7acfdabbac
The backup engine already drops to the backup user (sudo -E -u $docker_install_user) and backupLocationOwner == $docker_install_user, which is exactly what runFileOp/runFileWrite resolve to in both modes. So convert the raw-sudo data ops (mkdir/chmod/rm/find/cat/grep/mv/chown/tee on backup repos, location configs, keys, manifests) to runFileOp/runFileWrite — creating files as the owner directly, no root chown. backup_verify creates its scratch as the backup user (runFileOp mktemp) instead of chown-after. Binary installs (kopia tar/install, borg dnf) -> runSystem. The 44 sudo -u engine drops stay (already least-privilege; the scoped sudoers will grant them). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: librelad <librelad@digitalangels.vip>
107 lines
4.0 KiB
Bash
107 lines
4.0 KiB
Bash
#!/bin/bash
|
|
|
|
# One-shot migration from the legacy single-file layout
|
|
# (configs/backup/backup_locations + configs/security/restic/loc_N.pass)
|
|
# to the per-location directory layout. Passwords now live as
|
|
# CFG_BACKUP_LOC_<idx>_PASSWORD inside the location.config — old .pass
|
|
# files get inlined and deleted.
|
|
#
|
|
# Idempotent — early-outs if the new layout is already present.
|
|
|
|
backupLocationsMigrate()
|
|
{
|
|
local new_dir
|
|
new_dir=$(backupLocationsDir)
|
|
local old_file="$configs_dir/backup/backup_locations"
|
|
|
|
# Already migrated? Detect by presence of at least one location.config.
|
|
if [[ -d "$new_dir" ]]; then
|
|
local existing
|
|
existing=$(runFileOp find "$new_dir" -mindepth 2 -maxdepth 2 -name location.config -type f 2>/dev/null | head -1)
|
|
if [[ -n "$existing" ]]; then
|
|
return 0
|
|
fi
|
|
fi
|
|
|
|
# Nothing to migrate AND no fresh seed in dev — skip silently.
|
|
if [[ ! -f "$old_file" ]]; then
|
|
return 0
|
|
fi
|
|
|
|
isHeader "Migrating backup locations to per-location directories"
|
|
|
|
local owner
|
|
owner=$(backupLocationOwner)
|
|
runFileOp mkdir -p "$new_dir"
|
|
runFileOp chown "$owner":"$owner" "$new_dir"
|
|
runFileOp chmod 0755 "$new_dir"
|
|
|
|
local indices
|
|
indices=$(runFileOp grep -oE '^CFG_BACKUP_LOC_[0-9]+_' "$old_file" 2>/dev/null | grep -oE '[0-9]+' | sort -nu)
|
|
if [[ -z "$indices" ]]; then
|
|
isNotice "No locations found in legacy file — archiving without migration"
|
|
fi
|
|
|
|
local idx
|
|
for idx in $indices; do
|
|
local loc_dir cfg_file
|
|
loc_dir=$(backupLocationDir "$idx")
|
|
cfg_file=$(backupLocationConfig "$idx")
|
|
|
|
runFileOp mkdir -p "$loc_dir"
|
|
runFileOp chown "$owner":"$owner" "$loc_dir"
|
|
runFileOp chmod 0700 "$loc_dir"
|
|
|
|
local old_pass="/docker/configs/security/restic/loc_${idx}.pass"
|
|
local pass_value=""
|
|
if [[ -f "$old_pass" ]]; then
|
|
pass_value=$(runFileOp cat "$old_pass" | tr -d '\n\r')
|
|
fi
|
|
[[ -z "$pass_value" ]] && pass_value="RANDOMIZEDPASSWORD1"
|
|
|
|
{
|
|
echo "# Backup location $idx — migrated $(date -Iseconds) from $old_file."
|
|
echo "# Edit via the Locations page on /backup, or directly here."
|
|
echo "CFG_BACKUP_LOC_${idx}_PASSWORD=${pass_value} # Repository Password - Used to encrypt/decrypt snapshots — back up offline!"
|
|
runFileOp grep "^CFG_BACKUP_LOC_${idx}_" "$old_file" | grep -v "^CFG_BACKUP_LOC_${idx}_PASSWORD="
|
|
} | runFileWrite "$cfg_file" >/dev/null
|
|
runFileOp chown "$owner":"$owner" "$cfg_file"
|
|
runFileOp chmod 0640 "$cfg_file"
|
|
|
|
if [[ -f "$old_pass" ]]; then
|
|
runFileOp rm -f "$old_pass"
|
|
isNotice "Inlined password for location $idx into $cfg_file (old .pass removed)"
|
|
elif declare -f replacePlainPasswords >/dev/null 2>&1; then
|
|
replacePlainPasswords "$cfg_file"
|
|
fi
|
|
|
|
local old_kopia="/docker/configs/security/restic/kopia/loc_${idx}.config"
|
|
local new_kopia
|
|
new_kopia=$(backupLocationKopiaConfig "$idx")
|
|
if [[ -f "$old_kopia" ]]; then
|
|
runFileOp mv "$old_kopia" "$new_kopia"
|
|
runFileOp chown "$owner":"$owner" "$new_kopia"
|
|
runFileOp chmod 0600 "$new_kopia"
|
|
isNotice "Moved kopia state for location $idx → $new_kopia"
|
|
fi
|
|
|
|
local old_ssh="/docker/configs/security/restic/ssh/loc_${idx}.key"
|
|
local new_ssh
|
|
new_ssh=$(backupLocationSshKey "$idx")
|
|
if [[ -f "$old_ssh" ]]; then
|
|
runFileOp mv "$old_ssh" "$new_ssh"
|
|
runFileOp chown "$owner":"$owner" "$new_ssh"
|
|
runFileOp chmod 0600 "$new_ssh"
|
|
isNotice "Moved SSH key for location $idx → $new_ssh"
|
|
fi
|
|
|
|
isSuccessful "Location $idx migrated"
|
|
done
|
|
|
|
runFileOp mv "$old_file" "${old_file}.migrated"
|
|
isSuccessful "Migration complete — old file archived as ${old_file}.migrated"
|
|
|
|
# Re-source the new per-location configs so CFG vars reflect new state.
|
|
sourceBackupLocations
|
|
}
|