225 lines
9.5 KiB
Bash
Executable File
225 lines
9.5 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
# ================================================================
|
|
# Restore script for mrt0rtikize.ru Matrix instance
|
|
# ================================================================
|
|
# Reads a backup directory created by backup-mrt0rtikize.sh
|
|
# and restores it to the new yandex-prod cluster.
|
|
#
|
|
# Usage: ./restore-mrt0rtikize.sh <backup-dir>
|
|
#
|
|
# Steps:
|
|
# 1. Scale Synapse + MAS to 0 on new cluster
|
|
# 2. Restore PostgreSQL dumps to CNPG shared-pg
|
|
# 3. Apply generated secrets (signing key, MAS keys, macaroon)
|
|
# 4. Apply deployment markers
|
|
# 5. Scale Synapse to 1 (now has signing key + DB)
|
|
# 6. Restore media files
|
|
# 7. Scale MAS to 1
|
|
# ================================================================
|
|
|
|
readonly YC_KUBECONFIG="${KUBECONFIG:-/home/mrt0rtikize/infra/yandex-prod/kubeconfig}"
|
|
readonly K="${KUBECTL:-kubectl} --kubeconfig ${YC_KUBECONFIG}"
|
|
|
|
readonly NS="matrix-mrt0rtikize"
|
|
readonly CNPG_NS="cnpg"
|
|
readonly CNPG_POD="shared-pg-1"
|
|
|
|
# Colors
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m'
|
|
|
|
log() { echo -e "${GREEN}[$(date +%H:%M:%S)]${NC} $*"; }
|
|
warn() { echo -e "${YELLOW}[$(date +%H:%M:%S)] WARN:${NC} $*"; }
|
|
err() { echo -e "${RED}[$(date +%H:%M:%S)] ERROR:${NC} $*"; }
|
|
|
|
# -------------------------------------------------------------------
|
|
# Usage
|
|
# -------------------------------------------------------------------
|
|
if [ $# -ne 1 ]; then
|
|
echo "Usage: $0 <backup-dir>"
|
|
echo ""
|
|
echo "Example: $0 backups/matrix-mrt0rtikize-20260613-192010/"
|
|
exit 1
|
|
fi
|
|
|
|
readonly BACKUP_DIR="$1"
|
|
|
|
if [ ! -d "${BACKUP_DIR}" ]; then
|
|
err "Backup directory not found: ${BACKUP_DIR}"
|
|
exit 1
|
|
fi
|
|
|
|
# Verify critical files exist
|
|
for f in dump-synapse.sql dump-mas.sql secret-generated.yaml markers.yaml synapse-media.tar.gz; do
|
|
if [ ! -f "${BACKUP_DIR}/${f}" ]; then
|
|
warn "Missing: ${f}"
|
|
fi
|
|
done
|
|
|
|
# -------------------------------------------------------------------
|
|
# Prerequisites
|
|
# -------------------------------------------------------------------
|
|
log "=== Checking prerequisites ==="
|
|
|
|
if ! ${K} get ns "${NS}" >/dev/null 2>&1; then
|
|
err "Namespace ${NS} not found on new cluster. Deploy the ESS app first."
|
|
exit 1
|
|
fi
|
|
|
|
if ! ${K} -n "${CNPG_NS}" get pod "${CNPG_POD}" >/dev/null 2>&1; then
|
|
err "CNPG pod ${CNPG_POD} not found. Is the CNPG cluster running?"
|
|
exit 1
|
|
fi
|
|
|
|
log "Cluster access verified."
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 1: Scale Synapse + MAS to 0
|
|
# -------------------------------------------------------------------
|
|
log "=== Step 1: Stopping Synapse + MAS ==="
|
|
|
|
${K} -n "${NS}" scale sts -l "app.kubernetes.io/component=matrix-server" --replicas=0 2>/dev/null || \
|
|
${K} -n "${NS}" scale sts "${NS}-synapse-main" --replicas=0 2>/dev/null || \
|
|
warn "Could not scale Synapse via known names, trying by label..."
|
|
|
|
${K} -n "${NS}" scale deploy -l "app.kubernetes.io/component=matrix-authentication" --replicas=0 2>/dev/null || \
|
|
${K} -n "${NS}" scale deploy "${NS}-matrix-authentication-service" --replicas=0 2>/dev/null || \
|
|
warn "Could not scale MAS via known names..."
