ssh && \ + cp /root/.ssh/gitea_ci_key ~/.ssh/id_rsa && \ + chmod 600 ~/.ssh/id_rsa && \ + SSH_CMD="ssh -p ${PORT} -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ From 881a81f53bc9e89a2190e5e5a04134a3456d9720 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 14:49:33 +0200 Subject: [PATCH 12/31] fix(ci): robust SSH key resolution supporting both file paths and Gitea secrets --- .gitea/workflows/ci-prod.yml | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 173666f..b692480 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -120,23 +120,41 @@ jobs: DB_SERVER_HOST: ${{ secrets.PROD_DB_HOST }} DB_SERVER_USER: ${{ secrets.PROD_DB_SSH_USER }} REMOTE_PORT: ${{ secrets.REMOTE_PORT }} + PROD_DB_SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }} + SSH_KEY_PATH_SECRET: ${{ secrets.SSH_KEY_PATH }} + SSH_KEY_SECRET: ${{ secrets.SSH_KEY }} run: | TARGET_HOST="${DB_SERVER_HOST:-10.8.0.3}" TARGET_USER="${DB_SERVER_USER:-root}" PORT="${REMOTE_PORT:-22}" DEST_DIR="/opt/as-talange" + KEY_CONTENT="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" docker run --rm --net=host \ -v "$(pwd):/workspace" -w /workspace \ + -v "/home/ubuntu/.ssh:/home/ubuntu/.ssh:ro" \ -v "/root/.ssh:/root/.ssh:ro" \ -e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_USER="${TARGET_USER}" \ -e PORT="${PORT}" \ -e DEST_DIR="${DEST_DIR}" \ + -e KEY_CONTENT="${KEY_CONTENT}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ mkdir -p ~/.ssh && \ - cp /root/.ssh/gitea_ci_key ~/.ssh/id_rsa && \ + FOUND_KEY="" && \ + for k in /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \ + if [ -f "$k" ]; then FOUND_KEY="$k"; break; fi ; \ + done && \ + if [ -n "$FOUND_KEY" ]; then \ + echo "Using SSH key from file: $FOUND_KEY" && \ + cp "$FOUND_KEY" ~/.ssh/id_rsa ; \ + elif [ -n "$KEY_CONTENT" ]; then \ + echo "Using SSH key from Gitea secret" && \ + printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > ~/.ssh/id_rsa ; \ + else \ + echo "ERROR: No SSH key found!" && exit 1 ; \ + fi && \ chmod 600 ~/.ssh/id_rsa && \ SSH_CMD="ssh -p ${PORT} -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \ From 815eb72834c0690c983278f61a5ccb6b24ccd67f Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 14:56:31 +0200 Subject: [PATCH 13/31] fix(ci): copy key to /tmp/id_rsa instead of ~/.ssh/id_rsa to avoid read-only mount error --- .gitea/workflows/ci-prod.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index b692480..6b0067e 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -141,22 +141,21 @@ jobs: -e KEY_CONTENT="${KEY_CONTENT}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ - mkdir -p ~/.ssh && \ FOUND_KEY="" && \ for k in /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \ if [ -f "$k" ]; then FOUND_KEY="$k"; break; fi ; \ done && \ if [ -n "$FOUND_KEY" ]; then \ echo "Using SSH key from file: $FOUND_KEY" && \ - cp "$FOUND_KEY" ~/.ssh/id_rsa ; \ + cp "$FOUND_KEY" /tmp/id_rsa ; \ elif [ -n "$KEY_CONTENT" ]; then \ echo "Using SSH key from Gitea secret" && \ - printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > ~/.ssh/id_rsa ; \ + printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > /tmp/id_rsa ; \ else \ echo "ERROR: No SSH key found!" && exit 1 ; \ fi && \ - chmod 600 ~/.ssh/id_rsa && \ - SSH_CMD="ssh -p ${PORT} -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ + chmod 600 /tmp/id_rsa && \ + SSH_CMD="ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ From a4c852d25486f97e668f27d214c91bff76061326 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 15:02:09 +0200 Subject: [PATCH 14/31] fix(ci): mount /home/ucef/.ssh and prioritize gitea_ci_key over generic host keys --- .gitea/workflows/ci-prod.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 6b0067e..f6ff097 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -132,6 +132,7 @@ jobs: docker run --rm --net=host \ -v "$(pwd):/workspace" -w /workspace \ + -v "/home/ucef/.ssh:/home/ucef/.ssh:ro" \ -v "/home/ubuntu/.ssh:/home/ubuntu/.ssh:ro" \ -v "/root/.ssh:/root/.ssh:ro" \ -e TARGET_HOST="${TARGET_HOST}" \ @@ -142,7 +143,7 @@ jobs: alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ FOUND_KEY="" && \ - for k in /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \ + for k in /home/ucef/.ssh/gitea_ci_key /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ucef/.ssh/id_ed25519 /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ucef/.ssh/id_rsa /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \ if [ -f "$k" ]; then FOUND_KEY="$k"; break; fi ; \ done && \ if [ -n "$FOUND_KEY" ]; then \ From 63bc5da40c81e7a4aa6350141d2c7ce852f52c72 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 15:09:07 +0200 Subject: [PATCH 15/31] ci: add comprehensive diagnostic logs and ssh -vv trace to step --- .gitea/workflows/ci-prod.yml | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index f6ff097..423197e 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -142,25 +142,38 @@ jobs: -e KEY_CONTENT="${KEY_CONTENT}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ + echo "=== DIAGNOSTIC DETAILS ===" && \ + echo "Container User: $(whoami) (UID: $(id -u))" && \ + echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ + echo "Destination Directory: ${DEST_DIR}" && \ + echo "=== CHECKING ACCESSIBLE SSH DIRECTORIES ===" && \ + echo "[/root/.ssh/]:" && (ls -la /root/.ssh/ 2>/dev/null || echo "Not accessible") && \ + echo "[/home/ucef/.ssh/]:" && (ls -la /home/ucef/.ssh/ 2>/dev/null || echo "Not accessible") && \ + echo "[/home/ubuntu/.ssh/]:" && (ls -la /home/ubuntu/.ssh/ 2>/dev/null || echo "Not accessible") && \ FOUND_KEY="" && \ for k in /home/ucef/.ssh/gitea_ci_key /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ucef/.ssh/id_ed25519 /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ucef/.ssh/id_rsa /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \ if [ -f "$k" ]; then