feat: 部署准备

2026-10-19 17:48:57 +08:00
parent d30cf25890
commit 48c45ada89
7 changed files with 387 additions and 5 deletions
@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+# 只在官方镜像首次初始化空数据卷时执行。psql 引用变量，密码不进入 SQL 字面拼接或输出。
+: "${DOODLE_MIGRATOR_PASSWORD:?缺少迁移账号密码}"
+: "${DOODLE_APP_PASSWORD:?缺少应用账号密码}"
+psql --username "$POSTGRES_USER" --dbname postgres --set ON_ERROR_STOP=1 <<'SQL'
+\getenv migration_password DOODLE_MIGRATOR_PASSWORD
+\getenv application_password DOODLE_APP_PASSWORD
+CREATE ROLE doodle_migrator LOGIN PASSWORD :'migration_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
+CREATE ROLE doodle_app LOGIN PASSWORD :'application_password' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION;
+CREATE DATABASE doodle_prod OWNER doodle_migrator ENCODING 'UTF8' LC_COLLATE 'C' LC_CTYPE 'C' TEMPLATE template0;
+REVOKE ALL ON DATABASE doodle_prod FROM PUBLIC;
+GRANT CONNECT ON DATABASE doodle_prod TO doodle_migrator, doodle_app;
+\connect doodle_prod
+REVOKE ALL ON SCHEMA public FROM PUBLIC;
+GRANT USAGE ON SCHEMA public TO doodle_app;
+-- 迁移由 doodle_migrator 执行：后续创建的表自动赋予应用 DML 权限，不授予建表或删表权限。
+ALTER DEFAULT PRIVILEGES FOR ROLE doodle_migrator IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO doodle_app;
+ALTER DEFAULT PRIVILEGES FOR ROLE doodle_migrator IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO doodle_app;
+REVOKE ALL ON DATABASE postgres FROM PUBLIC;
+SQL
@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+umask 077
+
+# 使用容器本地 socket 备份，无须在命令行或日志中传密码；只生成新文件，不自动清理旧备份。
+deploy_dir=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+backup_dir="$deploy_dir/backups"
+mkdir -p "$backup_dir"
+backup_file="$backup_dir/doodle_prod_$(date -u +%Y%m%dT%H%M%SZ).dump"
+if [ -e "$backup_file" ] || [ -e "$backup_file.partial" ]; then
+    echo '备份文件已存在，请稍后重试' >&2
+    exit 1
+fi
+trap 'rm -f "$backup_file.partial"' EXIT HUP INT TERM
+docker compose --env-file "$deploy_dir/.env" -f "$deploy_dir/compose.database.yaml" \
+    exec -T postgres pg_dump -U postgres -d doodle_prod -Fc > "$backup_file.partial"
+# 从容器内部校验归档目录，确保可被 pg_restore 识别后才发布完整文件名。
+docker compose --env-file "$deploy_dir/.env" -f "$deploy_dir/compose.database.yaml" \
+    exec -T postgres pg_restore --list < "$backup_file.partial" > /dev/null
+mv "$backup_file.partial" "$backup_file"
+trap - EXIT HUP INT TERM
+printf '%s\n' "$backup_file"