339 lines
15 KiB
Bash
Executable File
339 lines
15 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ==============================================================================
|
|
# Script de sauvegarde automatisée de la base de données PostgreSQL AS Talange
|
|
# Exécution : Sur le serveur distant / interne hébergeant la base de données
|
|
# Rétention : 7 jours glissants (en local et sur le serveur de stockage VPS)
|
|
# Transfert : Copie sécurisée via SCP/SSH vers le serveur VPS (optionnel)
|
|
# Notification : Email de bilan (Succès/Échec + Logs) via l'API Brevo
|
|
# ==============================================================================
|
|
|
|
set -u
|
|
|
|
# Localisation du répertoire du script et du projet
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
PROJECT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
|
|
|
# Chargement du fichier .env si présent dans le projet
|
|
if [ -f "${PROJECT_DIR}/.env" ]; then
|
|
set -a
|
|
source "${PROJECT_DIR}/.env"
|
|
set +a
|
|
fi
|
|
|
|
# Variables de configuration (avec valeurs par défaut)
|
|
BACKUP_DIR="${BACKUP_DIR:-${PROJECT_DIR}/backups}"
|
|
RETENTION_DAYS="${RETENTION_DAYS:-7}"
|
|
|
|
DB_NAME="${POSTGRES_DB:-astalange}"
|
|
DB_USER="${POSTGRES_USER:-myuser}"
|
|
DB_PASSWORD="${POSTGRES_PASSWORD:-mypassword}"
|
|
DB_HOST="${POSTGRES_HOST:-localhost}"
|
|
DB_PORT="${POSTGRES_PORT:-5432}"
|
|
CONTAINER_NAME="${DOCKER_CONTAINER_NAME:-astalange_db}"
|
|
|
|
# Variables UAT
|
|
ENABLE_UAT_RESTORE="${ENABLE_UAT_RESTORE:-true}"
|
|
UAT_DB_HOST="${UAT_DB_HOST:-10.8.0.2}"
|
|
UAT_DB_PORT="${UAT_DB_PORT:-5433}"
|
|
UAT_DB_NAME="${UAT_DB_NAME:-astalange}"
|
|
UAT_DB_USER="${UAT_DB_USER:-myuser}"
|
|
UAT_DB_PASSWORD="${UAT_DB_PASSWORD:-mypassword}"
|
|
|
|
# Configuration du transfert distant vers le VPS (optionnel)
|
|
ENABLE_REMOTE_COPY="${ENABLE_REMOTE_COPY:-false}"
|
|
REMOTE_HOST="${REMOTE_HOST:-}"
|
|
REMOTE_USER="${REMOTE_USER:-root}"
|
|
REMOTE_PORT="${REMOTE_PORT:-22}"
|
|
REMOTE_BACKUP_DIR="${REMOTE_BACKUP_DIR:-/var/backups/as-talange}"
|
|
SSH_KEY_PATH="${SSH_KEY_PATH:-${HOME}/.ssh/id_rsa}"
|
|
|
|
# Configuration Brevo
|
|
BREVO_API_KEY="${BREVO_API_KEY:-}"
|
|
BREVO_SENDER_EMAIL="${APP_MAIL_FROM:-astalange1933@gmail.com}"
|
|
BREVO_SENDER_NAME="${BREVO_SENDER_NAME:-AS Talange Backup}"
|
|
RECIPIENT_EMAIL="${NOTIFICATION_EMAIL:-astalange1933@gmail.com}"
|
|
|
|
# Fichier journal temporaire pour cette exécution
|
|
TIMESTAMP=$(date +"%Y-%m-%d_%H%M%S")
|
|
DATE_HUMAN=$(date +"%d/%m/%Y à %H:%M:%S")
|
|
LOG_FILE=$(mktemp /tmp/astalange_backup_${TIMESTAMP}_XXXXXX.log)
|
|
DUMP_FILENAME="astalange_db_backup_${TIMESTAMP}.sql.gz"
|
|
DUMP_PATH="${BACKUP_DIR}/${DUMP_FILENAME}"
|
|
|
|
STATUS="SUCCESS"
|
|
DUMP_SIZE="0 KB"
|
|
|
|
log() {
|
|
echo "[$(date +'%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
|
|
}
|
|
|
|
log "======================================================================"
|
|
log " Démarrage du script de sauvegarde AS Talange (Serveur BDD)"
|
|
log "======================================================================"
|
|
log "Date d'exécution : ${DATE_HUMAN}"
|
|
log "Dossier local de sauvegarde : ${BACKUP_DIR}"
|
|
log "Fichier cible : ${DUMP_FILENAME}"
|
|
log "Rétention : ${RETENTION_DAYS} jours"
|
|
|
|
# 1. Création du répertoire de sauvegarde local si nécessaire
|
|
if ! mkdir -p "$BACKUP_DIR" >> "$LOG_FILE" 2>&1; then
|
|
log "ERREUR: Impossible de créer le dossier de sauvegarde local ${BACKUP_DIR}"
|
|
STATUS="FAILURE"
|
|
fi
|
|
|
|
# 2. Déroulement du Dump PostgreSQL
|
|
if [ "$STATUS" = "SUCCESS" ]; then
|
|
log "Démarrage de l'extraction (dump) de la base de données..."
