46 lines
1.9 KiB
Shell
46 lines
1.9 KiB
Shell
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
umask 077
|
|
|
|
action=${1:-}
|
|
backup_root=/var/backups/guanghu/jd-control-plane
|
|
audit_dir=/var/lib/guanghu/recovery-audit
|
|
install -d -o root -g root -m 0700 "$audit_dir"
|
|
|
|
latest=$(find "$backup_root" -maxdepth 1 -type f -name 'control-plane-*.tgz' -print 2>/dev/null | sort | tail -n 1)
|
|
[[ -n "$latest" && -f "${latest%.tgz}.sha256" ]] || { echo "verified backup unavailable" >&2; exit 70; }
|
|
(cd "$backup_root" && sha256sum -c "$(basename "${latest%.tgz}.sha256")" >/dev/null)
|
|
|
|
stamp=$(date -u +%Y%m%dT%H%M%SZ)
|
|
case "$action" in
|
|
restore-authz)
|
|
tar -xzf "$latest" -C / opt/guanghu/lake-lamp-authz etc/systemd/system/lake-lamp-authz.service etc/systemd/system/lake-lamp-action-broker.service
|
|
systemctl daemon-reload
|
|
systemctl restart lake-lamp-action-broker.service lake-lamp-authz.service
|
|
;;
|
|
install-owner-access)
|
|
tar -xzf "$latest" -C / opt/guanghu/lake-lamp-authz/owner-access-broker.js opt/guanghu/lake-lamp-authz/action-client.js etc/systemd/system/lake-lamp-owner-access.service
|
|
systemctl daemon-reload
|
|
systemctl enable --now lake-lamp-owner-access.service
|
|
systemctl restart lake-lamp-authz.service
|
|
;;
|
|
restore-navigation-map)
|
|
tar -xzf "$latest" -C / etc/guanghu/navigation-maps
|
|
systemctl restart lake-lamp-authz.service
|
|
;;
|
|
rollback-last-deploy)
|
|
receipt=$(find /var/backups/guanghu/jd-enterprise-repair -maxdepth 1 -type f -name 'jd-authz-*.tgz' -print 2>/dev/null | sort | tail -n 1)
|
|
[[ -n "$receipt" ]] || { echo "rollback backup unavailable" >&2; exit 71; }
|
|
tar -xzf "$receipt" -C /
|
|
systemctl daemon-reload
|
|
systemctl restart lake-lamp-action-broker.service lake-lamp-authz.service
|
|
;;
|
|
*)
|
|
echo "recovery action denied" >&2
|
|
exit 126
|
|
;;
|
|
esac
|
|
|
|
printf '{"schema":"guanghu.recovery-audit/v1","at":"%s","action":"%s","source":"%s","result":"ok"}\n' \
|
|
"$stamp" "$action" "${SSH_CONNECTION%% *}" >> "$audit_dir/events.jsonl"
|
|
echo "RECOVERY_ACTION_OK=$action"
|