bollwerkadmin/bollwerk
1
0
Fork 0
Code Issues 9 Pull requests Projects Releases Packages Wiki Activity Actions

fix: busybox crond statt dcron, pg17-Tokens aus Checksum filtern (#87)

Browse source 
- Dockerfile: dcron -> busybox crond (kein setpgid-Fehler im Container)
  Crontab in /var/spool/cron/crontabs/root
- backup.sh: grep-Filter fuer PostgreSQL 17 Security-Tokens
  (\restrict / \unrestrict) die sich bei jedem Dump aendern
This commit is contained in:
Jens Reinemann 2026-05-17 11:14:47 +02:00
parent d66f0d65c3
commit db2fc5dea1
2 changed files with 13 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
backup/Dockerfile
View file

@ -1,14 +1,17 @@
FROM alpine:3.21 FROM alpine:3.21
# Install PostgreSQL client and dcron (lightweight cron daemon) # Install PostgreSQL client (busybox crond is included with Alpine)
RUN apk add --no-cache postgresql-client dcron RUN apk add --no-cache postgresql-client
COPY backup.sh /usr/local/bin/backup.sh COPY backup.sh /usr/local/bin/backup.sh
RUN chmod +x /usr/local/bin/backup.sh RUN chmod +x /usr/local/bin/backup.sh
# Crontab: run backup daily at 03:00 UTC # Crontab: run backup daily at 03:00 UTC
RUN echo "0 3 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1" \ # busybox crond reads from /var/spool/cron/crontabs/<user>
> /etc/crontabs/root RUN mkdir -p /var/spool/cron/crontabs \
&& echo "0 3 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1" \
> /var/spool/cron/crontabs/root \
&& chmod 600 /var/spool/cron/crontabs/root
# crond -f: run in foreground; -l 2: log level notice # busybox crond: -f = foreground, -d 8 = log level debug
CMD ["crond", "-f", "-l", "2"] CMD ["crond", "-f", "-d", "8"]

6
backup/backup.sh
View file

@ -20,8 +20,10 @@ TEMP_DUMP=$(mktemp)
export PGPASSWORD="${POSTGRES_PASSWORD:-}" export PGPASSWORD="${POSTGRES_PASSWORD:-}"
pg_dump -h "$DB_HOST" -U "$DB_USER" "$DB_NAME" > "$TEMP_DUMP" pg_dump -h "$DB_HOST" -U "$DB_USER" "$DB_NAME" > "$TEMP_DUMP"
# Compute MD5 of dump content to detect changes # Compute MD5 of dump content, excluding lines that change every run:
CURRENT_CHECKSUM=$(md5sum "$TEMP_DUMP" | cut -d' ' -f1) # - pg_dump comment lines (timestamps, version info)
# - PostgreSQL 17 security tokens (\restrict / \unrestrict with random token)
CURRENT_CHECKSUM=$(grep -Ev '^(--|\\restrict|\\unrestrict)' "$TEMP_DUMP" | md5sum | cut -d' ' -f1)
LAST_CHECKSUM="" LAST_CHECKSUM=""
if [ -f "$CHECKSUM_FILE" ]; then if [ -f "$CHECKSUM_FILE" ]; then
LAST_CHECKSUM=$(cat "$CHECKSUM_FILE") LAST_CHECKSUM=$(cat "$CHECKSUM_FILE")