|
|
|
|
# Vérification si le conteneur Docker est actif
|
|
if command -v docker >/dev/null 2>&1 && docker ps --format '{{.Names}}' | grep -q "^${CONTAINER_NAME}$"; then
|
|
log "Mode détection: Conteneur Docker '${CONTAINER_NAME}' trouvé. Utilisation de pg_dump via docker exec."
|
|
docker exec -e PGPASSWORD="${DB_PASSWORD}" "${CONTAINER_NAME}" pg_dump --no-owner --no-privileges -U "${DB_USER}" -d "${DB_NAME}" | gzip > "$DUMP_PATH" 2>> "$LOG_FILE"
|
|
DUMP_EXIT_CODE=${PIPESTATUS[0]}
|
|
else
|
|
log "Mode détection: Exécution directe de pg_dump (hôte local)."
|
|
PGPASSWORD="${DB_PASSWORD}" pg_dump --no-owner --no-privileges -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER}" -d "${DB_NAME}" | gzip > "$DUMP_PATH" 2>> "$LOG_FILE"
|
|
DUMP_EXIT_CODE=${PIPESTATUS[0]}
|
|
fi
|
|
|
|
if [ ${DUMP_EXIT_CODE} -eq 0 ] && [ -s "$DUMP_PATH" ]; then
|
|
DUMP_SIZE=$(du -h "$DUMP_PATH" | cut -f1)
|
|
log "✅ Dump généré avec succès ! Taille du fichier : ${DUMP_SIZE}"
|
|
else
|
|
log "❌ ERREUR lors de l'extraction de la base de données (code de sortie: ${DUMP_EXIT_CODE})."
|
|
STATUS="FAILURE"
|
|
rm -f "$DUMP_PATH"
|
|
fi
|
|
fi
|
|
|
|
# 2b. Restauration et Anonymisation vers la BDD UAT (10.8.0.2)
|
|
if [ "$STATUS" = "SUCCESS" ] && [ "$ENABLE_UAT_RESTORE" = "true" ]; then
|
|
log "Démarrage de la restauration et l'anonymisation sur UAT (${UAT_DB_USER}@${UAT_DB_HOST}:${UAT_DB_PORT}/${UAT_DB_NAME})..."
|
|
|
|
CLEAN_SCHEMA_SQL="DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public; GRANT ALL ON SCHEMA public TO ${UAT_DB_USER}; GRANT ALL ON SCHEMA public TO public;"
|
|
|
|
ANONYMIZE_SQL="
|
|
UPDATE adherent SET
|
|
nom = 'Nom_Adherent_' || id,
|
|
prenom = 'Prenom_Adherent_' || id,
|
|
email = 'adherent' || id || '@test.local',
|
|
telephone = '06' || LPAD((id)::text, 8, '0'),
|
|
lieu_naissance = 'Ville_' || id,
|
|
representant_legal = CASE
|
|
WHEN representant_legal IS NOT NULL AND TRIM(representant_legal) <> ''
|
|
THEN 'Representant_' || id
|
|
ELSE representant_legal
|
|
END;
|
|
|
|
UPDATE pre_inscription SET
|
|
nom = 'Nom_PreInscr_' || id,
|
|
prenom = 'Prenom_PreInscr_' || id,
|
|
email = 'preinscr' || id || '@test.local',
|
|
telephone = '06' || LPAD((id)::text, 8, '0'),
|
|
lieu_naissance = 'Ville_' || id,
|
|
representant_legal = CASE
|
|
WHEN representant_legal IS NOT NULL AND TRIM(representant_legal) <> ''
|
|
THEN 'Representant_PreInscr_' || id
|
|
ELSE representant_legal
|
|
END;
|
|
|
|
UPDATE educateur SET
|
|
nom = 'Nom_Educ_' || id,
|
|
prenom = 'Prenom_Educ_' || id,
|
|
email = 'educ' || id || '@test.local',
|
|
telephone = '06' || LPAD((id)::text, 8, '0');
|
|
"
|
|
|
|
RESTORE_SUCCESS=false
|
|
|
|
if command -v psql >/dev/null 2>&1; then
|
|
log "Réinitialisation du schéma public sur UAT..."
