megaproxy
fe4e69b9ad
Phase 3 — Investments: - Multi-currency support: holdings track purchase currency, FX rates convert to base for totals - Capital gains report using UK Section 104 pool method, grouped by tax year - Capital Gains tab added to Reports page Phase 5 — Polish & Hardening: - Mobile-responsive layout: bottom nav, sidebar hidden on mobile, logo in TopBar, compact header buttons, hover-only actions now always visible on touch - Backup system: encrypted GPG backups via backup.sh, nightly scheduler job, admin API (list/trigger/download/restore), Settings UI with drag-to-restore confirmation - Docker entrypoint with gosu privilege drop to fix bind-mount ownership on fresh deployments - OWASP fixes: refresh token now bound to its session (new refresh_token_hash column + migration), CSRF secure flag tied to environment, IP-level rate limiting on login, TOTPEnableRequest Pydantic schema replaces raw dict - AES-256-GCM key rotation script (rotate_keys.py) with dry-run mode and atomic DB transaction - CLAUDE.md added for AI-assisted development context - README updated: correct reverse proxy port, accurate backup/restore commands, key rotation instructions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
56 lines
1.4 KiB
Bash
Executable file
56 lines
1.4 KiB
Bash
Executable file
#!/bin/bash
|
|
# restore.sh — decrypt and restore a backup
|
|
# Usage:
|
|
# docker compose exec backend bash scripts/restore.sh <backup_file>
|
|
# docker compose exec backend bash scripts/restore.sh --list
|
|
set -euo pipefail
|
|
|
|
BACKUP_DIR="${BACKUP_DIR:-/app/backups}"
|
|
|
|
if [ "${1:-}" = "--list" ]; then
|
|
echo "[restore] Available backups in ${BACKUP_DIR}:"
|
|
find "${BACKUP_DIR}" -name "*.sql.gz.gpg" -printf " %f (%s bytes)\n" | sort -r
|
|
exit 0
|
|
fi
|
|
|
|
if [ -z "${1:-}" ]; then
|
|
echo "Usage: restore.sh <backup_file.sql.gz.gpg>"
|
|
echo " restore.sh --list"
|
|
exit 1
|
|
fi
|
|
|
|
BACKUP_FILE="$1"
|
|
|
|
# Accept bare filename or full path
|
|
if [ ! -f "${BACKUP_FILE}" ] && [ -f "${BACKUP_DIR}/${BACKUP_FILE}" ]; then
|
|
BACKUP_FILE="${BACKUP_DIR}/${BACKUP_FILE}"
|
|
fi
|
|
|
|
if [ ! -f "${BACKUP_FILE}" ]; then
|
|
echo "[restore] ERROR: File not found: ${BACKUP_FILE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ -z "${BACKUP_PASSPHRASE:-}" ]; then
|
|
echo "[restore] ERROR: BACKUP_PASSPHRASE is not set" >&2
|
|
exit 1
|
|
fi
|
|
|
|
PG_URL="${DATABASE_URL/postgresql+asyncpg/postgresql}"
|
|
|
|
echo "[restore] WARNING: This will overwrite the current database."
|
|
echo "[restore] File: ${BACKUP_FILE}"
|
|
read -r -p "[restore] Type 'yes' to continue: " CONFIRM
|
|
if [ "${CONFIRM}" != "yes" ]; then
|
|
echo "[restore] Aborted"
|
|
exit 1
|
|
fi
|
|
|
|
echo "[restore] Decrypting and restoring…"
|
|
gpg --batch --yes --decrypt \
|
|
--passphrase "${BACKUP_PASSPHRASE}" \
|
|
"${BACKUP_FILE}" \
|
|
| gunzip \
|
|
| psql "${PG_URL}"
|
|
|
|
echo "[restore] Done"
|