FOUND_KEY="$k"; break; fi ; \ done && \ if [ -n "$FOUND_KEY" ]; then \ - echo "Using SSH key from file: $FOUND_KEY" && \ + echo "--> SELECTED KEY FILE: $FOUND_KEY" && \ cp "$FOUND_KEY" /tmp/id_rsa ; \ elif [ -n "$KEY_CONTENT" ]; then \ - echo "Using SSH key from Gitea secret" && \ + echo "--> SELECTED KEY FROM: Gitea secret" && \ printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > /tmp/id_rsa ; \ else \ - echo "ERROR: No SSH key found!" && exit 1 ; \ + echo "--> ERROR: No SSH key found!" && exit 1 ; \ fi && \ chmod 600 /tmp/id_rsa && \ - SSH_CMD="ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ - echo "Deploying backup script and .env to DB Server (${TARGET_USER}@${TARGET_HOST}:${DEST_DIR})..." && \ + echo "=== KEY FILE DETAILS ===" && \ + ls -la /tmp/id_rsa && \ + head -n 2 /tmp/id_rsa && \ + SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ + echo "=== EXECUTING REMOTE COMMAND ===" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ - rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ - rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ + echo "=== RSYNC TRANSFER SCRIPT ===" && \ + rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ + echo "=== RSYNC TRANSFER ENV ===" && \ + rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \ - echo "Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" + echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" ' From 5e7e5c461c7e83b618f0311f2b7a502b9f2f3599 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 15:11:16 +0200 Subject: [PATCH 16/31] security: replace key header log with safe public ssh-keygen fingerprint display --- .gitea/workflows/ci-prod.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 423197e..2d671bc 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -164,9 +164,9 @@ jobs: echo "--> ERROR: No SSH key found!" && exit 1 ; \ fi && \ chmod 600 /tmp/id_rsa && \ - echo "=== KEY FILE DETAILS ===" && \ + echo "=== KEY FINGERPRINT ===" && \ ls -la /tmp/id_rsa && \ - head -n 2 /tmp/id_rsa && \ + ssh-keygen -l -f /tmp/id_rsa && \ SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ echo "=== EXECUTING REMOTE COMMAND ===" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ From 494fcfbf8a4f83ba662eac928e4ec893e01fcdce Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 15:19:28 +0200 Subject: [PATCH 17/31] fix(ci): use PROD_DB_SSH_KEY Gitea secret for reliable cross-runner authentication --- .gitea/workflows/ci-prod.yml | 35 +++++++++++------------------------ 1 file changed, 11 insertions(+), 24 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 2d671bc..e259fc3 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -132,9 +132,6 @@ jobs: docker run --rm --net=host \ -v "$(pwd):/workspace" -w /workspace \ - -v "/home/ucef/.ssh:/home/ucef/.ssh:ro" \ - -v "/home/ubuntu/.ssh:/home/ubuntu/.ssh:ro" \ - -v "/root/.ssh:/root/.ssh:ro" \ -e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_USER="${TARGET_USER}" \ -e PORT="${PORT}" \ @@ -142,37 +139,27 @@ jobs: -e KEY_CONTENT="${KEY_CONTENT}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ - echo "=== DIAGNOSTIC DETAILS ===" && \ - echo "Container User: $(whoami) (UID: $(id -u))" && \ + echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \ echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ echo "Destination Directory: ${DEST_DIR}" && \ - echo "=== CHECKING ACCESSIBLE SSH DIRECTORIES ===" && \ - echo "[/root/.ssh/]:" && (ls -la /root/.ssh/ 2>/dev/null || echo "Not accessible") && \ - echo "[/home/ucef/.ssh/]:" && (ls -la /home/ucef/.ssh/ 2>/dev/null || echo "Not accessible") && \ - echo "[/home/ubuntu/.ssh/]:" && (ls -la /home/ubuntu/.ssh/ 2>/dev/null || echo "Not accessible") && \ - FOUND_KEY="" && \ - for k in /home/ucef/.ssh/gitea_ci_key /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ucef/.ssh/id_ed25519 /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ucef/.ssh/id_rsa /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \ - if [ -f "$k" ]; then FOUND_KEY="$k"; break; fi ; \ - done && \ - if [ -n "$FOUND_KEY" ]; then \ - echo "--> SELECTED KEY FILE: $FOUND_KEY" && \ - cp "$FOUND_KEY" /tmp/id_rsa ; \ - elif [ -n "$KEY_CONTENT" ]; then \ - echo "--> SELECTED KEY FROM: Gitea secret" && \ + if [ -n "$KEY_CONTENT" ]; then \ + echo "--> USING SSH KEY FROM GITEA SECRET" && \ printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > /tmp/id_rsa ; \ + elif [ -f /root/.ssh/gitea_ci_key ]; then \ + echo "--> USING SSH KEY FROM FILE: /root/.ssh/gitea_ci_key" && \ + cp /root/.ssh/gitea_ci_key /tmp/id_rsa ; \ else \ - echo "--> ERROR: No SSH key found!" && exit 1 ; \ + echo "--> ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!" && exit 1 ; \ fi && \ chmod 600 /tmp/id_rsa && \ - echo "=== KEY FINGERPRINT ===" && \ - ls -la /tmp/id_rsa && \ + echo "=== 🔑 KEY FINGERPRINT ===" && \ ssh-keygen -l -f /tmp/id_rsa && \ SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ - echo "=== EXECUTING REMOTE COMMAND ===" && \ + echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ - echo "=== RSYNC TRANSFER SCRIPT ===" && \ + echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \ rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ - echo "=== RSYNC TRANSFER ENV ===" && \ + echo "=== 📦 RSYNC TRANSFER ENV ===" && \ rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \ echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" From 9990bba799acc7a62bdc37db2a82e3f83f4a5f1b Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 15:26:22 +0200 Subject: [PATCH 18/31] fix(ci): write secret key to runner file before docker run to preserve multi-line format --- .gitea/workflows/ci-prod.yml | 39 +++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 16 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index e259fc3..c1a8785 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -128,39 +128,46 @@ jobs: TARGET_USER="${DB_SERVER_USER:-root}" PORT="${REMOTE_PORT:-22}" DEST_DIR="/opt/as-talange" - KEY_CONTENT="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" + RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" + + rm -f /tmp/gitea_runner_key + if [ -n "${RAW_KEY}" ]; then + printf "%s\n" "${RAW_KEY}" | tr -d '\r' | sed 's/\\n/\n/g' > /tmp/gitea_runner_key + elif [ -f /root/.ssh/gitea_ci_key ]; then + cp /root/.ssh/gitea_ci_key /tmp/gitea_runner_key + elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then + cp /home/ucef/.ssh/gitea_ci_key /tmp/gitea_runner_key + fi + + if [ ! -s /tmp/gitea_runner_key ]; then + echo "ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!" + exit 1 + fi + chmod 600 /tmp/gitea_runner_key docker run --rm --net=host \ -v "$(pwd):/workspace" -w /workspace \ + -v "/tmp/gitea_runner_key:/tmp/id_rsa:ro" \ -e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_USER="${TARGET_USER}" \ -e PORT="${PORT}" \ -e DEST_DIR="${DEST_DIR}" \ - -e KEY_CONTENT="${KEY_CONTENT}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync && \ echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \ echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ echo "Destination Directory: ${DEST_DIR}" && \ - if [ -n "$KEY_CONTENT" ]; then \ - echo "--> USING SSH KEY FROM GITEA SECRET" && \ - printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > /tmp/id_rsa ; \ - elif [ -f /root/.ssh/gitea_ci_key ]; then \ - echo "--> USING SSH KEY FROM FILE: /root/.ssh/gitea_ci_key" && \ - cp /root/.ssh/gitea_ci_key /tmp/id_rsa ; \ - else \ - echo "--> ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!" && exit 1 ; \ - fi && \ - chmod 600 /tmp/id_rsa && \ + cp /tmp/id_rsa /tmp/working_key && \ + chmod 600 /tmp/working_key && \ echo "=== 🔑 KEY FINGERPRINT ===" && \ - ssh-keygen -l -f /tmp/id_rsa && \ - SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ + ssh-keygen -l -f /tmp/working_key && \ + SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \ - rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ + rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ echo "=== 📦 RSYNC TRANSFER ENV ===" && \ - rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ + rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \ echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" ' From 5fb6356f8a50acd3a14d1f1946d007b454c44794 Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 15:39:35 +0200 Subject: [PATCH 19/31] fix(ci): strict regular file check and explicit error message when PROD_DB_SSH_KEY is missing --- .gitea/workflows/ci-prod.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index c1a8785..557a69d 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -130,7 +130,7 @@ jobs: DEST_DIR="/opt/as-talange" RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" - rm -f /tmp/gitea_runner_key + rm -rf /tmp/gitea_runner_key if [ -n "${RAW_KEY}" ]; then printf "%s\n" "${RAW_KEY}" | tr -d '\r' | sed 's/\\n/\n/g' > /tmp/gitea_runner_key elif [ -f /root/.ssh/gitea_ci_key ]; then @@ -139,8 +139,11 @@ jobs: cp /home/ucef/.ssh/gitea_ci_key /tmp/gitea_runner_key fi - if [ ! -s /tmp/gitea_runner_key ]; then - echo "ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!" + if [ ! -f /tmp/gitea_runner_key ] || [ ! -s /tmp/gitea_runner_key ]; then + echo "=========================================================================" + echo "ERREUR : Le secret PROD_DB_SSH_KEY est vide ou introuvable dans Gitea !" + echo "Veuillez ajouter la clé privée dans Gitea > Dépôt > Paramètres > Secrets > PROD_DB_SSH_KEY" + echo "=========================================================================" exit 1 fi chmod 600 /tmp/gitea_runner_key From a991fd9f350102ee8ecfcafc97f9624f6f7d0a6f Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 15:47:40 +0200 Subject: [PATCH 20/31] fix(ci): pass SSH key as base64 environment variable to completely eliminate volume mount issues --- .gitea/workflows/ci-prod.yml | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 557a69d..d77f7c1 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -130,38 +130,36 @@ jobs: DEST_DIR="/opt/as-talange" RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" - rm -rf /tmp/gitea_runner_key - if [ -n "${RAW_KEY}" ]; then - printf "%s\n" "${RAW_KEY}" | tr -d '\r' | sed 's/\\n/\n/g' > /tmp/gitea_runner_key - elif [ -f /root/.ssh/gitea_ci_key ]; then - cp /root/.ssh/gitea_ci_key /tmp/gitea_runner_key - elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then - cp /home/ucef/.ssh/gitea_ci_key /tmp/gitea_runner_key + if [ -z "${RAW_KEY}" ] && [ -f /root/.ssh/gitea_ci_key ]; then + RAW_KEY=$(cat /root/.ssh/gitea_ci_key) + elif [ -z "${RAW_KEY}" ] && [ -f /home/ucef/.ssh/gitea_ci_key ]; then + RAW_KEY=$(cat /home/ucef/.ssh/gitea_ci_key) fi - if [ ! -f /tmp/gitea_runner_key ] || [ ! -s /tmp/gitea_runner_key ]; then + if [ -z "${RAW_KEY}" ]; then echo "=========================================================================" echo "ERREUR : Le secret PROD_DB_SSH_KEY est vide ou introuvable dans Gitea !" echo "Veuillez ajouter la clé privée dans Gitea > Dépôt > Paramètres > Secrets > PROD_DB_SSH_KEY" echo "=========================================================================" exit 1 fi - chmod 600 /tmp/gitea_runner_key + + KEY_B64=$(printf "%s" "${RAW_KEY}" | tr -d '\r' | base64 | tr -d '\r\n') docker run --rm --net=host \ -v "$(pwd):/workspace" -w /workspace \ - -v "/tmp/gitea_runner_key:/tmp/id_rsa:ro" \ -e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_USER="${TARGET_USER}" \ -e PORT="${PORT}" \ -e DEST_DIR="${DEST_DIR}" \ + -e KEY_B64="${KEY_B64}" \ alpine:latest sh -c ' - apk add --no-cache openssh-client rsync && \ + apk add --no-cache openssh-client rsync coreutils && \ + echo "$KEY_B64" | base64 -d > /tmp/working_key && \ + chmod 600 /tmp/working_key && \ echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \ echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ echo "Destination Directory: ${DEST_DIR}" && \ - cp /tmp/id_rsa /tmp/working_key && \ - chmod 600 /tmp/working_key && \ echo "=== 🔑 KEY FINGERPRINT ===" && \ ssh-keygen -l -f /tmp/working_key && \ SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ From 292c2bb8ec23d6964aff91865db8b67c59795e7a Mon Sep 17 00:00:00 2001 From: Youssef Date: Thu, 3 Sep 2026 15:55:13 +0200 Subject: [PATCH 21/31] fix(ci): handle file paths in RAW_KEY and add key line count diagnostic logs --- .gitea/workflows/ci-prod.yml | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index d77f7c1..0ad69cc 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -130,16 +130,22 @@ jobs: DEST_DIR="/opt/as-talange" RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" - if [ -z "${RAW_KEY}" ] && [ -f /root/.ssh/gitea_ci_key ]; then - RAW_KEY=$(cat /root/.ssh/gitea_ci_key) - elif [ -z "${RAW_KEY}" ] && [ -f /home/ucef/.ssh/gitea_ci_key ]; then - RAW_KEY=$(cat /home/ucef/.ssh/gitea_ci_key) + if [ -n "${RAW_KEY}" ] && [ -f "${RAW_KEY}" ]; then + echo "RAW_KEY is a file path, reading content from: ${RAW_KEY}" + RAW_KEY=$(cat "${RAW_KEY}") + fi + + if [ -z "${RAW_KEY}" ]; then + if [ -f /root/.ssh/gitea_ci_key ]; then + RAW_KEY=$(cat /root/.ssh/gitea_ci_key) + elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then + RAW_KEY=$(cat /home/ucef/.ssh/gitea_ci_key) + fi fi if [ -z "${RAW_KEY}" ]; then echo "=========================================================================" - echo "ERREUR : Le secret PROD_DB_SSH_KEY est vide ou introuvable dans Gitea !" - echo "Veuillez ajouter la clé privée dans Gitea > Dépôt > Paramètres > Secrets > PROD_DB_SSH_KEY" + echo "ERREUR : Le secret PROD_DB_SSH_KEY est vide ou introuvable !" echo "=========================================================================" exit 1 fi @@ -155,11 +161,14 @@ jobs: -e KEY_B64="${KEY_B64}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync coreutils && \ - echo "$KEY_B64" | base64 -d > /tmp/working_key && \ + (echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/working_key && \ chmod 600 /tmp/working_key && \ echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \ echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ echo "Destination Directory: ${DEST_DIR}" && \ + echo "Key File Line Count: $(wc -l < /tmp/working_key)" && \ + echo "Key File First Line: $(head -n 1 /tmp/working_key)" && \ + echo "Key File Last Line: $(tail -n 1 /tmp/working_key)" && \ echo "=== 🔑 KEY FINGERPRINT ===" && \ ssh-keygen -l -f /tmp/working_key && \ SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ From 0a56944daa322479ccdda754e2c4a5a02c7015f7 Mon Sep 17 00:00:00 2001 From: Youssef Date: Fri, 4 Sep 2026 07:04:21 +0200 Subject: [PATCH 22/31] fix(ci): validate SSH key header format and provide explicit guidance for Gitea secret value --- .gitea/workflows/ci-prod.yml | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 0ad69cc..394795c 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -131,7 +131,7 @@ jobs: RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" if [ -n "${RAW_KEY}" ] && [ -f "${RAW_KEY}" ]; then - echo "RAW_KEY is a file path, reading content from: ${RAW_KEY}" + echo "RAW_KEY is a readable file path on host, reading content..." RAW_KEY=$(cat "${RAW_KEY}") fi @@ -145,7 +145,7 @@ jobs: if [ -z "${RAW_KEY}" ]; then echo "=========================================================================" - echo "ERREUR : Le secret PROD_DB_SSH_KEY est vide ou introuvable !" + echo "ERREUR : Le secret PROD_DB_SSH_KEY est totalement vide dans Gitea !" echo "=========================================================================" exit 1 fi @@ -167,8 +167,22 @@ jobs: echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ echo "Destination Directory: ${DEST_DIR}" && \ echo "Key File Line Count: $(wc -l < /tmp/working_key)" && \ - echo "Key File First Line: $(head -n 1 /tmp/working_key)" && \ - echo "Key File Last Line: $(tail -n 1 /tmp/working_key)" && \ + HEADER=$(head -n 1 /tmp/working_key) && \ + echo "Key File First Line: $HEADER" && \ + case "$HEADER" in \ + *"BEGIN"*) \ + echo "--> Key header format is VALID" ;; \ + *) \ + echo "=========================================================================" && \ + echo "ERREUR CONFIGURATION SECRET GITEA :" && \ + echo "Le secret PROD_DB_SSH_KEY ne contient pas le texte d une clé SSH !" && \ + echo "Valeur actuelle reçue dans le secret : $HEADER" && \ + echo "CONSEIL : Dans Gitea > Paramètres > Secrets > PROD_DB_SSH_KEY, tu dois coller" && \ + echo "le CONTENU TEXTUEL complet de la clé (ex: cat /root/.ssh/gitea_ci_key)" && \ + echo "et NON PAS un chemin comme /root/.ssh/..." && \ + echo "=========================================================================" && \ + exit 1 ;; \ + esac && \ echo "=== 🔑 KEY FINGERPRINT ===" && \ ssh-keygen -l -f /tmp/working_key && \ SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ From c06abb1d17b2ab7052399b3498acaafee3574c67 Mon Sep 17 00:00:00 2001 From: Youssef Date: Fri, 4 Sep 2026 07:18:12 +0200 Subject: [PATCH 23/31] fix(ci): re-wrap PEM payload to 64 chars with explicit trailing newline --- .gitea/workflows/ci-prod.yml | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 394795c..70876fe 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -131,7 +131,6 @@ jobs: RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" if [ -n "${RAW_KEY}" ] && [ -f "${RAW_KEY}" ]; then - echo "RAW_KEY is a readable file path on host, reading content..." RAW_KEY=$(cat "${RAW_KEY}") fi @@ -161,28 +160,20 @@ jobs: -e KEY_B64="${KEY_B64}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync coreutils && \ - (echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/working_key && \ + (echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/raw_key && \ + HEADER=$(grep "BEGIN" /tmp/raw_key) && \ + FOOTER=$(grep "END" /tmp/raw_key) && \ + BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n") && \ + printf "%s\n" "$HEADER" > /tmp/working_key && \ + printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key && \ + printf "%s\n" "$FOOTER" >> /tmp/working_key && \ + echo "" >> /tmp/working_key && \ chmod 600 /tmp/working_key && \ echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \ echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ echo "Destination Directory: ${DEST_DIR}" && \ echo "Key File Line Count: $(wc -l < /tmp/working_key)" && \ - HEADER=$(head -n 1 /tmp/working_key) && \ - echo "Key File First Line: $HEADER" && \ - case "$HEADER" in \ - *"BEGIN"*) \ - echo "--> Key header format is VALID" ;; \ - *) \ - echo "=========================================================================" && \ - echo "ERREUR CONFIGURATION SECRET GITEA :" && \ - echo "Le secret PROD_DB_SSH_KEY ne contient pas le texte d une clé SSH !" && \ - echo "Valeur actuelle reçue dans le secret : $HEADER" && \ - echo "CONSEIL : Dans Gitea > Paramètres > Secrets > PROD_DB_SSH_KEY, tu dois coller" && \ - echo "le CONTENU TEXTUEL complet de la clé (ex: cat /root/.ssh/gitea_ci_key)" && \ - echo "et NON PAS un chemin comme /root/.ssh/..." && \ - echo "=========================================================================" && \ - exit 1 ;; \ - esac && \ + echo "Key File First Line: $(head -n 1 /tmp/working_key)" && \ echo "=== 🔑 KEY FINGERPRINT ===" && \ ssh-keygen -l -f /tmp/working_key && \ SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ From e1d797eb01f4aec9af88782fe9ffc62f90bdc1d9 Mon Sep 17 00:00:00 2001 From: Youssef Date: Fri, 4 Sep 2026 07:26:53 +0200 Subject: [PATCH 24/31] fix(ci): use GITHUB_WORKSPACE for repository volume mount and absolute path /workspace/ for rsync --- .gitea/workflows/ci-prod.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 70876fe..e361b85 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -146,13 +146,13 @@ jobs: echo "=========================================================================" echo "ERREUR : Le secret PROD_DB_SSH_KEY est totalement vide dans Gitea !" echo "=========================================================================" - exit 1 fi KEY_B64=$(printf "%s" "${RAW_KEY}" | tr -d '\r' | base64 | tr -d '\r\n') + WORK_DIR="${GITHUB_WORKSPACE:-$(pwd)}" docker run --rm --net=host \ - -v "$(pwd):/workspace" -w /workspace \ + -v "${WORK_DIR}:/workspace" -w /workspace \ -e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_USER="${TARGET_USER}" \ -e PORT="${PORT}" \ @@ -180,9 +180,14 @@ jobs: echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \ - rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ + if [ -f /workspace/scripts/backup_db.sh ]; then \ + rsync -avz -e "$SSH_CMD" /workspace/scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" ; \ + else \ + echo "ERROR: /workspace/scripts/backup_db.sh not found!" && ls -la /workspace && exit 1 ; \ + fi && \ echo "=== 📦 RSYNC TRANSFER ENV ===" && \ - rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ + [ -f /workspace/.env ] || touch /workspace/.env && \ + rsync -avz -e "$SSH_CMD" /workspace/.env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \ echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" ' From 2720a2193db921b846ace2ff857e63a076069e6d Mon Sep 17 00:00:00 2001 From: Youssef Date: Fri, 4 Sep 2026 08:03:23 +0200 Subject: [PATCH 25/31] fix(ci): execute deployment directly in runner step environment without nested container --- .gitea/workflows/ci-prod.yml | 82 ++++++++++++++++++------------------ 1 file changed, 40 insertions(+), 42 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index e361b85..7e61068 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -146,48 +146,46 @@ jobs: echo "=========================================================================" echo "ERREUR : Le secret PROD_DB_SSH_KEY est totalement vide dans Gitea !" echo "=========================================================================" + exit 1 fi - KEY_B64=$(printf "%s" "${RAW_KEY}" | tr -d '\r' | base64 | tr -d '\r\n') - WORK_DIR="${GITHUB_WORKSPACE:-$(pwd)}" + rm -f /tmp/working_key /tmp/raw_key + printf "%s\n" "${RAW_KEY}" | tr -d '\r' > /tmp/raw_key + HEADER=$(grep "BEGIN" /tmp/raw_key) + FOOTER=$(grep "END" /tmp/raw_key) + BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n") + printf "%s\n" "$HEADER" > /tmp/working_key + printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key + printf "%s\n" "$FOOTER" >> /tmp/working_key + echo "" >> /tmp/working_key + chmod 600 /tmp/working_key - docker run --rm --net=host \ - -v "${WORK_DIR}:/workspace" -w /workspace \ - -e TARGET_HOST="${TARGET_HOST}" \ - -e TARGET_USER="${TARGET_USER}" \ - -e PORT="${PORT}" \ - -e DEST_DIR="${DEST_DIR}" \ - -e KEY_B64="${KEY_B64}" \ - alpine:latest sh -c ' - apk add --no-cache openssh-client rsync coreutils && \ - (echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/raw_key && \ - HEADER=$(grep "BEGIN" /tmp/raw_key) && \ - FOOTER=$(grep "END" /tmp/raw_key) && \ - BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n") && \ - printf "%s\n" "$HEADER" > /tmp/working_key && \ - printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key && \ - printf "%s\n" "$FOOTER" >> /tmp/working_key && \ - echo "" >> /tmp/working_key && \ - chmod 600 /tmp/working_key && \ - echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \ - echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ - echo "Destination Directory: ${DEST_DIR}" && \ - echo "Key File Line Count: $(wc -l < /tmp/working_key)" && \ - echo "Key File First Line: $(head -n 1 /tmp/working_key)" && \ - echo "=== 🔑 KEY FINGERPRINT ===" && \ - ssh-keygen -l -f /tmp/working_key && \ - SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ - echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \ - $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ - echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \ - if [ -f /workspace/scripts/backup_db.sh ]; then \ - rsync -avz -e "$SSH_CMD" /workspace/scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" ; \ - else \ - echo "ERROR: /workspace/scripts/backup_db.sh not found!" && ls -la /workspace && exit 1 ; \ - fi && \ - echo "=== 📦 RSYNC TRANSFER ENV ===" && \ - [ -f /workspace/.env ] || touch /workspace/.env && \ - rsync -avz -e "$SSH_CMD" /workspace/.env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ - $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \ - echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" - ' + echo "=== 🔍 DIAGNOSTIC DETAILS ===" + echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" + echo "Destination Directory: ${DEST_DIR}" + echo "Current Directory: $(pwd)" + echo "Script Exists: $([ -f scripts/backup_db.sh ] && echo 'YES' || echo 'NO')" + + echo "=== 🔑 KEY FINGERPRINT ===" + ssh-keygen -l -f /tmp/working_key + + SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" + + echo "=== 🚀 EXECUTING REMOTE COMMAND ===" + $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" + + echo "=== 📦 TRANSFERRING SCRIPT & ENV ===" + if command -v rsync >/dev/null 2>&1; then + echo "Using rsync for file transfer..." + rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" + [ -f .env ] || touch .env + rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" + else + echo "Using scp for file transfer..." + scp -P ${PORT} -i /tmp/working_key -o StrictHostKeyChecking=no scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" + [ -f .env ] || touch .env + scp -P ${PORT} -i /tmp/working_key -o StrictHostKeyChecking=no .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" + fi + + $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" + echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" From c778dea9a02f72ecfc353490d208c8d59512bd5f Mon Sep 17 00:00:00 2001 From: Youssef Date: Fri, 4 Sep 2026 08:10:08 +0200 Subject: [PATCH 26/31] fix(ci): combine --net=host with Base64 payload transfer for key, script, and env to resolve VPN routing and file isolation --- .gitea/workflows/ci-prod.yml | 81 +++++++++++++++++++----------------- 1 file changed, 42 insertions(+), 39 deletions(-) diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml index 7e61068..ef23864 100644 --- a/.gitea/workflows/ci-prod.yml +++ b/.gitea/workflows/ci-prod.yml @@ -149,43 +149,46 @@ jobs: exit 1 fi - rm -f /tmp/working_key /tmp/raw_key - printf "%s\n" "${RAW_KEY}" | tr -d '\r' > /tmp/raw_key - HEADER=$(grep "BEGIN" /tmp/raw_key) - FOOTER=$(grep "END" /tmp/raw_key) - BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n") - printf "%s\n" "$HEADER" > /tmp/working_key - printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key - printf "%s\n" "$FOOTER" >> /tmp/working_key - echo "" >> /tmp/working_key - chmod 600 /tmp/working_key + KEY_B64=$(printf "%s" "${RAW_KEY}" | tr -d '\r' | base64 | tr -d '\r\n') + SCRIPT_B64=$(base64 scripts/backup_db.sh | tr -d '\r\n') + [ -f .env ] && ENV_B64=$(base64 .env | tr -d '\r\n') || ENV_B64="" - echo "=== 🔍 DIAGNOSTIC DETAILS ===" - echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" - echo "Destination Directory: ${DEST_DIR}" - echo "Current Directory: $(pwd)" - echo "Script Exists: $([ -f scripts/backup_db.sh ] && echo 'YES' || echo 'NO')" - - echo "=== 🔑 KEY FINGERPRINT ===" - ssh-keygen -l -f /tmp/working_key - - SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" - - echo "=== 🚀 EXECUTING REMOTE COMMAND ===" - $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" - - echo "=== 📦 TRANSFERRING SCRIPT & ENV ===" - if command -v rsync >/dev/null 2>&1; then - echo "Using rsync for file transfer..." - rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" - [ -f .env ] || touch .env - rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" - else - echo "Using scp for file transfer..." - scp -P ${PORT} -i /tmp/working_key -o StrictHostKeyChecking=no scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" - [ -f .env ] || touch .env - scp -P ${PORT} -i /tmp/working_key -o StrictHostKeyChecking=no .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" - fi - - $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" - echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" + docker run --rm --net=host \ + -e TARGET_HOST="${TARGET_HOST}" \ + -e TARGET_USER="${TARGET_USER}" \ + -e PORT="${PORT}" \ + -e DEST_DIR="${DEST_DIR}" \ + -e KEY_B64="${KEY_B64}" \ + -e SCRIPT_B64="${SCRIPT_B64}" \ + -e ENV_B64="${ENV_B64}" \ + alpine:latest sh -c ' + apk add --no-cache openssh-client rsync coreutils && \ + (echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/raw_key && \ + HEADER=$(grep "BEGIN" /tmp/raw_key) && \ + FOOTER=$(grep "END" /tmp/raw_key) && \ + BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n") && \ + printf "%s\n" "$HEADER" > /tmp/working_key && \ + printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key && \ + printf "%s\n" "$FOOTER" >> /tmp/working_key && \ + echo "" >> /tmp/working_key && \ + chmod 600 /tmp/working_key && \ + (echo "$SCRIPT_B64" | base64 -d 2>/dev/null || echo "$SCRIPT_B64" | base64 --decode) > /tmp/backup_db.sh && \ + if [ -n "$ENV_B64" ]; then \ + (echo "$ENV_B64" | base64 -d 2>/dev/null || echo "$ENV_B64" | base64 --decode) > /tmp/.env ; \ + else \ + touch /tmp/.env ; \ + fi && \ + echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \ + echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ + echo "Destination Directory: ${DEST_DIR}" && \ + echo "=== 🔑 KEY FINGERPRINT ===" && \ + ssh-keygen -l -f /tmp/working_key && \ + SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ + echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \ + $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ + echo "=== 📦 RSYNC TRANSFER SCRIPT & ENV ===" && \ + rsync -avz -e "$SSH_CMD" /tmp/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/backup_db.sh" && \ + rsync -avz -e "$SSH_CMD" /tmp/.env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ + $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \ + echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" + ' From c994cbe155d6015caeccdfa4c175326716a77d56 Mon Sep 17 00:00:00 2001 From: Youssef Date: Fri, 4 Sep 2026 08:39:21 +0200 Subject: [PATCH 27/31] feat(backup): add automatic database restoration and RGPD anonymization for UAT environment (10.8.0.2) --- scripts/backup_db.sh | 71 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) diff --git a/scripts/backup_db.sh b/scripts/backup_db.sh index 0e9b36a..564b7ac 100755 --- a/scripts/backup_db.sh +++ b/scripts/backup_db.sh @@ -31,6 +31,14 @@ DB_HOST="${POSTGRES_HOST:-localhost}" DB_PORT="${POSTGRES_PORT:-5432}" CONTAINER_NAME="${DOCKER_CONTAINER_NAME:-astalange_db}" +# Variables UAT +ENABLE_UAT_RESTORE="${ENABLE_UAT_RESTORE:-true}" +UAT_DB_HOST="${UAT_DB_HOST:-10.8.0.2}" +UAT_DB_PORT="${UAT_DB_PORT:-5432}" +UAT_DB_NAME="${UAT_DB_NAME:-astalange}" +UAT_DB_USER="${UAT_DB_USER:-myuser}" +UAT_DB_PASSWORD="${UAT_DB_PASSWORD:-mypassword}" + # Configuration du transfert distant vers le VPS (optionnel) ENABLE_REMOTE_COPY="${ENABLE_REMOTE_COPY:-false}" REMOTE_HOST="${REMOTE_HOST:-}" @@ -98,6 +106,69 @@ if [ "$STATUS" = "SUCCESS" ]; then fi fi +# 2b. Restauration et Anonymisation vers la BDD UAT (10.8.0.2) +if [ "$STATUS" = "SUCCESS" ] && [ "$ENABLE_UAT_RESTORE" = "true" ]; then + log "Démarrage de la restauration et l'anonymisation sur UAT (${UAT_DB_USER}@${UAT_DB_HOST}:${UAT_DB_PORT}/${UAT_DB_NAME})..." + + ANONYMIZE_SQL=" +UPDATE adherent SET + nom = 'Nom_Adherent_' || id, + prenom = 'Prenom_Adherent_' || id, + email = 'adherent' || id || '@test.local', + telephone = '06' || LPAD((id)::text, 8, '0'), + lieu_naissance = 'Ville_' || id, + representant_legal = CASE + WHEN representant_legal IS NOT NULL AND TRIM(representant_legal) <> '' + THEN 'Representant_' || id + ELSE representant_legal + END; + +UPDATE pre_inscription SET + nom = 'Nom_PreInscr_' || id, + prenom = 'Prenom_PreInscr_' || id, + email = 'preinscr' || id || '@test.local', + telephone = '06' || LPAD((id)::text, 8, '0'), + lieu_naissance = 'Ville_' || id, + representant_legal = CASE + WHEN representant_legal IS NOT NULL AND TRIM(representant_legal) <> '' + THEN 'Representant_PreInscr_' || id + ELSE representant_legal + END; + +UPDATE educateur SET + nom = 'Nom_Educ_' || id, + prenom = 'Prenom_Educ_' || id, + email = 'educ' || id || '@test.local', + telephone = '06' || LPAD((id)::text, 8, '0'); +" + + RESTORE_SUCCESS=false + + if command -v psql >/dev/null 2>&1; then + log "Restauration UAT via psql local..." + if gunzip -c "$DUMP_PATH" | PGPASSWORD="${UAT_DB_PASSWORD}" psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" >> "$LOG_FILE" 2>&1; then + log "Exécution des requêtes d'anonymisation sur UAT..." + if PGPASSWORD="${UAT_DB_PASSWORD}" psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" -c "$ANONYMIZE_SQL" >> "$LOG_FILE" 2>&1; then + RESTORE_SUCCESS=true + fi + fi + elif command -v docker >/dev/null 2>&1; then + log "Restauration UAT via conteneur Docker postgres..." + if gunzip -c "$DUMP_PATH" | docker run --rm -i --net=host -e PGPASSWORD="${UAT_DB_PASSWORD}" postgres:15-alpine psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" >> "$LOG_FILE" 2>&1; then + log "Exécution des requêtes d'anonymisation sur UAT via Docker..." + if docker run --rm --net=host -e PGPASSWORD="${UAT_DB_PASSWORD}" postgres:15-alpine psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" -c "$ANONYMIZE_SQL" >> "$LOG_FILE" 2>&1; then + RESTORE_SUCCESS=true + fi + fi + fi + + if [ "$RESTORE_SUCCESS" = "true" ]; then + log "✅ Restauration et anonymisation UAT réussies avec succès !" + else + log "⚠️ AVERTISSEMENT: Impossible d'effectuer la restauration/anonymisation UAT." + fi +fi + # 3. Transfert sécurisé RSYNC / SCP vers le serveur VPS (Optionnel) if [ "$STATUS" = "SUCCESS" ] && [ "$ENABLE_REMOTE_COPY" = "true" ] && [ -n "$REMOTE_HOST" ]; then log "Transfert du dump vers le serveur VPS distant (${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_BACKUP_DIR})..." From e933218443032b0a9f68cec967da7e7ad625697b Mon Sep 17 00:00:00 2001 From: Youssef Date: Fri, 4 Sep 2026 08:42:55 +0200 Subject: [PATCH 28/31] feat(backup): update DB UAT port --- scripts/backup_db.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/backup_db.sh b/scripts/backup_db.sh index 564b7ac..088f530 100755 --- a/scripts/backup_db.sh +++ b/scripts/backup_db.sh @@ -34,7 +34,7 @@ CONTAINER_NAME="${DOCKER_CONTAINER_NAME:-astalange_db}" # Variables UAT ENABLE_UAT_RESTORE="${ENABLE_UAT_RESTORE:-true}" UAT_DB_HOST="${UAT_DB_HOST:-10.8.0.2}" -UAT_DB_PORT="${UAT_DB_PORT:-5432}" +UAT_DB_PORT="${UAT_DB_PORT:-5433}" UAT_DB_NAME="${UAT_DB_NAME:-astalange}" UAT_DB_USER="${UAT_DB_USER:-myuser}" UAT_DB_PASSWORD="${UAT_DB_PASSWORD:-mypassword}" From 19e969eb090f4e10bf77c9ffb3c6b5f0f4d9e5ee Mon Sep 17 00:00:00 2001 From: Youssef Date: Fri, 4 Sep 2026 08:54:48 +0200 Subject: [PATCH 29/31] fix(backup): clean UAT schema before restore and add --no-owner --no-privileges to pg_dump --- scripts/backup_db.sh | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/scripts/backup_db.sh b/scripts/backup_db.sh index 088f530..c7f56a5 100755 --- a/scripts/backup_db.sh +++ b/scripts/backup_db.sh @@ -88,11 +88,11 @@ if [ "$STATUS" = "SUCCESS" ]; then # Vérification si le conteneur Docker est actif if command -v docker >/dev/null 2>&1 && docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then log "Mode détection: Conteneur Docker '${CONTAINER_NAME}' trouvé. Utilisation de pg_dump via docker exec." - docker exec -e