adam/Paillasse
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sauvegarde les bases d'OpenStack et teste leur restauration chaque semaine

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Adam Belkacemi 2026-10-12 18:01:50 +02:00
parent 7b0a8583eb
commit b054888f5a
6 changed files with 136 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

19
ansible/roles/sauvegardes/templates/sauvegarde-dedibackup.sh.j2
View file

@ -36,6 +36,25 @@ if [ "$(docker inspect -f '{% raw %}{{.State.Running}}{% endraw %}' {{ sauvegard
> "$WORKDIR/portail.sql"
EN_PLUS+=(-C "$WORKDIR" portail.sql)
fi
# OpenStack (bloc A, 2026-10-12) : export logique des bases de Kolla (Keystone,
# Nova, Neutron, Glance, Heat, Placement, Grafana), sans redémarrage ni
# verrou (--single-transaction). Les comptes MariaDB (base mysql) ne sont pas
# exportés : Kolla les recrée au déploiement. Le mot de passe est lu dans
# passwords.yml et passé par l'entrée standard, jamais en argument.
if [ "$(docker inspect -f '{% raw %}{{.State.Running}}{% endraw %}' {{ sauvegardes_openstack_conteneur }} 2>/dev/null)" = "true" ]; then
kolla_sql() {
printf '[client]\nuser=root\npassword="%s"\nhost=%s\n' \
"$(awk '/^database_password:/{print $2}' {{ sauvegardes_openstack_mots_de_passe }})" "{{ sauvegardes_openstack_hote }}" \
| docker exec -i {{ sauvegardes_openstack_conteneur }} "$@"
}
BASES=$(kolla_sql mariadb --defaults-extra-file=/dev/stdin -N -e \
"SELECT schema_name FROM information_schema.schemata WHERE schema_name NOT IN ('mysql','information_schema','performance_schema','sys')")
# shellcheck disable=SC2086 # une base par mot
kolla_sql mariadb-dump --defaults-extra-file=/dev/stdin --single-transaction \
--routines --triggers --events --databases $BASES > "$WORKDIR/openstack.sql"
EN_PLUS+=(-C "$WORKDIR" openstack.sql)
fi
for chemin in {{ sauvegardes_portail_fichiers | join(' ') }}; do
if [ -e "$chemin" ]; then
EN_PLUS+=("$chemin")

40
ansible/roles/sauvegardes/templates/syllabus-test-restauration.sh.j2
View file

