rune/scripts/gitea-backup.sh

#!/usr/bin/env bash
set -euo pipefail

BACKUP_MOUNT=${BACKUP_MOUNT:-/media/pi/Foundry}
BACKUP_DIR=${BACKUP_DIR:-$BACKUP_MOUNT/backups/gitea}
RETENTION_DAYS=${RETENTION_DAYS:-30}
LOCK_FILE=${LOCK_FILE:-/run/lock/rune-gitea-backup.lock}
WORK_ROOT=${WORK_ROOT:-/var/lib/gitea}
BACKUP_OWNER=${BACKUP_OWNER-pi:pi}
GITEA_RUN_USER=${GITEA_RUN_USER-git}
GITEA_BIN=${GITEA_BIN:-/usr/local/bin/gitea}
GITEA_CONFIG=${GITEA_CONFIG:-/etc/gitea/app.ini}
GITEA_WORK_PATH=${GITEA_WORK_PATH:-/var/lib/gitea}
SYSTEMCTL_BIN=${SYSTEMCTL_BIN:-systemctl}
CURL_BIN=${CURL_BIN:-curl}
SHA256SUM_BIN=${SHA256SUM_BIN:-sha256sum}
REALPATH_BIN=${REALPATH_BIN:-realpath}
MOUNTPOINT_BIN=${MOUNTPOINT_BIN:-mountpoint}
FINDMNT_BIN=${FINDMNT_BIN:-findmnt}
STAMP=$(date -u +%Y%m%dT%H%M%SZ)
ARCHIVE="gitea-dump-${STAMP}.tar.gz"

die() { printf 'Gitea backup failed: %s\n' "$*" >&2; exit 1; }

# Check both lexical containment and symlink-aware containment before touching
# the destination. The configured mount itself must be mounted on a device
# distinct from / so an absent off-disk volume can never become a local folder.
mount_lex=$("$REALPATH_BIN" -m -s -- "$BACKUP_MOUNT") || die "cannot normalize BACKUP_MOUNT"
backup_lex=$("$REALPATH_BIN" -m -s -- "$BACKUP_DIR") || die "cannot normalize BACKUP_DIR"
mount_real=$("$REALPATH_BIN" -m -- "$BACKUP_MOUNT") || die "cannot resolve BACKUP_MOUNT"
backup_real=$("$REALPATH_BIN" -m -- "$BACKUP_DIR") || die "cannot resolve BACKUP_DIR"
case "$backup_lex" in "$mount_lex"|"$mount_lex"/*) ;; *) die "BACKUP_DIR is outside BACKUP_MOUNT" ;; esac
case "$backup_real" in "$mount_real"|"$mount_real"/*) ;; *) die "BACKUP_DIR resolves outside BACKUP_MOUNT" ;; esac
"$MOUNTPOINT_BIN" -q -- "$BACKUP_MOUNT" || die "BACKUP_MOUNT is not mounted"
mount_device=$("$FINDMNT_BIN" -n -r -o MAJ:MIN --target "$BACKUP_MOUNT") \
  || die "cannot identify BACKUP_MOUNT backing device"
root_device=$("$FINDMNT_BIN" -n -r -o MAJ:MIN --target /) \
  || die "cannot identify root backing device"
[[ "$mount_device" =~ ^[0-9]+:[0-9]+$ && "$root_device" =~ ^[0-9]+:[0-9]+$ ]] \
  || die "ambiguous backing device information"
[[ "$mount_device" != "$root_device" ]] || die "BACKUP_MOUNT is backed by the root device"

mkdir -p -- "$(dirname -- "$LOCK_FILE")" "$WORK_ROOT"
exec 9>"$LOCK_FILE"
if ! flock -n 9; then
  printf 'Another Gitea backup is already running\n' >&2
  exit 75
fi

WORK_DIR=$(mktemp -d "$WORK_ROOT/backup.XXXXXX")
GITEA_WAS_ACTIVE=0
SERVICE_RESTORED=0
STAGED_ARCHIVE=""
STAGED_CHECKSUM=""
STAGED_METADATA=""

restore_service() {
  if ((GITEA_WAS_ACTIVE)) && ! "$SYSTEMCTL_BIN" is-active --quiet gitea; then
    "$SYSTEMCTL_BIN" start gitea
  fi
  SERVICE_RESTORED=1
}

cleanup() {
  local status=$?
  if ((GITEA_WAS_ACTIVE)) && ((SERVICE_RESTORED == 0)); then
    restore_service || status=$?
  fi
  rm -rf -- "$WORK_DIR"

