adam/forgejo
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/forgejo.git synced 2026-09-30 05:23:11 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(terraform): scope plan object reads and restore on the data volume

Browse source 
The plan role only needs object reads for the verification zip. Unpacking a dump in /tmp fills the root volume.
This commit is contained in:
Adam Moussa 2026-09-29 19:35:07 -04:00
parent 8eb19b4e55
commit 30f4b54052
No known key found for this signature in database
2 changed files with 21 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
terraform/hcp_iam.tf
View file

@ -605,22 +605,29 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
"s3:GetBucketWebsite",
"s3:GetEncryptionConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:GetObjectAttributes",
"s3:GetObjectLegalHold",
"s3:GetObjectRetention",
"s3:GetObjectTagging",
"s3:GetReplicationConfiguration",
"s3:ListBucket",
]
resources = [
"arn:aws:s3:::${local.backup_bucket_name}",
"arn:aws:s3:::${local.backup_bucket_name}/*",
"arn:aws:s3:::${local.replica_bucket_name}",
"arn:aws:s3:::${local.replica_bucket_name}/*",
"arn:aws:s3:::${local.artifacts_bucket_name}",
"arn:aws:s3:::${local.artifacts_bucket_name}/*",
]
}
# aws_s3_object refresh calls HeadObject and object metadata reads. Scope
# them to the verification package. Backup and replica objects stay unread.
statement {
sid = "RefreshLambdaPackage"
effect = "Allow"
actions = [
"s3:GetObject",
"s3:GetObjectAcl",
"s3:GetObjectAttributes",
"s3:GetObjectTagging",
]
resources = [
"arn:aws:s3:::${local.artifacts_bucket_name}/functions/forgejo-backup-verification.zip",
]
}

8
terraform/user_data.sh
View file

@ -111,9 +111,11 @@ if [ ! -f /var/lib/forgejo/data/forgejo.db ]; then
LATEST="$(aws s3 ls "s3://${BACKUP_BUCKET}/${S3_PREFIX}/" --region "${AWS_REGION}" | awk '{print $2}' | sort | tail -1 | tr -d '/')"
if [ -n "$LATEST" ]; then
FILE="$(aws s3 ls "s3://${BACKUP_BUCKET}/${S3_PREFIX}/${LATEST}/" --region "${AWS_REGION}" | awk '{print $4}' | tail -1)"
RESTORE_DIR="$(mktemp -d)"
aws s3 cp "s3://${BACKUP_BUCKET}/${S3_PREFIX}/${LATEST}/${FILE}" "$RESTORE_DIR/dump.tar.gz" --region "${AWS_REGION}"
tar xzf "$RESTORE_DIR/dump.tar.gz" -C "$RESTORE_DIR"
# The root volume is 20 GB. A dump expands well past that, so unpack on the data volume.
RESTORE_DIR=/var/lib/forgejo/.restore
rm -rf "$RESTORE_DIR"
mkdir -p "$RESTORE_DIR"
aws s3 cp "s3://${BACKUP_BUCKET}/${S3_PREFIX}/${LATEST}/${FILE}" - --region "${AWS_REGION}" --no-progress | tar -xz -C "$RESTORE_DIR"
mkdir -p /var/lib/forgejo/data /var/lib/forgejo/custom
if [ -d "$RESTORE_DIR/data" ]; then
cp -a "$RESTORE_DIR"/data/. /var/lib/forgejo/data/