@ -16,9 +16,10 @@ source /root/.dedibackup
CLE="{{ sauvegardes_age_cle }}"
APP="/var/www/portail"
CONTENEUR="syllabus-restauration"
CONTENEUR_OS="syllabus-restauration-openstack"
DOSSIER=$(mktemp -d /var/tmp/restauration-XXXXXX)
nettoyer() {
docker rm -f "$CONTENEUR" >/dev/null 2>&1 || true
docker rm -f "$CONTENEUR" "$CONTENEUR_OS" >/dev/null 2>&1 || true
rm -rf "$DOSSIER"
}
trap nettoyer EXIT
@ -34,8 +35,9 @@ echo "$DERNIERE ($(du -h "$DOSSIER/archive.age" | cut -f1))"
echo "== 2. Déchiffrement et extraction"
mkdir "$DOSSIER/extrait"
age -d -i "$CLE" "$DOSSIER/archive.age" \
| tar -I zstd -xf - -C "$DOSSIER/extrait" portail.sql var/www/portail/.env
| tar -I zstd -xf - -C "$DOSSIER/extrait" portail.sql openstack.sql var/www/portail/.env
[ -s "$DOSSIER/extrait/portail.sql" ] || { echo "portail.sql absent de l'archive"; exit 1; }
[ -s "$DOSSIER/extrait/openstack.sql" ] || { echo "openstack.sql absent de l'archive"; exit 1; }
APP_KEY_RESTAUREE=$(grep -oP '^APP_KEY=\K.*' "$DOSSIER/extrait/var/www/portail/.env")
if [ "$APP_KEY_RESTAUREE" = "$(grep -oP '^APP_KEY=\K.*' "$APP/.env")" ]; then
echo "APP_KEY restaurée identique à la production (valeur non affichée)"
@ -90,6 +92,40 @@ TABLES_MANQUANTES=$(join -v2 "$DOSSIER/copie.txt" "$DOSSIER/production.txt" | wc
[ "$TABLES_MANQUANTES" = "0" ] || { echo "$TABLES_MANQUANTES table(s) de production absente(s) de la copie"; exit 1; }
echo "lab_sessions vues par le portail dans la copie : $(artisan_copie tinker --execute='echo App\Models\LabSession::count();' 2>/dev/null | tail -1)"
echo "== 6. Base OpenStack : restauration dans un conteneur jetable"
docker run -d --name "$CONTENEUR_OS" --network portail_default \
-e MARIADB_ROOT_PASSWORD="$MDP" {{ sauvegardes_image_mariadb_openstack }} >/dev/null
for _ in $(seq 1 60); do
docker exec "$CONTENEUR_OS" sh -c 'MYSQL_PWD="$MARIADB_ROOT_PASSWORD" mariadb -uroot -e "SELECT 1"' >/dev/null 2>&1 && break
sleep 1
done
docker exec -i "$CONTENEUR_OS" sh -c 'MYSQL_PWD="$MARIADB_ROOT_PASSWORD" exec mariadb -uroot' < "$DOSSIER/extrait/openstack.sql"
# Même requête des deux côtés : la copie (root du conteneur jetable) et la
# production (root de Kolla, mot de passe passé par l'entrée standard).
requete_copie() {
docker exec "$CONTENEUR_OS" sh -c 'MYSQL_PWD="$MARIADB_ROOT_PASSWORD" exec mariadb -uroot -N -e "$0"' "$1"
}
requete_production() {
printf '[client]\nuser=root\npassword="%s"\nhost=%s\n' \
"$(awk '/^database_password:/{print $2}' {{ sauvegardes_openstack_mots_de_passe }})" "{{ sauvegardes_openstack_hote }}" \
| docker exec -i {{ sauvegardes_openstack_conteneur }} mariadb --defaults-extra-file=/dev/stdin -N -e "$1"
}
PAR_BASE="SELECT table_schema, COUNT(*) FROM information_schema.tables WHERE table_schema NOT IN ('mysql','information_schema','performance_schema','sys') GROUP BY table_schema ORDER BY 1"
requete_copie "$PAR_BASE" > "$DOSSIER/os-copie.txt"
requete_production "$PAR_BASE" > "$DOSSIER/os-production.txt"
printf "%-14s %8s %8s\n" base tables production
join -a1 -a2 -e absente -o 0,1.2,2.2 "$DOSSIER/os-copie.txt" "$DOSSIER/os-production.txt" | while read -r b c p; do
printf "%-14s %8s %8s\n" "$b" "$c" "$p"
done
cmp -s "$DOSSIER/os-copie.txt" "$DOSSIER/os-production.txt" || { echo "bases ou tables OpenStack différentes"; exit 1; }
for t in {{ sauvegardes_openstack_tables_stables | join(' ') }}; do
c=$(requete_copie "SELECT COUNT(*) FROM $t")
p=$(requete_production "SELECT COUNT(*) FROM $t")
echo "$t : copie $c, production $p"
[ "$c" = "$p" ] || { echo "écart sur $t"; exit 1; }
done
echo "projet paillasse dans la copie : $(requete_copie "SELECT COUNT(*) FROM keystone.project WHERE name='paillasse'")"
DOSSIER_TEXTFILE="{{ sauvegardes_dossier_textfile | default('/var/lib/node_exporter/textfile') }}"
cat > "$DOSSIER_TEXTFILE/restauration.prom.tmp" <<METRIQUE
# HELP syllabus_derniere_restauration_reussie_timestamp Horodatage Unix du dernier test de restauration du portail réussi.