M48: harden demo operations and offsite recovery

2026-08-21 22:17:49 +02:00
parent a24098c583
commit 00191e9b54
28 changed files with 1136 additions and 332 deletions
@@ -0,0 +1,38 @@
+#!/bin/sh
+set -eu
+
+root="${MOBILITYOPS_DEPLOY_ROOT:-/mnt/user/appdata/mobilityops}"
+config_dir="${MOBILITYOPS_RCLONE_CONFIG_DIR:-$root/.secrets/rclone}"
+remote="${1:-onedrive}"
+
+case "$config_dir" in ""|"/"|".") echo "Unsafe rclone configuration directory" >&2; exit 1;; esac
+case "$remote" in ""|*:*|*/*) echo "Remote must be a simple rclone remote name" >&2; exit 1;; esac
+mkdir -p "$config_dir"
+chmod 700 "$config_dir"
+
+revision="$(cat "$root/.deploy/source-revision")"
+release_dir="$root/.deploy/releases/$revision"
+short_revision="$(printf '%s' "$revision" | cut -c1-12)"
+image="mobilityops-backup-tools:$short_revision"
+docker build --build-arg "VCS_REF=$revision" --tag "$image" \
+  --file "$release_dir/deploy/unraid/Dockerfile.backup-tools" "$release_dir"
+
+echo "Configure Microsoft OneDrive as remote '$remote'; OAuth opens in your browser."
+docker run --rm -it --entrypoint rclone -v "$config_dir:/config/rclone" "$image" config
+chmod 600 "$config_dir/rclone.conf"
+docker run --rm --entrypoint rclone -v "$config_dir:/config/rclone" "$image" lsd "$remote:"
+
+history="$(tail -n 1 "$root/.deploy/release-history.log")"
+# shellcheck disable=SC2086
+set -- $history
+[ "$1" = "$revision" ] || { echo "Release history does not match active revision" >&2; exit 1; }
+export MOBILITYOPS_API_IMAGE="$2" MOBILITYOPS_WEB_IMAGE="$3"
+export MOBILITYOPS_SOURCE_REVISION="$revision"
+export MOBILITYOPS_BACKUP_TOOLS_IMAGE="$image"
+export MOBILITYOPS_RCLONE_CONFIG_DIR="$config_dir"
+export MOBILITYOPS_BACKUP_DIR="${MOBILITYOPS_BACKUP_DIR:-$root/backups/postgres}"
+export MOBILITYOPS_OFFSITE_VERIFY_DIR="${MOBILITYOPS_OFFSITE_VERIFY_DIR:-$root/backups/offsite-verify}"
+export RCLONE_ONEDRIVE_REMOTE="$remote"
+compose="docker compose --env-file $root/.env -p ${COMPOSE_PROJECT_NAME:-mobilityops} -f $release_dir/compose.yaml -f $release_dir/compose.unraid.yaml -f $release_dir/compose.observability.yaml -f $release_dir/compose.release.yaml --profile offsite"
+$compose up --no-build -d offsite-backup
+echo "OneDrive remote '$remote' is reachable and the off-site backup worker is starting."