mirror of
https://github.com/Sea-Haven-Industries/forgejo.git
synced 2026-09-30 21:13:14 +00:00
d57aea19f3
Implements a fully compliant 3-2-1 backup architecture: - Copy 1 (live): Harden existing EBS snapshots to 30-day retention - Copy 2 (near-site): S3 cross-region replication to us-west-2 with Object Lock (governance 90d) and versioning - Copy 3 (offsite): GCS bucket in dedicated seahaven-backups GCP project with 2-year irreversible retention lock Also adds a verification Lambda that checks all 3 locations daily and runs monthly restore tests with SQLite integrity checks.
94 lines
2.9 KiB
TypeScript
94 lines
2.9 KiB
TypeScript
import * as cdk from "aws-cdk-lib";
|
|
import * as events from "aws-cdk-lib/aws-events";
|
|
import * as events_targets from "aws-cdk-lib/aws-events-targets";
|
|
import * as iam from "aws-cdk-lib/aws-iam";
|
|
import * as lambda from "aws-cdk-lib/aws-lambda";
|
|
import * as logs from "aws-cdk-lib/aws-logs";
|
|
import * as s3 from "aws-cdk-lib/aws-s3";
|
|
import { PythonFunction } from "@aws-cdk/aws-lambda-python-alpha";
|
|
import { Construct } from "constructs";
|
|
|
|
interface BackupVerificationProps {
|
|
sourceBucket: s3.IBucket;
|
|
replicaBucketName: string;
|
|
gcsBucket: string;
|
|
gcsSaSecretName: string;
|
|
slackWebhookSecretName: string;
|
|
}
|
|
|
|
export class BackupVerification extends Construct {
|
|
constructor(scope: Construct, id: string, props: BackupVerificationProps) {
|
|
super(scope, id);
|
|
|
|
const fn = new PythonFunction(this, "Function", {
|
|
functionName: "forgejo-backup-verification",
|
|
entry: "lambda/backup-verification",
|
|
runtime: lambda.Runtime.PYTHON_3_12,
|
|
architecture: lambda.Architecture.ARM_64,
|
|
handler: "handler",
|
|
index: "app.py",
|
|
memorySize: 512,
|
|
timeout: cdk.Duration.minutes(5),
|
|
environment: {
|
|
SOURCE_BUCKET: props.sourceBucket.bucketName,
|
|
REPLICA_BUCKET: props.replicaBucketName,
|
|
GCS_BUCKET: props.gcsBucket,
|
|
GCS_SA_SECRET_ARN: props.gcsSaSecretName,
|
|
SLACK_WEBHOOK_SECRET_ARN: props.slackWebhookSecretName,
|
|
},
|
|
logRetention: logs.RetentionDays.TWO_MONTHS,
|
|
});
|
|
|
|
props.sourceBucket.grantRead(fn);
|
|
|
|
fn.addToRolePolicy(
|
|
new iam.PolicyStatement({
|
|
actions: ["s3:ListBucket", "s3:GetObject"],
|
|
resources: [
|
|
`arn:aws:s3:::${props.replicaBucketName}`,
|
|
`arn:aws:s3:::${props.replicaBucketName}/*`,
|
|
],
|
|
})
|
|
);
|
|
|
|
const account = cdk.Stack.of(this).account;
|
|
const region = cdk.Stack.of(this).region;
|
|
|
|
fn.addToRolePolicy(
|
|
new iam.PolicyStatement({
|
|
actions: ["secretsmanager:GetSecretValue"],
|
|
resources: [
|
|
`arn:aws:secretsmanager:${region}:${account}:secret:${props.gcsSaSecretName}-*`,
|
|
`arn:aws:secretsmanager:${region}:${account}:secret:${props.slackWebhookSecretName}-*`,
|
|
],
|
|
})
|
|
);
|
|
|
|
fn.addToRolePolicy(
|
|
new iam.PolicyStatement({
|
|
actions: ["ec2:DescribeSnapshots"],
|
|
resources: ["*"],
|
|
})
|
|
);
|
|
|
|
new events.Rule(this, "DailyCheck", {
|
|
ruleName: "forgejo-backup-daily-check",
|
|
schedule: events.Schedule.cron({ hour: "8", minute: "0" }),
|
|
targets: [new events_targets.LambdaFunction(fn)],
|
|
});
|
|
|
|
new events.Rule(this, "MonthlyRestoreTest", {
|
|
ruleName: "forgejo-backup-monthly-restore-test",
|
|
schedule: events.Schedule.cron({
|
|
hour: "9",
|
|
minute: "0",
|
|
day: "1",
|
|
}),
|
|
targets: [
|
|
new events_targets.LambdaFunction(fn, {
|
|
event: events.RuleTargetInput.fromObject({ mode: "restore-test" }),
|
|
}),
|
|
],
|
|
});
|
|
}
|
|
}
|