adam/forgejo
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/forgejo.git synced 2026-10-04 12:31:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Compare commits

base: adam:dd23f08878946a4c81f65d15ad55df8ee272871b
Branches Tags
adam:main
adam:chore/enqueue-as-seahaven-bot
..
compare: adam:30f4b54052d3bfc9ac15f4c0cffb761ce6fc2a5f
Branches Tags
adam:main
adam:chore/enqueue-as-seahaven-bot

No commits in common. "dd23f08878946a4c81f65d15ad55df8ee272871b" and "30f4b54052d3bfc9ac15f4c0cffb761ce6fc2a5f" have entirely different histories.
dd23f08878 ... 30f4b54052

3 changed files with 20 additions and 93 deletions
Show stats Expand all files Collapse all files

94
README.md
View file

@ -107,101 +107,37 @@ sudo /usr/local/bin/forgejo-backup.sh
For backups older than 30 days (Glacier), restore the object first:
```bash
aws s3api restore-object --bucket forgejo-backups-011934824531 \
aws s3api restore-object --bucket forgejo-backups-328440206208 \
--key "archive/<date>/forgejo-<date>.tar.gz" \
--restore-request '{"Days":7,"GlacierJobParameters":{"Tier":"Standard"}}'
# Wait ~3-5 hours for restore to complete, then:
```
Download and restore. The copy does not start until the dump contains a database, so a failed download leaves the live data alone.
Download and restore:
```bash
set -euo pipefail
rm -rf /var/lib/forgejo/.restore && mkdir -p /var/lib/forgejo/.restore
aws s3 cp s3://forgejo-backups-011934824531/archive/<date>/forgejo-<date>.tar.gz - --no-progress \
| tar -xz -C /var/lib/forgejo/.restore
if [ ! -s /var/lib/forgejo/.restore/gitea-db.sqlite3 ] && [ ! -s /var/lib/forgejo/.restore/data/forgejo.db ]; then
echo "Dump has no database" >&2
exit 1
fi
aws s3 cp s3://forgejo-backups-328440206208/archive/<date>/forgejo-<date>.tar.gz /tmp/
systemctl stop forgejo
if [ -d /var/lib/forgejo/.restore/data ]; then
cp -a /var/lib/forgejo/.restore/data/. /var/lib/forgejo/data/
fi
mkdir -p /tmp/forgejo-restore && tar -xzf /tmp/forgejo-<date>.tar.gz -C /tmp/forgejo-restore
cd /tmp/forgejo-restore
cp app.ini /etc/forgejo/app.ini
cp gitea-db.sqlite3 /var/lib/forgejo/data/forgejo.db
rm -rf /var/lib/forgejo/data/repositories
mkdir -p /var/lib/forgejo/data/repositories
if [ -d /var/lib/forgejo/.restore/repos ]; then
cp -a /var/lib/forgejo/.restore/repos/. /var/lib/forgejo/data/repositories/
fi
if [ -f /var/lib/forgejo/.restore/gitea-db.sqlite3 ]; then
cp /var/lib/forgejo/.restore/gitea-db.sqlite3 /var/lib/forgejo/data/forgejo.db
fi
if [ -d /var/lib/forgejo/.restore/lfs ]; then
mkdir -p /var/lib/forgejo/data/lfs
cp -a /var/lib/forgejo/.restore/lfs/. /var/lib/forgejo/data/lfs/
fi
if [ -d /var/lib/forgejo/.restore/custom ]; then
cp -a /var/lib/forgejo/.restore/custom/. /var/lib/forgejo/custom/
fi
if [ ! -s /var/lib/forgejo/data/forgejo.db ]; then
echo "Restore did not produce /var/lib/forgejo/data/forgejo.db" >&2
exit 1
fi
if [ -f /var/lib/forgejo/.restore/app.ini ]; then
cp /var/lib/forgejo/.restore/app.ini /etc/forgejo/app.ini
chown root:forgejo /etc/forgejo/app.ini
chmod 660 /etc/forgejo/app.ini
fi
chown -R forgejo:forgejo /var/lib/forgejo
cp -a repos /var/lib/forgejo/data/repositories
cp -a data/. /var/lib/forgejo/data/
[ -d lfs ] && cp -a lfs/. /var/lib/forgejo/data/lfs/
[ -d custom ] && cp -a custom/. /var/lib/forgejo/custom/
chown -R forgejo:forgejo /var/lib/forgejo /etc/forgejo/app.ini
systemctl start forgejo
rm -rf /var/lib/forgejo/.restore
rm -rf /tmp/forgejo-restore /tmp/forgejo-<date>.tar.gz
```
### Restore from GCS (disaster recovery)
This path does not read S3. It unpacks the offsite object on the data volume and uses the same copy order as the S3 restore.
```bash
set -euo pipefail
gcloud config set project sea-haven-backups
rm -rf /var/lib/forgejo/.restore && mkdir -p /var/lib/forgejo/.restore
gsutil cp gs://forgejo-backups-offsite-seahaven/archive/<date>/forgejo-<date>.tar.gz - \
| tar -xz -C /var/lib/forgejo/.restore
if [ ! -s /var/lib/forgejo/.restore/gitea-db.sqlite3 ] && [ ! -s /var/lib/forgejo/.restore/data/forgejo.db ]; then
echo "Dump has no database" >&2
exit 1
fi
systemctl stop forgejo
if [ -d /var/lib/forgejo/.restore/data ]; then
cp -a /var/lib/forgejo/.restore/data/. /var/lib/forgejo/data/
fi
rm -rf /var/lib/forgejo/data/repositories
mkdir -p /var/lib/forgejo/data/repositories
if [ -d /var/lib/forgejo/.restore/repos ]; then
cp -a /var/lib/forgejo/.restore/repos/. /var/lib/forgejo/data/repositories/
fi
if [ -f /var/lib/forgejo/.restore/gitea-db.sqlite3 ]; then
cp /var/lib/forgejo/.restore/gitea-db.sqlite3 /var/lib/forgejo/data/forgejo.db
fi
if [ -d /var/lib/forgejo/.restore/lfs ]; then
mkdir -p /var/lib/forgejo/data/lfs
cp -a /var/lib/forgejo/.restore/lfs/. /var/lib/forgejo/data/lfs/
fi
if [ -d /var/lib/forgejo/.restore/custom ]; then
cp -a /var/lib/forgejo/.restore/custom/. /var/lib/forgejo/custom/
fi
if [ ! -s /var/lib/forgejo/data/forgejo.db ]; then
echo "Restore did not produce /var/lib/forgejo/data/forgejo.db" >&2
exit 1
fi
if [ -f /var/lib/forgejo/.restore/app.ini ]; then
cp /var/lib/forgejo/.restore/app.ini /etc/forgejo/app.ini
chown root:forgejo /etc/forgejo/app.ini
chmod 660 /etc/forgejo/app.ini
fi
chown -R forgejo:forgejo /var/lib/forgejo
systemctl start forgejo
rm -rf /var/lib/forgejo/.restore
gsutil cp gs://forgejo-backups-offsite-seahaven/archive/<date>/forgejo-<date>.tar.gz /tmp/
# Then follow the same restore steps as S3 above
```
## Autodiscovery