|
|
|
|
log "Waiting for Synapse + MAS pods to terminate..."
|
|
${K} -n "${NS}" wait --for=delete pod -l "app.kubernetes.io/component=matrix-server" --timeout=120s 2>/dev/null || warn "Some Synapse pods may still be terminating."
|
|
${K} -n "${NS}" wait --for=delete pod -l "app.kubernetes.io/component=matrix-authentication" --timeout=120s 2>/dev/null || warn "Some MAS pods may still be terminating."
|
|
|
|
log "Synapse + MAS stopped."
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 2: Clean schemas (DROP SCHEMA CASCADE — no connection races)
|
|
# -------------------------------------------------------------------
|
|
log "=== Step 2: Cleaning database schemas ==="
|
|
|
|
log "Reading PG credentials from cluster..."
|
|
SYNAPSE_PW=$(${K} get secret pg-creds -n "${NS}" -o jsonpath='{.data.synapse}' | base64 -d)
|
|
MAS_PW=$(${K} get secret pg-creds -n "${NS}" -o jsonpath='{.data.mas}' | base64 -d)
|
|
|
|
log "Wiping synapse schema..."
|
|
${K} exec -n "${CNPG_NS}" "${CNPG_POD}" -- env PGPASSWORD="${SYNAPSE_PW}" \
|
|
psql -U synapse_mrt0rtikize -d synapse_mrt0rtikize -h localhost -c \
|
|
"DROP SCHEMA public CASCADE; CREATE SCHEMA public; GRANT ALL ON SCHEMA public TO synapse_mrt0rtikize;" 2>/dev/null || true
|
|
|
|
log "Wiping MAS schema..."
|
|
${K} exec -n "${CNPG_NS}" "${CNPG_POD}" -- env PGPASSWORD="${MAS_PW}" \
|
|
psql -U mas_mrt0rtikize -d mas_mrt0rtikize -h localhost -c \
|
|
"DROP SCHEMA public CASCADE; CREATE SCHEMA public; GRANT ALL ON SCHEMA public TO mas_mrt0rtikize;" 2>/dev/null || true
|
|
|
|
log "Schemas cleaned."
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 3: Restore PostgreSQL dumps
|
|
# -------------------------------------------------------------------
|
|
log "=== Step 3: Restoring PostgreSQL dumps ==="
|
|
|
|
log "Restoring Synapse database..."
|
|
${K} exec -i -n "${CNPG_NS}" "${CNPG_POD}" -- env PGPASSWORD="${SYNAPSE_PW}" \
|
|
psql -U synapse_mrt0rtikize -d synapse_mrt0rtikize -h localhost < "${BACKUP_DIR}/dump-synapse.sql"
|
|
log "Synapse database restored."
|
|
|
|
log "Restoring MAS database..."
|
|
${K} exec -i -n "${CNPG_NS}" "${CNPG_POD}" -- env PGPASSWORD="${MAS_PW}" \
|
|
psql -U mas_mrt0rtikize -d mas_mrt0rtikize -h localhost < "${BACKUP_DIR}/dump-mas.sql"
|
|
log "MAS database restored."
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 3: Apply generated secrets (CRITICAL)
|
|
# -------------------------------------------------------------------
|
|
log "=== Step 4: Applying generated secrets ==="
|
|
|
|
if [ -f "${BACKUP_DIR}/secret-generated.yaml" ]; then
|
|
${K} replace --force -f "${BACKUP_DIR}/secret-generated.yaml"
|
|
log "Generated secret replaced: ${NS}-generated (original signing key from backup)"
|
|
else
|
|
err "CRITICAL: secret-generated.yaml not found in backup!"
|
|
err "SYNAPSE_SIGNING_KEY and MAS keys will NOT be restored."
|
|
err "Federation identity is lost without this file."
|
|
fi
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 4: Apply deployment markers
|
|
# -------------------------------------------------------------------
|
|
log "=== Step 5: Applying deployment markers ==="
|
|
|
|
if [ -f "${BACKUP_DIR}/markers.yaml" ]; then
|
|
${K} replace --force -f "${BACKUP_DIR}/markers.yaml"
|
|
log "Deployment markers replaced."