  # The staged checksum is the rollback marker. It remains linked until all
  # three no-clobber links have succeeded, so signal handling never depends on
  # a shell assignment racing an atomic ln. Only unlink a final while its inode
  # still proves that it is this run's hard link; a raced replacement survives.
  if [[ -n "$STAGED_CHECKSUM" && -e "$STAGED_CHECKSUM" ]]; then
    if [[ -n "$STAGED_METADATA" && -e "$BACKUP_DIR/$ARCHIVE.metadata" && ! -L "$BACKUP_DIR/$ARCHIVE.metadata" && "$BACKUP_DIR/$ARCHIVE.metadata" -ef "$STAGED_METADATA" ]]; then
      rm -f -- "$BACKUP_DIR/$ARCHIVE.metadata"
    fi
    if [[ -n "$STAGED_ARCHIVE" && -e "$BACKUP_DIR/$ARCHIVE" && ! -L "$BACKUP_DIR/$ARCHIVE" && "$BACKUP_DIR/$ARCHIVE" -ef "$STAGED_ARCHIVE" ]]; then
      rm -f -- "$BACKUP_DIR/$ARCHIVE"
    fi
    if [[ -e "$BACKUP_DIR/$ARCHIVE.sha256" && ! -L "$BACKUP_DIR/$ARCHIVE.sha256" && "$BACKUP_DIR/$ARCHIVE.sha256" -ef "$STAGED_CHECKSUM" ]]; then
      rm -f -- "$BACKUP_DIR/$ARCHIVE.sha256"
    fi
  fi
  [[ -z "$STAGED_ARCHIVE" ]] || rm -f -- "$STAGED_ARCHIVE"
  [[ -z "$STAGED_CHECKSUM" ]] || rm -f -- "$STAGED_CHECKSUM"
  [[ -z "$STAGED_METADATA" ]] || rm -f -- "$STAGED_METADATA"
  exit "$status"
}
trap cleanup EXIT
trap 'exit 130' INT
trap 'exit 143' TERM

install -d -m 0750 "$BACKUP_DIR"
if [[ -n "$BACKUP_OWNER" ]]; then
  chown "$BACKUP_OWNER" "$BACKUP_DIR"
fi
if [[ -n "$GITEA_RUN_USER" ]]; then
  chown -R "$GITEA_RUN_USER:$GITEA_RUN_USER" "$WORK_DIR"
fi

if "$SYSTEMCTL_BIN" is-active --quiet gitea; then
  GITEA_WAS_ACTIVE=1
  "$SYSTEMCTL_BIN" stop gitea
fi

dump_command=(
  "$GITEA_BIN" dump
  --config "$GITEA_CONFIG"
  --work-path "$GITEA_WORK_PATH"
  --tempdir "$WORK_DIR"
  --type tar.gz
  --file "$WORK_DIR/$ARCHIVE"
  --skip-log
)
if [[ -n "$GITEA_RUN_USER" ]]; then
  sudo -u "$GITEA_RUN_USER" "${dump_command[@]}"
else
  "${dump_command[@]}"
fi

if ((GITEA_WAS_ACTIVE)); then
  restore_service
  for _ in $(seq 1 30); do
    "$CURL_BIN" -fsS http://127.0.0.1:3000/api/v1/version >/dev/null && break
    sleep 1
  done
  "$CURL_BIN" -fsS http://127.0.0.1:3000/api/v1/version >/dev/null
fi

tar -tzf "$WORK_DIR/$ARCHIVE" >"$WORK_DIR/manifest.txt"
for required in app.ini data repos gitea-db.sql; do
  if ! grep -Eq "^(\\./)?${required}(/|$)" "$WORK_DIR/manifest.txt"; then
    printf 'Backup archive is missing mandatory member: %s\n' "$required" >&2
    exit 1
  fi
done

