gtiandClaude Sonnet 5
d884d41db5
backup.sh now also streams the fiscal-hub container's release binaries (dist tarball, never in Postgres) into BACKUP_DIR alongside the pg_dump, with the same 14-backup retention; restore_releases.sh is the companion restore. Verified with a real restore smoke test in production: the restored dump's agent_releases row and the restored tarball's exe both match the published sha256 exactly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
50 lines
2.6 KiB
Python
50 lines
2.6 KiB
Python
"""The Hub backup/restore scripts must actually run on the Linux host.
|
|
|
|
Both failures below were found by running the scripts on the production VM,
|
|
not by reading them.
|
|
"""
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).parents[1]
|
|
HUB = ROOT / "deploy" / "hub"
|
|
|
|
|
|
def test_shell_scripts_are_forced_to_lf():
|
|
# With core.autocrlf=true on the Windows release machine, `git archive`
|
|
# shipped CRLF and `sh` failed on the first line ("set: Illegal option -").
|
|
rules = [line.split() for line in (ROOT / ".gitattributes").read_text(encoding="utf-8").splitlines() if line.strip() and not line.startswith("#")]
|
|
assert ["*.sh", "text", "eol=lf"] in rules
|
|
assert ["*.service", "text", "eol=lf"] in rules
|
|
for script in [*HUB.glob("*.sh"), *HUB.glob("*.service")]:
|
|
assert b"\r" not in script.read_bytes(), script.name
|
|
|
|
|
|
def test_hub_port_restriction_uses_docker_user_chain():
|
|
# Docker-published ports bypass UFW/INPUT; only DOCKER-USER filters them.
|
|
# --ctdir ORIGINAL keeps the container's replies out of the DROP rule.
|
|
script = (HUB / "restrict_hub_port.sh").read_text(encoding="utf-8")
|
|
assert "DOCKER-USER" in script and "--ctdir ORIGINAL" in script and "--ctorigdstport" in script
|
|
unit = (HUB / "gti-fiscal-hub-port.service").read_text(encoding="utf-8")
|
|
assert "After=docker.service" in unit and "PartOf=docker.service" in unit
|
|
|
|
|
|
def test_backup_retention_does_not_delete_on_the_host():
|
|
# The Postgres dump is written by pg_dump INSIDE the postgres container
|
|
# into the bind-mounted (root-owned) backup dir, so only that container
|
|
# can rm it. The release-storage tarball is different: backup.sh writes
|
|
# it itself via host-side shell redirection (`> "$DIR/..."`), so it's
|
|
# host-owned and a host-side rm is correct there, not a bug.
|
|
lines = [line.strip() for line in (HUB / "backup.sh").read_text(encoding="utf-8").splitlines() if not line.strip().startswith("#")]
|
|
retention = [line for line in lines if "rm -f" in line]
|
|
assert len(retention) == 2
|
|
assert retention[0].startswith("$COMPOSE exec -T postgres") and "gti_fiscal_*.dump" in retention[0]
|
|
assert retention[1].startswith("find \"$DIR\"") and "gti_fiscal_releases_*.tgz" in retention[1]
|
|
|
|
|
|
def test_backup_also_covers_release_storage():
|
|
# Part H: PostgreSQL alone isn't enough — every published Agent package
|
|
# binary lives only on the release-storage volume (never in Postgres).
|
|
script = (HUB / "backup.sh").read_text(encoding="utf-8")
|
|
assert "fiscal-hub" in script and "/app/data" in script and "releases" in script
|
|
assert "gti_fiscal_releases_" in script
|