|
|
PGPASSWORD="${UAT_DB_PASSWORD}" psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" -c "$CLEAN_SCHEMA_SQL" >> "$LOG_FILE" 2>&1
|
|
|
|
log "Restauration du dump Prod vers UAT..."
|
|
if gunzip -c "$DUMP_PATH" | PGPASSWORD="${UAT_DB_PASSWORD}" psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" >> "$LOG_FILE" 2>&1; then
|
|
log "Exécution des requêtes d'anonymisation sur UAT..."
|
|
if PGPASSWORD="${UAT_DB_PASSWORD}" psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" -c "$ANONYMIZE_SQL" >> "$LOG_FILE" 2>&1; then
|
|
RESTORE_SUCCESS=true
|
|
fi
|
|
fi
|
|
elif command -v docker >/dev/null 2>&1; then
|
|
log "Réinitialisation du schéma public sur UAT via Docker..."
|
|
docker run --rm --net=host -e PGPASSWORD="${UAT_DB_PASSWORD}" postgres:15-alpine psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" -c "$CLEAN_SCHEMA_SQL" >> "$LOG_FILE" 2>&1
|
|
|
|
log "Restauration du dump Prod vers UAT via Docker..."
|
|
if gunzip -c "$DUMP_PATH" | docker run --rm -i --net=host -e PGPASSWORD="${UAT_DB_PASSWORD}" postgres:15-alpine psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" >> "$LOG_FILE" 2>&1; then
|
|
log "Exécution des requêtes d'anonymisation sur UAT via Docker..."
|
|
if docker run --rm --net=host -e PGPASSWORD="${UAT_DB_PASSWORD}" postgres:15-alpine psql -h "${UAT_DB_HOST}" -p "${UAT_DB_PORT}" -U "${UAT_DB_USER}" -d "${UAT_DB_NAME}" -c "$ANONYMIZE_SQL" >> "$LOG_FILE" 2>&1; then
|
|
RESTORE_SUCCESS=true
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
if [ "$RESTORE_SUCCESS" = "true" ]; then
|
|
log "✅ Restauration et anonymisation UAT réussies avec succès !"
|
|
else
|
|
log "⚠️ AVERTISSEMENT: Impossible d'effectuer la restauration/anonymisation UAT."
|
|
fi
|
|
fi
|
|
|
|
# 3. Transfert sécurisé RSYNC / SCP vers le serveur VPS (Optionnel)
|
|
if [ "$STATUS" = "SUCCESS" ] && [ "$ENABLE_REMOTE_COPY" = "true" ] && [ -n "$REMOTE_HOST" ]; then
|
|
log "Transfert du dump vers le serveur VPS distant (${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_BACKUP_DIR})..."
|
|
|
|
SSH_CMD="ssh -i ${SSH_KEY_PATH} -p ${REMOTE_PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=10"
|
|
|
|
# Création du dossier distant si nécessaire
|
|
$SSH_CMD "${REMOTE_USER}@${REMOTE_HOST}" "mkdir -p ${REMOTE_BACKUP_DIR}" >> "$LOG_FILE" 2>&1
|
|
|
|
TRANSFER_SUCCESS=false
|
|
|
|
# Privilégier rsync si disponible
|
|
if command -v rsync >/dev/null 2>&1; then
|
|
log "Utilisation de RSYNC pour le transfert..."
