Skip to content

Commit 815df9b

Browse files
kosheetakosheeta
committed
init
0 parents  commit 815df9b

File tree

4 files changed

+221
-0
lines changed

4 files changed

+221
-0
lines changed

‎Dockerfile

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM alpine:latest
2+
3+
RUN apk update \
4+
&& apk add coreutils \
5+
&& apk add postgresql-client \
6+
&& apk add python3 py3-pip && pip3 install --upgrade pip && pip3 install awscli \
7+
&& apk add openssl \
8+
&& rm -rf /var/cache/apk/*
9+
10+
COPY entrypoint.sh /entrypoint.sh
11+
12+
CMD ["sh", "/entrypoint.sh"]

‎LICENSE

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2023 Nikita Koshelenko
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# postgres2s3
2+
💾 Backup all PostgreSQL databases to S3 Storage
3+
4+
## Usage
5+
```bash
6+
$ docker run \
7+
-e POSTGRES_HOST=localhost
8+
-e POSTGRES_USER=postgres
9+
-e POSTGRES_PASSWORD=postgrespw
10+
-e S3_ENDPOINT=http://localhost:9000
11+
-e S3_ACCESS_KEY=accessKey
12+
-e S3_SECRET_KEY=secretKey
13+
-e S3_BUCKET=backups
14+
-e ENCRYPTION_PASSWORD=supersecretpassword
15+
--rm
16+
nikitakoschelenko/postgres2s3
17+
```
18+
19+
## Environment variables
20+
#### `POSTGRES_HOST`*
21+
Host of the PostgreSQL database.
22+
23+
#### `POSTGRES_PORT`*
24+
Port of the PostgreSQL database. Default to `5432`.
25+
26+
#### `POSTGRES_USER`*
27+
Username of the PostgreSQL user.
28+
29+
#### `POSTGRES_PASSWORD`*
30+
Password of the PostgreSQL user.
31+
32+
#### `S3_ENDPOINT`*
33+
Endpoint URL of the S3.
34+
35+
#### `S3_ACCESS_KEY`*
36+
Access key of the S3.
37+
38+
#### `S3_SECRET_KEY`*
39+
Secret key of the S3.
40+
41+
#### `S3_BUCKET`*
42+
Name of the bucket for saving backups to S3.
43+
44+
#### `S3_FILE_PREFIX`
45+
Prefix for the backup file name for saving to S3. Default to `backup-`.
46+
47+
#### `ENCRYPTION_PASSWORD`
48+
Password for encryption.
49+
50+
#### `PG_DUMPALL_EXTRA_ARGS`
51+
Extra options for `pg_dumpall` command.
52+
53+
#### `OPENSSL_ENC_EXTRA_ARGS`
54+
Extra options for `openssl enc` command.
55+
56+
#### `AWS_S3_CP_EXTRA_ARGS`
57+
Extra options for `aws s3 cp` command.
58+
59+
## Decryption
60+
```bash
61+
openssl enc -d -aes-256-cbc -pbkdf2 -iter 20000 -in backup.bak.gz.enc -out backup.bak.gz
62+
```
63+
64+
## Kubernetes
65+
To use with Kubernetes, you need to create a CronJob:
66+
```yaml
67+
apiVersion: batch/v1
68+
kind: CronJob
69+
metadata:
70+
name: postgresql-backup
71+
namespace: shared
72+
spec:
73+
schedule: 0 */8 * * *
74+
jobTemplate:
75+
spec:
76+
template:
77+
spec:
78+
containers:
79+
- name: postgresql-backup
80+
image: nikitakoschelenko/postgres2s3:15.1
81+
env:
82+
- name: POSTGRES_HOST
83+
value: postgresql.shared
84+
- name: POSTGRES_USER
85+
valueFrom:
86+
secretKeyRef:
87+
name: postgresql-backup-secret
88+
key: POSTGRES_USER
89+
- name: POSTGRES_PASSWORD
90+
valueFrom:
91+
secretKeyRef:
92+
name: postgresql-backup-secret
93+
key: POSTGRES_PASSWORD
94+
- name: S3_ENDPOINT
95+
value: http://minio.shared:9000/
96+
- name: S3_ACCESS_KEY
97+
valueFrom:
98+
secretKeyRef:
99+
name: postgresql-backup-secret
100+
key: S3_ACCESS_KEY
101+
- name: S3_SECRET_KEY
102+
valueFrom:
103+
secretKeyRef:
104+
name: postgresql-backup-secret
105+
key: S3_SECRET_KEY
106+
- name: S3_BUCKET
107+
value: backups
108+
- name: S3_PREFIX
109+
value: postresql/backup-
110+
- name: ENCRYPTION_PASSWORD
111+
valueFrom:
112+
secretKeyRef:
113+
name: postgresql-backup-secret
114+
key: ENCRYPTION_PASSWORD
115+
restartPolicy: OnFailure
116+
```