|
|
else
|
|
warn "markers.yaml not found in backup (non-critical)."
|
|
fi
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 5: Scale Synapse to 1
|
|
# -------------------------------------------------------------------
|
|
log "=== Step 6: Starting Synapse ==="
|
|
|
|
${K} -n "${NS}" scale sts -l "app.kubernetes.io/component=matrix-server" --replicas=1 2>/dev/null || \
|
|
${K} -n "${NS}" scale sts "${NS}-synapse-main" --replicas=1 2>/dev/null
|
|
|
|
log "Waiting for Synapse to start..."
|
|
${K} -n "${NS}" wait --for=condition=ready pod -l "app.kubernetes.io/component=matrix-server" --timeout=300s 2>/dev/null || warn "Synapse is not ready yet, check logs."
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 6: Restore media files
|
|
# -------------------------------------------------------------------
|
|
log "=== Step 7: Restoring media files ==="
|
|
|
|
if [ -f "${BACKUP_DIR}/synapse-media.tar.gz" ]; then
|
|
SYNAPSE_POD=$( ${K} -n "${NS}" get pods -l "app.kubernetes.io/component=matrix-server" -o jsonpath='{.items[?(@.status.phase=="Running")].metadata.name}' 2>/dev/null)
|
|
if [ -z "${SYNAPSE_POD}" ]; then
|
|
warn "No running Synapse pod found for media restore. Skip media."
|
|
warn "Re-run this step after Synapse is up:"
|
|
warn " kubectl cp synapse-media.tar.gz ${NS}/<synapse-pod>:/tmp/ && kubectl exec <synapse-pod> -- tar xzf /tmp/synapse-media.tar.gz -C /media/"
|
|
else
|
|
log "Copying media to Synapse pod: ${SYNAPSE_POD}"
|
|
${K} cp "${BACKUP_DIR}/synapse-media.tar.gz" "${NS}/${SYNAPSE_POD}:/tmp/synapse-media.tar.gz"
|
|
${K} exec -n "${NS}" "${SYNAPSE_POD}" -- tar xzf /tmp/synapse-media.tar.gz -C /media/
|
|
${K} exec -n "${NS}" "${SYNAPSE_POD}" -- rm /tmp/synapse-media.tar.gz
|
|
log "Media files restored."
|
|
fi
|
|
else
|
|
warn "synapse-media.tar.gz not found in backup."
|
|
fi
|
|
|
|
# -------------------------------------------------------------------
|
|
# Step 7: Scale MAS to 1
|
|
# -------------------------------------------------------------------
|
|
log "=== Step 8: Starting MAS ==="
|
|
|
|
${K} -n "${NS}" scale deploy -l "app.kubernetes.io/component=matrix-authentication" --replicas=1 2>/dev/null || \
|
|
${K} -n "${NS}" scale deploy "${NS}-matrix-authentication-service" --replicas=1 2>/dev/null
|
|
|
|
log "Waiting for MAS to start..."
|
|
${K} -n "${NS}" wait --for=condition=ready pod -l "app.kubernetes.io/component=matrix-authentication" --timeout=120s 2>/dev/null || warn "MAS is not ready yet, check logs."
|
|
|
|
# -------------------------------------------------------------------
|
|
# Summary
|
|
# -------------------------------------------------------------------
|
|
cat <<SUMMARY
|
|
|
|
${GREEN}========================================${NC}
|
|
${GREEN} Restore Complete: ${NS}${NC}
|
|
${GREEN}========================================${NC}
|
|
|
|
${YELLOW}Verification steps:${NC}
|
|
1. Check Synapse logs:
|
|
${K} logs -n ${NS} -l "app.kubernetes.io/component=matrix-server" --tail=30
|
|
2. Check Synapse has correct signing key:
|
|
${K} exec -n ${NS} deploy/${NS}-synapse-main -- ls /secrets/${NS}-generated/SYNAPSE_SIGNING_KEY
|
|
3. Test login at: https://chat.mrt0rtikize.ru
|
|
4. Federation tester: https://federationtester.matrix.org/?server_name=mrt0rtikize.ru
|
|
5. Check certificates:
|
|
${K} get certificates -n ${NS}
|
|
|
|
SUMMARY
|