From 50a79236952e5fc96be074742aa77bc0ccda65e2 Mon Sep 17 00:00:00 2001 From: Mykola Solodukha Date: Sun, 28 Apr 2024 18:19:39 +0300 Subject: [PATCH 1/3] :sparkles: Implement GPG Public Key encryption support First introduced in https://github.com/dokku/docker-s3backup/pull/81. --- README.md | 28 +++++++++++++++++++ bin/generate | 2 ++ common-functions | 23 +++++++++++++++ subcommands/backup-set-public-key-encryption | 25 +++++++++++++++++ .../backup-unset-public-key-encryption | 23 +++++++++++++++ 5 files changed, 101 insertions(+) create mode 100755 subcommands/backup-set-public-key-encryption create mode 100755 subcommands/backup-unset-public-key-encryption diff --git a/README.md b/README.md index 679d9e3..67d73e0 100644 --- a/README.md +++ b/README.md @@ -24,8 +24,10 @@ postgres:backup-deauth # remove backup authenticatio postgres:backup-schedule [--use-iam] # schedule a backup of the postgres service postgres:backup-schedule-cat # cat the contents of the configured backup cronfile for the service postgres:backup-set-encryption # set encryption for all future backups of postgres service +postgres:backup-set-public-key-encryption # set GPG Public Key encryption for all future backups of postgres service postgres:backup-unschedule # unschedule the backup of the postgres service postgres:backup-unset-encryption # unset encryption for future backups of the postgres service +postgres:backup-unset-public-key-encryption # unset GPG Public Key encryption for future backups of the postgres service postgres:clone [--clone-flags...] # create container then copy data from into postgres:connect # connect to the service via the postgres connection tool postgres:create [--create-flags...] # create a postgres service @@ -718,6 +720,19 @@ Set the GPG-compatible passphrase for encrypting backups for backups: dokku postgres:backup-set-encryption lollipop ``` +### set GPG Public Key encryption for all future backups of postgres service + +```shell +# usage +dokku postgres:backup-set-public-key-encryption +``` + +Set the `GPG` Public Key for encrypting backups: + +```shell +dokku postgres:backup-set-public-key-encryption lollipop +``` + ### unset encryption for future backups of the postgres service ```shell @@ -731,6 +746,19 @@ Unset the `GPG` encryption passphrase for backups: dokku postgres:backup-unset-encryption lollipop ``` +### unset GPG Public Key encryption for future backups of the postgres service + +```shell +# usage +dokku postgres:backup-unset-public-key-encryption +``` + +Unset the `GPG` Public Key encryption for backups: + +```shell +dokku postgres:backup-unset-public-key-encryption lollipop +``` + ### schedule a backup of the postgres service ```shell diff --git a/bin/generate b/bin/generate index f4f14e7..2ebd4b2 100755 --- a/bin/generate +++ b/bin/generate @@ -290,7 +290,9 @@ def usage_backup( "backup-deauth", "backup", "backup-set-encryption", + "backup-set-public-key-encryption", "backup-unset-encryption", + "backup-unset-public-key-encryption", "backup-schedule", "backup-schedule-cat", "backup-unschedule", diff --git a/common-functions b/common-functions index c0ba352..5c41089 100755 --- a/common-functions +++ b/common-functions @@ -308,6 +308,10 @@ service_backup() { BACKUP_PARAMETERS="$BACKUP_PARAMETERS -e ENCRYPTION_KEY=$(cat "$BACKUP_ENCRYPTION_CONFIG_ROOT/ENCRYPTION_KEY")" fi + if [[ -f "$BACKUP_ENCRYPTION_CONFIG_ROOT/ENCRYPT_WITH_PUBLIC_KEY_ID" ]]; then + BACKUP_PARAMETERS="$BACKUP_PARAMETERS -e ENCRYPT_WITH_PUBLIC_KEY_ID=$(cat "$BACKUP_ENCRYPTION_CONFIG_ROOT/ENCRYPT_WITH_PUBLIC_KEY_ID")" + fi + # shellcheck disable=SC2086 "$DOCKER_BIN" container run --rm $BACKUP_PARAMETERS "$PLUGIN_S3BACKUP_IMAGE" } @@ -433,6 +437,16 @@ service_backup_set_encryption() { echo "$ENCRYPTION_KEY" >"${SERVICE_BACKUP_ENCRYPTION_ROOT}/ENCRYPTION_KEY" } +service_backup_set_public_key_encryption() { + declare desc="set up backup GPG Public Key encryption" + declare SERVICE="$1" ENCRYPT_WITH_PUBLIC_KEY_ID="$2" + local SERVICE_ROOT="${PLUGIN_DATA_ROOT}/${SERVICE}" + local SERVICE_BACKUP_ENCRYPTION_ROOT="${SERVICE_ROOT}/backup-encryption/" + + mkdir "$SERVICE_BACKUP_ENCRYPTION_ROOT" + echo "$ENCRYPT_WITH_PUBLIC_KEY_ID" >"${SERVICE_BACKUP_ENCRYPTION_ROOT}/ENCRYPT_WITH_PUBLIC_KEY_ID" +} + service_backup_unschedule() { declare desc="unschedule the backup of the service" declare SERVICE="$1" @@ -450,6 +464,15 @@ service_backup_unset_encryption() { rm -rf "$SERVICE_BACKUP_ENCRYPTION_ROOT" } +service_backup_unset_encryption() { + declare desc="remove backup encryption" + declare SERVICE="$1" + local SERVICE_ROOT="${PLUGIN_DATA_ROOT}/${SERVICE}" + local SERVICE_BACKUP_ENCRYPTION_ROOT="${SERVICE_ROOT}/backup-encryption/" + + rm -rf "$SERVICE_BACKUP_ENCRYPTION_ROOT" +} + service_container_rm() { declare desc="stop a service and remove the running container" declare SERVICE="$1" diff --git a/subcommands/backup-set-public-key-encryption b/subcommands/backup-set-public-key-encryption new file mode 100755 index 0000000..38bcaa7 --- /dev/null +++ b/subcommands/backup-set-public-key-encryption @@ -0,0 +1,25 @@ +#!