# Build every sidecar before publishing. The checksum is published last and is the
# commit marker: consumers must ignore archives without a matching sidecar.
STAGED_ARCHIVE=$(mktemp "$BACKUP_DIR/.${ARCHIVE}.archive.XXXXXX")
STAGED_CHECKSUM=$(mktemp "$BACKUP_DIR/.${ARCHIVE}.sha256.XXXXXX")
STAGED_METADATA=$(mktemp "$BACKUP_DIR/.${ARCHIVE}.metadata.XXXXXX")
install -m 0640 "$WORK_DIR/$ARCHIVE" "$STAGED_ARCHIVE"
digest=$("$SHA256SUM_BIN" "$STAGED_ARCHIVE" | awk '{print $1}')
[[ "$digest" =~ ^[[:xdigit:]]{64}$ ]] || { printf 'Invalid SHA-256 output\n' >&2; exit 1; }
printf '%s  %s\n' "$digest" "$ARCHIVE" >"$STAGED_CHECKSUM"
printf 'created_utc=%s\narchive=%s\ngitea_config=%s\nformat=gitea-dump-tar.gz\n' \
  "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$ARCHIVE" "$GITEA_CONFIG" >"$STAGED_METADATA"
chmod 0640 "$STAGED_ARCHIVE" "$STAGED_CHECKSUM" "$STAGED_METADATA"
if [[ -n "$BACKUP_OWNER" ]]; then
  chown "$BACKUP_OWNER" "$STAGED_ARCHIVE" "$STAGED_CHECKSUM" "$STAGED_METADATA"
fi
if [[ -e "$BACKUP_DIR/$ARCHIVE" || -e "$BACKUP_DIR/$ARCHIVE.sha256" || -e "$BACKUP_DIR/$ARCHIVE.metadata" ]]; then
  printf 'Refusing to overwrite an existing backup publication: %s\n' "$ARCHIVE" >&2
  exit 1
fi
ln -T -- "$STAGED_METADATA" "$BACKUP_DIR/$ARCHIVE.metadata"
ln -T -- "$STAGED_ARCHIVE" "$BACKUP_DIR/$ARCHIVE"
ln -T -- "$STAGED_CHECKSUM" "$BACKUP_DIR/$ARCHIVE.sha256"

# Removing the staged checksum disarms rollback only after the checksum-last
# commit has succeeded. The other staged links are then safe to unlink.
rm -f -- "$STAGED_CHECKSUM"
rm -f -- "$STAGED_ARCHIVE" "$STAGED_METADATA"

# Expiration applies to the publication as a unit: if any final artifact has
# aged out, remove the archive, checksum, and metadata together.
while IFS= read -r -d '' expired; do
  archive_path=${expired%.sha256}
  archive_path=${archive_path%.metadata}
  rm -f -- "$archive_path" "$archive_path.sha256" "$archive_path.metadata"
done < <(find "$BACKUP_DIR" -maxdepth 1 -type f \
  \( -name 'gitea-dump-*.tar.gz' -o -name 'gitea-dump-*.tar.gz.sha256' -o -name 'gitea-dump-*.tar.gz.metadata' \) \
  -mtime "+$RETENTION_DAYS" -print0)

# Preserve complete legacy archive+checksum pairs that predate metadata. New
# publications are three-file sets; any lone pair member or metadata-bearing
# incomplete set is an interrupted/malformed publication and is removed as a
# unit.
while IFS= read -r -d '' artifact; do
  archive_path=${artifact%.sha256}
  archive_path=${archive_path%.metadata}
  if [[ -f "$archive_path.metadata" ]]; then
    if [[ ! -f "$archive_path" || ! -f "$archive_path.sha256" ]]; then
      rm -f -- "$archive_path" "$archive_path.sha256" "$archive_path.metadata"
    fi
  elif [[ ! -f "$archive_path" || ! -f "$archive_path.sha256" ]]; then
    rm -f -- "$archive_path" "$archive_path.sha256" "$archive_path.metadata"
  fi
done < <(find "$BACKUP_DIR" -maxdepth 1 -type f \
  \( -name 'gitea-dump-*.tar.gz' -o -name 'gitea-dump-*.tar.gz.sha256' -o -name 'gitea-dump-*.tar.gz.metadata' \) -print0)

printf 'Backup verified: %s\n' "$BACKUP_DIR/$ARCHIVE"