|
|
RSYNC_CMD="rsync -avz -e \"ssh -i ${SSH_KEY_PATH} -p ${REMOTE_PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=10\""
|
|
if eval $RSYNC_CMD "$DUMP_PATH" "${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_BACKUP_DIR}/${DUMP_FILENAME}" >> "$LOG_FILE" 2>&1; then
|
|
TRANSFER_SUCCESS=true
|
|
fi
|
|
fi
|
|
|
|
# Fallback vers SCP si rsync échoue ou n'est pas installé
|
|
if [ "$TRANSFER_SUCCESS" = "false" ]; then
|
|
log "Utilisation de SCP pour le transfert..."
|
|
SCP_CMD="scp -i ${SSH_KEY_PATH} -P ${REMOTE_PORT} -o StrictHostKeyChecking=no -o ConnectTimeout=10"
|
|
if $SCP_CMD "$DUMP_PATH" "${REMOTE_USER}@${REMOTE_HOST}:${REMOTE_BACKUP_DIR}/${DUMP_FILENAME}" >> "$LOG_FILE" 2>&1; then
|
|
TRANSFER_SUCCESS=true
|
|
fi
|
|
fi
|
|
|
|
if [ "$TRANSFER_SUCCESS" = "true" ]; then
|
|
log "✅ Copie distante vers le VPS réussie !"
|
|
|
|
# Nettoyage des sauvegardes distantes sur le VPS (> 7 jours)
|
|
log "Nettoyage des sauvegardes distantes de plus de ${RETENTION_DAYS} jours sur le VPS..."
|
|
$SSH_CMD "${REMOTE_USER}@${REMOTE_HOST}" "find ${REMOTE_BACKUP_DIR} -type f -name 'astalange_db_backup_*.sql.gz' -mtime +${RETENTION_DAYS} -delete" >> "$LOG_FILE" 2>&1
|
|
else
|
|
log "❌ ERREUR lors du transfert (rsync/scp) vers le serveur VPS."
|
|
STATUS="FAILURE"
|
|
fi
|
|
fi
|
|
|
|
# 4. Nettoyage des anciennes sauvegardes locales (> 7 jours)
|
|
if [ "$STATUS" = "SUCCESS" ]; then
|
|
log "Nettoyage des sauvegardes locales de plus de ${RETENTION_DAYS} jours..."
|
|
DELETED_FILES=$(find "$BACKUP_DIR" -type f -name "astalange_db_backup_*.sql.gz" -mtime +${RETENTION_DAYS} -print)
|
|
if [ -n "$DELETED_FILES" ]; then
|
|
log "Fichiers locaux supprimés (obsolètes) :"
|
|
echo "$DELETED_FILES" | tee -a "$LOG_FILE"
|
|
find "$BACKUP_DIR" -type f -name "astalange_db_backup_*.sql.gz" -mtime +${RETENTION_DAYS} -delete >> "$LOG_FILE" 2>&1
|
|
else
|
|
log "Aucune sauvegarde locale obsolète à supprimer."
|
|
fi
|
|
fi
|
|
|
|
log "======================================================================"
|
|
log " Fin du traitement de sauvegarde. Statut global : ${STATUS}"
|
|
log "======================================================================"
|
|
|
|
# 5. Envoi de l'email de rapport via Brevo API
|
|
send_email_notification() {
|
|
if [ -z "${BREVO_API_KEY}" ]; then
|
|
log "ATTENTION: BREVO_API_KEY n'est pas définie. Envoi d'email ignoré."
|
|
return 0
|
|
fi
|
|
|
|
log "Envoi du rapport par email via l'API Brevo à ${RECIPIENT_EMAIL}..."