/usr/bin/env bash +source "$(dirname "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)")/config" +set -eo pipefail +[[ $DOKKU_TRACE ]] && set -x +source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions" +source "$(dirname "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)")/functions" + +service-backup-set-public-key-encryption-cmd() { + #E set the GPG Public Key for encrypting backups + #E dokku $PLUGIN_COMMAND_PREFIX:backup-set-public-key-encryption lollipop + #A service, service to run command against + #A public-key-id, a GPG Public Key ID (or fingerprint) to use for encryption. Must be uploaded to the GPG keyserver beforehand. + declare desc="set GPG Public Key encryption for all future backups of $PLUGIN_SERVICE service" + local cmd="$PLUGIN_COMMAND_PREFIX:backup-set-public-key-encryption" argv=("$@") + [[ ${argv[0]} == "$cmd" ]] && shift 1 + declare SERVICE="$1" PUBLIC_KEY_ID="$2" + is_implemented_command "$cmd" || dokku_log_fail "Not yet implemented" + + [[ -z "$SERVICE" ]] && dokku_log_fail "Please specify a valid name for the service" + [[ -z "$PUBLIC_KEY_ID" ]] && dokku_log_fail "Please specify a valid GPG Public Key ID (or fingerprint)" + verify_service_name "$SERVICE" + service_backup_set_public_key_encryption "$SERVICE" "$PUBLIC_KEY_ID" +} + +service-backup-set-encryption-cmd "$@" diff --git a/subcommands/backup-unset-public-key-encryption b/subcommands/backup-unset-public-key-encryption new file mode 100755 index 0000000..8e0352f --- /dev/null +++ b/subcommands/backup-unset-public-key-encryption @@ -0,0 +1,23 @@ +#!/usr/bin/env bash +source "$(dirname "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)")/config" +set -eo pipefail +[[ $DOKKU_TRACE ]] && set -x +source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions" +source "$(dirname "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)")/functions" + +service-backup-unset-public-key-encryption-cmd() { + #E unset the GPG Public Key encryption for backups + #E dokku $PLUGIN_COMMAND_PREFIX:backup-unset-public-key-encryption lollipop + #A service, service to run command against + declare desc="unset GPG Public Key encryption for future backups of the $PLUGIN_SERVICE service" + local cmd="$PLUGIN_COMMAND_PREFIX:backup-unset-public-key-encryption" argv=("$@") + [[ ${argv[0]} == "$cmd" ]] && shift 1 + declare SERVICE="$1" + is_implemented_command "$cmd" || dokku_log_fail "Not yet implemented" # TODO: [22.03.2024 by Mykola] + + [[ -z "$SERVICE" ]] && dokku_log_fail "Please specify a valid name for the service" + verify_service_name "$SERVICE" + service_backup_unset_public_key_encryption "$SERVICE" # TODO: [22.03.2024 by Mykola] +} + +service-backup-unset-encryption-cmd "$@" From 1077c49a1565b2ae0638213a5144c14c119ce12a Mon Sep 17 00:00:00 2001 From: Mykola Solodukha Date: Sun, 28 Apr 2024 18:19:39 +0300 Subject: [PATCH 2/3] :ambulance: Correct the function name --- subcommands/backup-set-public-key-encryption | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/subcommands/backup-set-public-key-encryption b/subcommands/backup-set-public-key-encryption index 38bcaa7..d058bb2 100755 --- a/subcommands/backup-set-public-key-encryption +++ b/subcommands/backup-set-public-key-encryption @@ -22,4 +22,4 @@ service-backup-set-public-key-encryption-cmd() { service_backup_set_public_key_encryption "$SERVICE" "$PUBLIC_KEY_ID" } -service-backup-set-encryption-cmd "$@" +service-backup-set-public-key-encryption-cmd "$@" From 5171614175b89b2de15da4d4e9e0ec1022ebd6e9 Mon Sep 17 00:00:00 2001 From: Mykola Solodukha Date: Mon, 10 Jun 2024 01:32:01 +0300 Subject: [PATCH 3/3] :ambulance: Use the correct version of `dokku/s3backup` image --- config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config b/config index 2743176..cefebb1 100644 --- a/config +++ b/config @@ -30,7 +30,7 @@ fi export PLUGIN_BUSYBOX_IMAGE="busybox:1.34.1-uclibc" export PLUGIN_AMBASSADOR_IMAGE="dokku/ambassador:0.5.0" -export PLUGIN_S3BACKUP_IMAGE="dokku/s3backup:0.14.0" +export PLUGIN_S3BACKUP_IMAGE="dokku/s3backup:0.16.0" export PLUGIN_WAIT_IMAGE="dokku/wait:0.6.0" export POSTGRES_CONFIG_OPTIONS=${POSTGRES_CONFIG_OPTIONS:=""}