AkurAI-Build

Latest change b2fb6810b8844f39a9752f65118c05ffecf28160 - Fold AkurAI EC2 operations into Build CLI by Ólafur Búi Ólafsson

set -euo pipefail
retention="$1"
sudo install -d -o bunfork -g bunfork -m 0700 /var/backups/bunfork
sudo install -d -o root -g root -m 0755 /usr/local/libexec
sudo tee /usr/local/libexec/bunfork-backup >/dev/null <<'SCRIPT'
#!/usr/bin/env bash
set -euo pipefail
umask 0077
retention="${BUNFORK_BACKUP_RETENTION:-14}"
[[ "$retention" =~ ^[0-9]+$ ]] && [ "$retention" -ge 2 ] && [ "$retention" -le 365 ]
directory=/var/backups/bunfork
stamp="$(date -u +%Y%m%dT%H%M%S)-$(date +%N)"
destination="$directory/bunfork-$stamp.db"
/opt/bunfork/current/bunfork \
  --database /var/lib/bunfork/bunfork.db \
  --key-file /etc/bunfork/db.key \
  backup --out "$destination"
mapfile -t backups < <(find "$directory" -maxdepth 1 -type f -name 'bunfork-*.db' -printf '%f\n' | LC_ALL=C sort)
excess=$((${#backups[@]} - retention))
if [ "$excess" -gt 0 ]; then
  for ((index = 0; index < excess; index++)); do
    rm -- "$directory/${backups[$index]}"
  done
fi
SCRIPT
sudo chown root:root /usr/local/libexec/bunfork-backup
sudo chmod 0755 /usr/local/libexec/bunfork-backup
sudo tee /etc/systemd/system/bunfork-backup.service >/dev/null <<UNIT
[Unit]
Description=Create a verified encrypted Bunfork database backup
After=bunfork.service
Requires=bunfork.service

[Service]
Type=oneshot
User=bunfork
Group=bunfork
Environment=BUNFORK_BACKUP_RETENTION=$retention
ExecStart=/usr/local/libexec/bunfork-backup
UMask=0077
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadOnlyPaths=/opt/bunfork /etc/bunfork
ReadWritePaths=/var/backups/bunfork /var/lib/bunfork
CapabilityBoundingSet=
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictSUIDSGID=true
RestrictAddressFamilies=AF_UNIX

[Install]
WantedBy=multi-user.target
UNIT
sudo tee /etc/systemd/system/bunfork-backup.timer >/dev/null <<'UNIT'
[Unit]
Description=Daily encrypted Bunfork database backup

[Timer]
OnCalendar=*-*-* 03:15:00 UTC
RandomizedDelaySec=15m
Persistent=true
Unit=bunfork-backup.service

[Install]
WantedBy=timers.target
UNIT
sudo systemctl daemon-reload
sudo systemctl enable --now bunfork-backup.timer
sudo systemctl start bunfork-backup.service