‎entrypoint.sh

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
#! /bin/sh
2+
3+
if [[ -z "$POSTGRES_HOST" ]]; then
4+
echo "POSTGRES_HOST environment variable is required"
5+
exit 1
6+
fi
7+
8+
POSTGRES_PORT="${POSTGRES_PORT:-5432}"
9+
10+
if [[ -z "$POSTGRES_USER" ]]; then
11+
echo "POSTGRES_USER environment variable is required"
12+
exit 1
13+
fi
14+
15+
if [[ -z "$POSTGRES_PASSWORD" ]]; then
16+
echo "POSTGRES_PASSWORD environment variable is required"
17+
exit 1
18+
fi
19+
20+
if [[ -z "$S3_ENDPOINT" ]]; then
21+
echo "S3_ENDPOINT environment variable is required"
22+
exit 1
23+
fi
24+
25+
if [[ -z "$S3_ACCESS_KEY" ]]; then
26+
echo "S3_ACCESS_KEY environment variable is required"
27+
exit 1
28+
fi
29+
30+
if [[ -z "$S3_SECRET_KEY" ]]; then
31+
echo "S3_SECRET_KEY environment variable is required"
32+
exit 1
33+
fi
34+
35+
if [[ -z "$S3_BUCKET" ]]; then
36+
echo "S3_BUCKET environment variable is required"
37+
exit 1
38+
fi
39+
40+
S3_FILE_PREFIX="${S3_FILE_PREFIX:-backup-}"
41+
42+
pg_dumpall -V
43+
echo "Creating a dump of all databases..."
44+
45+
SOURCE_FILE="output.bak.gz"
46+
DESTINATION_FILE="${S3_FILE_PREFIX}$(date +"%Y-%m-%dT%H:%M:%SZ").bak.gz"
47+
48+
export PGPASSWORD=$POSTGRES_PASSWORD
49+
pg_dumpall -h $POSTGRES_HOST -p $POSTGRES_PORT -U $POSTGRES_USER $PG_DUMPALL_EXTRA_ARGS | gzip > $SOURCE_FILE
50+
51+
echo "Dump created"
52+
53+
if [[ -z "$ENCRYPTION_PASSWORD" ]]; then
54+
echo "Encryption disabled"
55+
else
56+
echo "Encryption of the dump..."
57+
58+
openssl enc -aes-256-cbc -pbkdf2 -iter 20000 -in $SOURCE_FILE -out ${SOURCE_FILE}.enc -k $ENCRYPTION_PASSWORD $OPENSSL_ENC_EXTRA_ARGS
59+
60+
SOURCE_FILE="${SOURCE_FILE}.enc"
61+
DESTINATION_FILE="${DESTINATION_FILE}.enc"
62+
63+
echo "Dump encrypted"
64+
fi
65+
66+
echo "Uploading the dump to S3..."
67+
68+
export AWS_ACCESS_KEY_ID=$S3_ACCESS_KEY
69+
export AWS_SECRET_ACCESS_KEY=$S3_SECRET_KEY
70+
aws s3 cp $SOURCE_FILE s3://$S3_BUCKET/$DESTINATION_FILE --endpoint-url $S3_ENDPOINT $AWS_S3_CP_EXTRA_ARGS
71+
72+
echo "Dump uploaded"

0 commit comments

Comments
 (0)