diff --git a/playbooks/db.yml b/playbooks/db.yml index 4d3a0b1..01aece5 100755 --- a/playbooks/db.yml +++ b/playbooks/db.yml @@ -6,6 +6,7 @@ roles: - role: backup vars: + backup_script: s3pgdump backup_s3backup_list_extra: - /var/lib/postgresql become: yes diff --git a/roles/backup/templates/s3pgdump.sh b/roles/backup/templates/s3pgdump.sh new file mode 100644 index 0000000..31f3c44 --- /dev/null +++ b/roles/backup/templates/s3pgdump.sh @@ -0,0 +1,47 @@ +#! /bin/bash +# +# s3pgdump.sh +# General-purpose, Ansible-managed backup script to dump PostgreSQL DBs to +# an S3 bucket +# + +# NOTICE: THIS FILE CONTAINS SECRETS +# This file may contain the following secrets depending on configuration: +# * An AWS access key +# * An AWS session token +# These are NOT things you want arbitrary readers to access! Ansible will +# attempt to ensure this file has 0700 permissions, but that won't stop you +# from changing that yourself +# DO NOT ALLOW THIS FILE TO BE READ BY NON-ROOT USERS + +# NOTICE: DO NOT MODIFY THIS FILE +# Any changes made will be clobbered by Ansible +# Please make any configuration changes in the main repo + +set -e + +# AWS S3 configuration +# NOTE: THIS IS SECRET INFORMATION +export AWS_ACCESS_KEY_ID="{{ backup_s3_aws_access_key_id }}" +export AWS_SECRET_ACCESS_KEY="{{ backup_s3_aws_secret_access_key }}" + +# Populate a list of databases +declare -a DATABASES +while read line; do + DATABASES+=("$line") +done < <(sudo -u postgres psql -t -A -c "SELECT datname FROM pg_database where datname not in ('template0', 'template1', 'postgres');" 2>/dev/null) + +# pgdump all DBs, compress them, and pipe straight up to S3 +echo "Commencing backup on the following databases:" +for dir in "${DATABASES[@]}"; do + echo "- $dir" +done +echo "Will upload resultant backups to {{ backup_s3_bucket }}" +for db in "${DATABASES[@]}"; do + echo "Backing up $db" + sudo -u postgres pg_dump "$db" \ + | gzip -v9 \ + | aws s3 cp - \ + "s3://{{ backup_s3_bucket }}/{{ inventory_hostname_short }}/$db-$(date "+{{ backup_dateformat }}").pgsql.gz" +done +