Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed the backup-unset-public-key-encryption command. #336

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fixed the backup-unset-public-key-encryption command. #336

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -646,6 +646,10 @@ Datastore backups are supported via AWS S3 and S3 compatible services like [mini

You may skip the `backup-auth` step if your dokku install is running within EC2 and has access to the bucket via an IAM profile. In that case, use the `--use-iam` option with the `backup` command.

If both passphrase and public key forms of encryption are set, the public key encryption will take precedence.

The underlying core backup script is present [here](https://github.com/dokku/docker-s3backup/blob/main/backup.sh).

Backups can be performed using the backup commands:

### set up authentication for backups on the postgres service
Expand Down Expand Up @@ -728,8 +732,12 @@ Set the GPG-compatible passphrase for encrypting backups for backups:
dokku postgres:backup-set-encryption lollipop
```

Public key encryption will take precendence over the passphrase encryption if both types are set.

### set GPG Public Key encryption for all future backups of postgres service

This method currently requires the <public-key-id> to be present on the "keyserver.ubuntu.com" keyserver.

```shell
# usage
dokku postgres:backup-set-public-key-encryption <service> <public-key-id>
Expand All @@ -741,6 +749,8 @@ Set the `GPG` Public Key for encrypting backups:
dokku postgres:backup-set-public-key-encryption lollipop
```

This will take precendence over the passphrase encryption.

### unset encryption for future backups of the postgres service

```shell
Expand Down
12 changes: 6 additions & 6 deletions common-functions
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -433,7 +433,7 @@ service_backup_set_encryption() {
local SERVICE_ROOT="${PLUGIN_DATA_ROOT}/${SERVICE}"
local SERVICE_BACKUP_ENCRYPTION_ROOT="${SERVICE_ROOT}/backup-encryption/"

mkdir "$SERVICE_BACKUP_ENCRYPTION_ROOT"
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added '-p' flag to prevent this command from failing if the encryption directory already exists. This will occur after an encryption type was set and then removed.

mkdir -p "$SERVICE_BACKUP_ENCRYPTION_ROOT"
echo "$ENCRYPTION_KEY" >"${SERVICE_BACKUP_ENCRYPTION_ROOT}/ENCRYPTION_KEY"
}

Expand All @@ -443,7 +443,7 @@ service_backup_set_public_key_encryption() {
local SERVICE_ROOT="${PLUGIN_DATA_ROOT}/${SERVICE}"
local SERVICE_BACKUP_ENCRYPTION_ROOT="${SERVICE_ROOT}/backup-encryption/"

mkdir "$SERVICE_BACKUP_ENCRYPTION_ROOT"
mkdir -p "$SERVICE_BACKUP_ENCRYPTION_ROOT"
echo "$ENCRYPT_WITH_PUBLIC_KEY_ID" >"${SERVICE_BACKUP_ENCRYPTION_ROOT}/ENCRYPT_WITH_PUBLIC_KEY_ID"
}

Expand All @@ -461,16 +461,16 @@ service_backup_unset_encryption() {
local SERVICE_ROOT="${PLUGIN_DATA_ROOT}/${SERVICE}"
local SERVICE_BACKUP_ENCRYPTION_ROOT="${SERVICE_ROOT}/backup-encryption/"

rm -rf "$SERVICE_BACKUP_ENCRYPTION_ROOT"
rm "$SERVICE_BACKUP_ENCRYPTION_ROOT/ENCRYPTION_KEY"
}

service_backup_unset_encryption() {
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was a duplicate of the above function prior to this change.

declare desc="remove backup encryption"
service_backup_unset_public_key_encryption() {
declare desc="remove backup GPG Public Key encryption"
declare SERVICE="$1"
local SERVICE_ROOT="${PLUGIN_DATA_ROOT}/${SERVICE}"
local SERVICE_BACKUP_ENCRYPTION_ROOT="${SERVICE_ROOT}/backup-encryption/"

rm -rf "$SERVICE_BACKUP_ENCRYPTION_ROOT"
rm "$SERVICE_BACKUP_ENCRYPTION_ROOT/ENCRYPT_WITH_PUBLIC_KEY_ID"
}

service_container_rm() {
Expand Down
6 changes: 3 additions & 3 deletions subcommands/backup-unset-public-key-encryption
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,11 @@ service-backup-unset-public-key-encryption-cmd() {
local cmd="$PLUGIN_COMMAND_PREFIX:backup-unset-public-key-encryption" argv=("$@")
[[ ${argv[0]} == "$cmd" ]] && shift 1
declare SERVICE="$1"
is_implemented_command "$cmd" || dokku_log_fail "Not yet implemented" # TODO: [22.03.2024 by Mykola]
is_implemented_command "$cmd" || dokku_log_fail "Not yet implemented"
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cleaned up todos


[[ -z "$SERVICE" ]] && dokku_log_fail "Please specify a valid name for the service"
verify_service_name "$SERVICE"
service_backup_unset_public_key_encryption "$SERVICE" # TODO: [22.03.2024 by Mykola]
service_backup_unset_public_key_encryption "$SERVICE"
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This wasn't pointing to an actual function and would blow up at this point prior to the above change in common-functions.

}

service-backup-unset-encryption-cmd "$@"
service-backup-unset-public-key-encryption-cmd "$@"