konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

fix: Simplify restore script using mc in PG pod

Browse Source 
Downloads backup from RustFS S3 directly into the CNPG pod using
the MinIO client. No extra pods or complex orchestration needed.
Requires AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
k.renner
2026-04-13 16:22:51 +02:00
co-authored by Claude Opus 4.6
parent 1f0e3f54e3
commit 49db7668e1
1 changed files with 26 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/restore-authentik-db.sh
+26 -21
View File
@@ -2,24 +2,26 @@
set -euo pipefail
# Restore Authentik database from RustFS backup into K8s CloudNativePG
# Prerequisites: kubectl configured, aws-cli configured for RustFS
#
# Usage: ./restore-authentik-db.sh
# Prerequisites:
# - kubectl configured
# - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars set (RustFS creds)
#
# Usage:
# export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=...
# ./restore-authentik-db.sh
S3_ENDPOINT="http://s3.renner.uno:9000"
S3_BUCKET="migration"
S3_KEY="authentik-backup.dump"
NAMESPACE="authentik"
PG_POD="ak-pg-1"
DUMP_PATH="/tmp/authentik-backup.dump"
: "${AWS_ACCESS_KEY_ID:?Set AWS_ACCESS_KEY_ID}"
: "${AWS_SECRET_ACCESS_KEY:?Set AWS_SECRET_ACCESS_KEY}"
echo "=== Authentik DB Restore ==="
# Download backup from S3
echo "Downloading backup from S3..."
aws --endpoint-url "$S3_ENDPOINT" s3 cp "s3://$S3_BUCKET/$S3_KEY" "$DUMP_PATH"
ls -lh "$DUMP_PATH"
# Scale down Authentik
echo "Scaling down Authentik..."
kubectl scale -n "$NAMESPACE" deploy/authentik-server --replicas=0
@@ -27,28 +29,31 @@ kubectl scale -n "$NAMESPACE" deploy/authentik-worker --replicas=0
kubectl wait -n "$NAMESPACE" --for=delete pod -l app.kubernetes.io/name=authentik --timeout=120s 2>/dev/null || true
sleep 5
# Copy dump into PG pod
echo "Copying dump to $PG_POD..."
kubectl cp "$DUMP_PATH" "$NAMESPACE/$PG_POD:/tmp/authentik-backup.dump" -c postgres
# Install mc (MinIO client) in the PG pod and download the backup
echo "Downloading backup into PG pod..."
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- bash -c "
curl -sfL https://dl.min.io/client/mc/release/linux-amd64/mc -o /tmp/mc && chmod +x /tmp/mc
/tmp/mc alias set rustfs '$S3_ENDPOINT' '$AWS_ACCESS_KEY_ID' '$AWS_SECRET_ACCESS_KEY'
/tmp/mc cp rustfs/$S3_BUCKET/$S3_KEY /tmp/backup.dump
ls -lh /tmp/backup.dump
"
# Restore
echo "Restoring database..."
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- pg_restore \
--clean --if-exists \
--no-owner --no-privileges \
--dbname=authentik \
/tmp/authentik-backup.dump || echo "Warning: pg_restore reported errors (usually safe to ignore for pre-existing objects)"
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- \
pg_restore --clean --if-exists --no-owner --no-privileges \
--dbname=authentik /tmp/backup.dump \
|| echo "Warning: pg_restore reported errors (usually safe to ignore for pre-existing objects)"
# Cleanup
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- rm /tmp/authentik-backup.dump
rm -f "$DUMP_PATH"
echo "Cleaning up..."
kubectl exec -n "$NAMESPACE" "$PG_POD" -c postgres -- rm -f /tmp/backup.dump /tmp/mc
# Scale Authentik back up
# Scale back up
echo "Scaling up Authentik..."
kubectl scale -n "$NAMESPACE" deploy/authentik-server --replicas=2
kubectl scale -n "$NAMESPACE" deploy/authentik-worker --replicas=2
kubectl wait -n "$NAMESPACE" --for=condition=Ready pod -l app.kubernetes.io/component=server --timeout=120s
echo "=== Restore Complete ==="
echo "Authentik is running with the migrated database."
echo "All users, passwords, 2FA devices, and sessions are preserved."
echo "All users, passwords, 2FA devices, and sessions preserved."