|
|
|
|
if [ "$STATUS" = "SUCCESS" ]; then
|
|
SUBJECT="[AS Talange] ✅ Backup Base de Données Réussi - $(date +'%d/%m/%Y')"
|
|
HEADER_BG="#28a745"
|
|
STATUS_LABEL="SUCCÈS"
|
|
else
|
|
SUBJECT="[AS Talange] ❌ ECHEC du Backup Base de Données - $(date +'%d/%m/%Y')"
|
|
HEADER_BG="#dc3545"
|
|
STATUS_LABEL="ÉCHEC"
|
|
fi
|
|
|
|
LOG_CONTENT=$(cat "$LOG_FILE")
|
|
|
|
PYTHON_JSON_GEN=$(python3 -c '
|
|
import json, sys
|
|
|
|
status_label = sys.argv[1]
|
|
header_bg = sys.argv[2]
|
|
timestamp = sys.argv[3]
|
|
dump_name = sys.argv[4]
|
|
dump_size = sys.argv[5]
|
|
log_content = sys.argv[6]
|
|
sender_name = sys.argv[7]
|
|
sender_email = sys.argv[8]
|
|
recipient_email = sys.argv[9]
|
|
subject = sys.argv[10]
|
|
|
|
html = f"""
|
|
<!DOCTYPE html>
|
|
<html>
|
|
<head><meta charset="utf-8"></head>
|
|
<body style="font-family: Arial, sans-serif; background-color: #f4f6f9; padding: 20px; color: #333;">
|
|
<div style="max-width: 650px; margin: 0 auto; background: #ffffff; border-radius: 8px; overflow: hidden; box-shadow: 0 2px 8px rgba(0,0,0,0.1);">
|
|
<div style="background-color: {header_bg}; color: white; padding: 15px 20px; text-align: center;">
|
|
<h2 style="margin:0;">Sauvegarde Base de Données AS Talange</h2>
|
|
<p style="margin: 5px 0 0 0; font-weight: bold;">Statut : {status_label}</p>
|
|
</div>
|
|
<div style="padding: 20px;">
|
|
<table style="width: 100%; border-collapse: collapse; margin-bottom: 20px;">
|
|
<tr><td style="padding: 8px; font-weight: bold; width: 35%;">Date :</td><td style="padding: 8px;">{timestamp}</td></tr>
|
|
<tr><td style="padding: 8px; font-weight: bold;">Fichier Dump :</td><td style="padding: 8px;"><code>{dump_name}</code></td></tr>
|
|
<tr><td style="padding: 8px; font-weight: bold;">Taille :</td><td style="padding: 8px;">{dump_size}</td></tr>
|
|
</table>
|
|
|
|
<h3 style="border-bottom: 2px solid #eee; padding-bottom: 8px; color: #555;">Logs d'exécution :</h3>
|
|
<pre style="background: #272822; color: #f8f8f2; padding: 15px; border-radius: 5px; font-size: 12px; overflow-x: auto; white-space: pre-wrap;">{log_content}</pre>
|
|
</div>
|
|
<div style="background: #e9ecef; padding: 10px 20px; font-size: 12px; text-align: center; color: #6c757d;">
|
|
Script automatique de sauvegarde AS Talange - Rétention 7 jours
|
|
</div>
|
|
</div>
|
|
</body>
|
|
</html>
|
|
"""
|
|
|
|
payload = {
|
|
"sender": {"name": sender_name, "email": sender_email},
|
|
"to": [{"email": recipient_email}],
|
|
"subject": subject,
|
|
"htmlContent": html
|
|
}
|
|
|
|
print(json.dumps(payload))
|
|
' "$STATUS_LABEL" "$HEADER_BG" "$DATE_HUMAN" "$DUMP_FILENAME" "${DUMP_SIZE:-N/A}" "$LOG_CONTENT" "$BREVO_SENDER_NAME" "$BREVO_SENDER_EMAIL" "$RECIPIENT_EMAIL" "$SUBJECT" 2>/dev/null)
|
|
|
|
if [ -n "$PYTHON_JSON_GEN" ]; then
|
|
RESPONSE=$(curl -s -w "\nHTTP_CODE:%{http_code}" -X POST "https://api.brevo.com/v3/smtp/email" \
|
|
-H "accept: application/json" \
|
|
-H "api-key: ${BREVO_API_KEY}" \
|
|
-H "content-type: application/json" \
|
|
-d "$PYTHON_JSON_GEN")
|
|
|
|
HTTP_CODE=$(echo "$RESPONSE" | grep "HTTP_CODE:" | cut -d: -f2)
|
|
if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
|
|
log "✅ Email envoyé avec succès via l'API Brevo !"
|
|
else
|
|
log "❌ ERREUR lors de l'envoi de l'email via Brevo (Code HTTP: ${HTTP_CODE}). Réponse: ${RESPONSE}"
|
|
fi
|
|
else
|
|
log "❌ ERREUR: Échec de la génération du payload JSON pour l'email."
|
|
fi
|
|
}
|
|
|
|
send_email_notification
|
|
|
|
# Nettoyage du fichier log temporaire
|
|
rm -f "$LOG_FILE"
|
|
|
|
if [ "$STATUS" = "FAILURE" ]; then
|
|
exit 1
|
|
fi
|
|
|
|
exit 0
|