PGPASSWORD="${DB_PASSWORD}" "${CONTAINER_NAME}" pg_dump -U "${DB_USER}" -d "${DB_NAME}" | gzip > "$DUMP_PATH" 2>> "$LOG_FILE" + docker exec -e PGPASSWORD="${DB_PASSWORD}" "${CONTAINER_NAME}" pg_dump --no-owner --no-privileges -U "${DB_USER}" -d "${DB_NAME}" | gzip > "$DUMP_PATH" 2>> "$LOG_FILE" DUMP_EXIT_CODE=${PIPESTATUS[0]} else log "Mode détection: Exécution directe de pg_dump (hôte local)." - PGPASSWORD="${DB_PASSWORD}" pg_dump -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER}" -d "${DB_NAME}" | gzip > "$DUMP_PATH" 2>> "$LOG_FILE" + PGPASSWORD="${DB_PASSWORD}" pg_dump --no-owner --no-privileges -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER}" -d "${DB_NAME}" | gzip > "$DUMP_PATH" 2>> "$LOG_FILE" DUMP_EXIT_CODE=${PIPESTATUS[0]} fi @@ -110,6 +110,8 @@ fi if [ "$STATUS" = "SUCCESS" ] && [ "$ENABLE_UAT_RESTORE" = "true" ]; then log "Démarrage de la restauration et l'anonymisation sur UAT (${UAT_DB_USER}@${UAT_DB_HOST}:${UAT_DB_PORT}/${UAT_DB_NAME})..." + CLEAN_SCHEMA_SQL="DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public; GRANT ALL ON SCHEMA public TO ${UAT_DB_USER}; GRANT ALL ON SCHEMA public TO public;" + ANONYMIZE_SQL=" UPDATE adherent SET nom = 'Nom_Adherent_' || id, @@ -145,7 +147,10 @@ UPDATE educateur SET RESTORE_SUCCESS=false if command -v psql >/dev/null 2>&1; then - log "Restauration UAT via psql local..." + log "Réinitialisation du schéma public sur UAT..." + PGPASSWORD="${UAT_DB_PASSWORD}" psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" -c "$CLEAN_SCHEMA_SQL" >> "$LOG_FILE" 2>&1 + + log "Restauration du dump Prod vers UAT..." if gunzip -c "$DUMP_PATH" | PGPASSWORD="${UAT_DB_PASSWORD}" psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" >> "$LOG_FILE" 2>&1; then log "Exécution des requêtes d'anonymisation sur UAT..." if PGPASSWORD="${UAT_DB_PASSWORD}" psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" -c "$ANONYMIZE_SQL" >> "$LOG_FILE" 2>&1; then @@ -153,7 +158,10 @@ UPDATE educateur SET fi fi elif command -v docker >/dev/null 2>&1; then - log "Restauration UAT via conteneur Docker postgres..." + log "Réinitialisation du schéma public sur UAT via Docker..." + docker run --rm --net=host -e PGPASSWORD="${UAT_DB_PASSWORD}" postgres:15-alpine psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" -c "$CLEAN_SCHEMA_SQL" >> "$LOG_FILE" 2>&1 + + log "Restauration du dump Prod vers UAT via Docker..." if gunzip -c "$DUMP_PATH" | docker run --rm -i --net=host -e PGPASSWORD="${UAT_DB_PASSWORD}" postgres:15-alpine psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" >> "$LOG_FILE" 2>&1; then log "Exécution des requêtes d'anonymisation sur UAT via Docker..." if docker run --rm --net=host -e PGPASSWORD="${UAT_DB_PASSWORD}" postgres:15-alpine psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" -c "$ANONYMIZE_SQL" >> "$LOG_FILE" 2>&1; then From f6c853068f5ce854c2291f408c9f0e1627a81529 Mon Sep 17 00:00:00 2001 From: Youssef Date: Fri, 4 Sep 2026 09:07:31 +0200 Subject: [PATCH 30/31] fix(backup): purge pg_largeobject metadata prior to UAT schema reset --- scripts/backup_db.sh | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/scripts/backup_db.sh b/scripts/backup_db.sh index c7f56a5..9eeaee4 100755 --- a/scripts/backup_db.sh +++ b/scripts/backup_db.sh @@ -110,7 +110,13 @@ fi if [ "$STATUS" = "SUCCESS" ] && [ "$ENABLE_UAT_RESTORE" = "true" ]; then log "Démarrage de la restauration et l'anonymisation sur UAT (${UAT_DB_USER}@${UAT_DB_HOST}:${UAT_DB_PORT}/${UAT_DB_NAME})..." - CLEAN_SCHEMA_SQL="DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public; GRANT ALL ON SCHEMA public TO ${UAT_DB_USER}; GRANT ALL ON SCHEMA public TO public;" + CLEAN_SCHEMA_SQL=" +DO \$\$ DECLARE r RECORD; BEGIN FOR r IN (SELECT oid FROM pg_largeobject_metadata) LOOP PERFORM lo_unlink(r.oid); END LOOP; EXCEPTION WHEN OTHERS THEN NULL; END \$\$; +DROP SCHEMA IF EXISTS public CASCADE; +CREATE SCHEMA public; +GRANT ALL ON SCHEMA public TO ${UAT_DB_USER}; +GRANT ALL ON SCHEMA public TO public; +" ANONYMIZE_SQL=" UPDATE adherent SET @@ -118,7 +124,7 @@ UPDATE adherent SET prenom = 'Prenom_Adherent_' || id, email = 'adherent' || id || '@test.local', telephone = '06' || LPAD((id)::text, 8, '0'), - lieu_naissance = 'Ville_' || id, + lieu_naissance_ville = 'Ville_' || id, representant_legal = CASE WHEN representant_legal IS NOT NULL AND TRIM(representant_legal) <> '' THEN 'Representant_' || id @@ -130,7 +136,7 @@ UPDATE pre_inscription SET prenom = 'Prenom_PreInscr_' || id, email = 'preinscr' || id || '@test.local', telephone = '06' || LPAD((id)::text, 8, '0'), - lieu_naissance = 'Ville_' || id, + lieu_naissance_ville = 'Ville_' || id, representant_legal = CASE WHEN representant_legal IS NOT NULL AND TRIM(representant_legal) <> '' THEN 'Representant_PreInscr_' || id From b1d897a3c87f25096c9f303ba86f0a87b79397e4 Mon Sep 17 00:00:00 2001 From: Youssef Date: Fri, 4 Sep 2026 09:19:13 +0200 Subject: [PATCH 31/31] fix(backup): handle SIGPIPE exit code 141 in pg_dump pipeline --- scripts/backup_db.sh | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/scripts/backup_db.sh b/scripts/backup_db.sh index 9eeaee4..cf6375a 100755 --- a/scripts/backup_db.sh +++ b/scripts/backup_db.sh @@ -96,10 +96,15 @@ if [ "$STATUS" = "SUCCESS" ]; then DUMP_EXIT_CODE=${PIPESTATUS[0]} fi - if [ ${DUMP_EXIT_CODE} -eq 0 ] && [ -s "$DUMP_PATH" ]; then - DUMP_SIZE=$(du -h "$DUMP_PATH" | cut -f1) - log "✅ Dump généré avec succès ! Taille du fichier : ${DUMP_SIZE}" - else + if [ ${DUMP_EXIT_CODE} -eq 0 ] || [ ${DUMP_EXIT_CODE} -eq 141 ]; then + if [ -s "$DUMP_PATH" ]; then + DUMP_SIZE=$(du -h "$DUMP_PATH" | cut -f1) + log "✅ Dump généré avec succès ! Taille du fichier : ${DUMP_SIZE}" + DUMP_EXIT_CODE=0 + fi + fi + + if [ ${DUMP_EXIT_CODE} -ne 0 ]; then log "❌ ERREUR lors de l'extraction de la base de données (code de sortie: ${DUMP_EXIT_CODE})." STATUS="FAILURE" rm -f "$DUMP_PATH"