AkurAI-Build

public
Latest change e9497c4d8313c394e907ae962fdfe3bb5025013e - Add mail-server backup, audit, and update operations by Ólafur Búi Ólafsson
set -euo pipefail
retention="$1"
[[ "$retention" =~ ^[0-9]+$ ]] && [ "$retention" -ge 2 ] && [ "$retention" -le 365 ]

sudo systemctl is-enabled --quiet akurai-mail-backup.timer
sudo systemctl is-active --quiet akurai-mail-backup.timer
sudo systemctl show akurai-mail-backup.service -p Result --value | grep -qx success

[ "$(sudo stat -c %a /etc/akurai-mail-backup/gnupg)" = 700 ]
[ "$(sudo stat -c %U:%G /etc/akurai-mail-backup/gnupg)" = root:root ]
# The archives must be unreadable on the host that produced them.
if sudo gpg --batch --homedir /etc/akurai-mail-backup/gnupg --with-colons --list-secret-keys 2>/dev/null |
  grep -q '^sec:'; then
  echo 'the mail server holds a backup secret key' >&2
  exit 1
fi

latest="$(sudo find /var/backups/akurai-mail -maxdepth 1 -type f -name 'akurai-mail-*.tar.gz.gpg' \
  -printf '%T@ %p\n' | sort -nr | head -1 | cut -d' ' -f2-)"
[ -n "$latest" ] && sudo test -s "$latest"
[ "$(sudo stat -c %a "$latest")" = 600 ]
[ "$(sudo stat -c %U:%G "$latest")" = root:root ]
[ "$(sudo od -An -N2 -tx1 "$latest" | tr -d ' \n')" != 1f8b ]
sudo test -s "$latest.sha256"
(cd /var/backups/akurai-mail && sudo sha256sum -c --quiet "$(basename "$latest").sha256")

age="$(( $(date -u +%s) - $(sudo stat -c %Y "$latest") ))"
[ "$age" -lt 172800 ]
count="$(sudo find /var/backups/akurai-mail -maxdepth 1 -type f -name 'akurai-mail-*.tar.gz.gpg' | wc -l)"
[ "$count" -le 3 ]
mtime="$(sudo stat -c %y "$latest" | cut -d. -f1)Z"
printf 'timer=active latest=%s age_secs=%s local_copies=%s encryption=gpg secret_key=absent\n' \
  "$mtime" "$age" "$count"