7
terraform/hcp_iam.tf
View file

@ -13,10 +13,9 @@
# 4. Point TFC_AWS_* at hcptf-forgejo / hcptf-forgejo-plan.
# 5. Re-run the script without --allow-workspace.
# 6. Second Manual apply creates the instance, buckets, ALB, and Lambda.
# Later edits to hcptf-* inline policies and to policy/tf-managed/forgejo-services
# need the org-account role. The scoped role cannot PutRolePolicy or
# CreatePolicyVersion. Do not add StringLike on bootstrap trust.
# CreatePolicy stays on hcptf-bootstrap.
# Later edits to these hcptf-* inline policies need the same window.
# DenySelfMutation blocks PutRolePolicy on hcptf-* from the scoped role.
# Do not add StringLike on bootstrap trust. CreatePolicy stays on hcptf-bootstrap.
data "aws_iam_policy_document" "hcptf_apply_trust" {
statement {

12
terraform/user_data.sh
View file

@ -125,10 +125,8 @@ if [ ! -f /var/lib/forgejo/data/forgejo.db ]; then
if [ -d "$RESTORE_DIR/repos" ]; then
cp -a "$RESTORE_DIR"/repos/. /var/lib/forgejo/data/repositories/
fi
# Older dumps keep sqlite at the archive root. Current dumps already have data/forgejo.db.
if [ -f "$RESTORE_DIR/gitea-db.sqlite3" ]; then
cp "$RESTORE_DIR/gitea-db.sqlite3" /var/lib/forgejo/data/forgejo.db
fi
# Dump sqlite lives at the archive root, not under data/. Copy it last.
cp "$RESTORE_DIR/gitea-db.sqlite3" /var/lib/forgejo/data/forgejo.db
if [ -d "$RESTORE_DIR/lfs" ]; then
mkdir -p /var/lib/forgejo/data/lfs
cp -a "$RESTORE_DIR"/lfs/. /var/lib/forgejo/data/lfs/
@ -136,12 +134,6 @@ if [ ! -f /var/lib/forgejo/data/forgejo.db ]; then
if [ -d "$RESTORE_DIR/custom" ]; then
cp -a "$RESTORE_DIR"/custom/. /var/lib/forgejo/custom/
fi
# The dump's app.ini carries INTERNAL_TOKEN, JWT_SECRET, and LFS_JWT_SECRET.
if [ -f "$RESTORE_DIR/app.ini" ]; then
cp "$RESTORE_DIR/app.ini" /etc/forgejo/app.ini
chown root:forgejo /etc/forgejo/app.ini
chmod 660 /etc/forgejo/app.ini
fi
chown -R forgejo:forgejo /var/lib/forgejo
rm -rf "$RESTORE_DIR"
if [ ! -s /var/lib/forgejo/data/forgejo.db ]; then