megaproxy
fe4e69b9ad
Phase 3 — Investments: - Multi-currency support: holdings track purchase currency, FX rates convert to base for totals - Capital gains report using UK Section 104 pool method, grouped by tax year - Capital Gains tab added to Reports page Phase 5 — Polish & Hardening: - Mobile-responsive layout: bottom nav, sidebar hidden on mobile, logo in TopBar, compact header buttons, hover-only actions now always visible on touch - Backup system: encrypted GPG backups via backup.sh, nightly scheduler job, admin API (list/trigger/download/restore), Settings UI with drag-to-restore confirmation - Docker entrypoint with gosu privilege drop to fix bind-mount ownership on fresh deployments - OWASP fixes: refresh token now bound to its session (new refresh_token_hash column + migration), CSRF secure flag tied to environment, IP-level rate limiting on login, TOTPEnableRequest Pydantic schema replaces raw dict - AES-256-GCM key rotation script (rotate_keys.py) with dry-run mode and atomic DB transaction - CLAUDE.md added for AI-assisted development context - README updated: correct reverse proxy port, accurate backup/restore commands, key rotation instructions Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
51 lines
1.6 KiB
Bash
Executable file
51 lines
1.6 KiB
Bash
Executable file
#!/bin/bash
|
|
# backup.sh — pg_dump | gzip | gpg encrypt → /backups/
|
|
# Run inside the backend container:
|
|
# docker compose exec backend bash /app/scripts/backup.sh
|
|
# Or from host:
|
|
# docker compose exec -e BACKUP_PASSPHRASE="$BACKUP_PASSPHRASE" backend bash scripts/backup.sh
|
|
set -euo pipefail
|
|
|
|
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
|
BACKUP_DIR="${BACKUP_DIR:-/app/backups}"
|
|
BACKUP_FILE="${BACKUP_DIR}/${TIMESTAMP}.sql.gz.gpg"
|
|
RETENTION_DAYS="${BACKUP_RETENTION_DAYS:-30}"
|
|
|
|
# Require passphrase
|
|
if [ -z "${BACKUP_PASSPHRASE:-}" ]; then
|
|
echo "[backup] ERROR: BACKUP_PASSPHRASE is not set" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "${BACKUP_DIR}"
|
|
echo "[backup] Starting at ${TIMESTAMP}"
|
|
|
|
# GPG needs a writable home dir; appuser has no real home
|
|
export GNUPGHOME=/tmp/.gnupg
|
|
mkdir -p "${GNUPGHOME}"
|
|
chmod 700 "${GNUPGHOME}"
|
|
|
|
# pg_dump using the DATABASE_URL but swap asyncpg driver for psycopg2-compatible URL
|
|
PG_URL="${DATABASE_URL/postgresql+asyncpg/postgresql}"
|
|
|
|
pg_dump --clean --if-exists "${PG_URL}" \
|
|
| gzip \
|
|
| gpg --batch --yes --no-symkey-cache --pinentry-mode loopback \
|
|
--symmetric --cipher-algo AES256 \
|
|
--passphrase "${BACKUP_PASSPHRASE}" \
|
|
--output "${BACKUP_FILE}"
|
|
|
|
SIZE=$(du -sh "${BACKUP_FILE}" | cut -f1)
|
|
echo "[backup] Written ${SIZE} → ${BACKUP_FILE}"
|
|
|
|
# List current backups
|
|
COUNT=$(find "${BACKUP_DIR}" -name "*.sql.gz.gpg" | wc -l)
|
|
echo "[backup] ${COUNT} backup(s) on disk"
|
|
|
|
# Prune old backups
|
|
PRUNED=$(find "${BACKUP_DIR}" -name "*.sql.gz.gpg" -mtime "+${RETENTION_DAYS}" -print -delete | wc -l)
|
|
if [ "${PRUNED}" -gt 0 ]; then
|
|
echo "[backup] Pruned ${PRUNED} backup(s) older than ${RETENTION_DAYS} days"
|
|
fi
|
|
|
|
echo "[backup] Done"
|