18 lines
692 B
Django/Jinja
18 lines
692 B
Django/Jinja
#!/usr/bin/env bash
|
|
# Konsistentes, verschluesseltes SQLite-Backup (Konzept 6.8).
|
|
# KEK-Backup erfolgt bewusst GETRENNT (siehe Konzept 6.8) -- dieses Skript
|
|
# sichert ausschliesslich die Datenbank, kein Schluesselmaterial.
|
|
set -euo pipefail
|
|
|
|
DB_PATH="{{ jumphost_data_dir }}/jumphost.db"
|
|
BACKUP_DIR="{{ backup_dir }}"
|
|
TS="$(date -u +%Y%m%dT%H%M%SZ)"
|
|
OUT_PLAIN="${BACKUP_DIR}/jumphost_${TS}.db"
|
|
OUT_ENC="${OUT_PLAIN}.age"
|
|
|
|
sqlite3 "$DB_PATH" "VACUUM INTO '${OUT_PLAIN}'"
|
|
age -r "{{ backup_age_public_key | default('AGE_PUBLIC_KEY_PLACEHOLDER') }}" -o "${OUT_ENC}" "${OUT_PLAIN}"
|
|
shred -u "${OUT_PLAIN}"
|
|
|
|
find "$BACKUP_DIR" -name 'jumphost_*.db.age' -mtime +{{ backup_retention_days }} -delete
|