From 055bfb8ed00ae1c508b7ff7c1707997ff23c603f Mon Sep 17 00:00:00 2001 From: Daniel Date: Fri, 17 Jul 2026 17:54:46 +0000 Subject: [PATCH] reset-data.sh: require typed confirmation + auto pre-backup by default - local wrapper now prompts interactively for the operator to type the exact DEPLOY_TARGET before it will even upload/run the remote script; refuses to run without a TTY. --yes alone is no longer enough. - remote script takes a fresh backup.sh snapshot right before wiping mongo/redis/minio (aborts the reset if the backup fails) unless --skip-backup is explicitly passed on both ends. Co-authored-by: Cursor --- deploy/prod/remote/reset-data.sh | 35 ++++++++++++++++++++++++++-- deploy/prod/reset-data.sh | 40 +++++++++++++++++++++++++++++--- 2 files changed, 70 insertions(+), 5 deletions(-) diff --git a/deploy/prod/remote/reset-data.sh b/deploy/prod/remote/reset-data.sh index 850306f..24a7699 100755 --- a/deploy/prod/remote/reset-data.sh +++ b/deploy/prod/remote/reset-data.sh @@ -11,14 +11,42 @@ if ! flock -n 9; then exit 1 fi -if [[ "${1:-}" != "--yes" ]]; then - printf '%s\n' "usage: reset-data.sh --yes" >&2 +skip_backup=0 +yes_flag=0 +for a in "$@"; do + case "$a" in + --yes) yes_flag=1 ;; + --skip-backup) skip_backup=1 ;; + *) + printf '%s\n' "unknown argument: $a" >&2 + exit 1 + ;; + esac +done +if [[ "$yes_flag" != 1 ]]; then + printf '%s\n' "usage: reset-data.sh --yes [--skip-backup]" >&2 printf '%s\n' "this permanently deletes all Mongo, Redis, and MinIO data" >&2 exit 1 fi compose=(docker compose --env-file /etc/harbor/harbor.env -f /opt/harbor/deploy/compose/docker-compose.yml) +if [[ "$skip_backup" == 1 ]]; then + printf '%s\n' "--skip-backup given: NOT taking a safety backup before wiping data" +else + printf '%s\n' "taking a safety backup before wiping data (use --skip-backup to skip)" + set -a + # shellcheck disable=SC1091 + . /etc/harbor/harbor.env + set +a + if ! BACKUP_DIR=/var/backups/harbor BACKUP_STATUS_DIR=/opt/harbor/deploy/backup/status \ + /opt/harbor/deploy/backup/backup.sh; then + printf '%s\n' "pre-reset backup failed — aborting without touching any data" >&2 + printf '%s\n' "re-run with --skip-backup if you really want to proceed without one" >&2 + exit 1 + fi +fi + printf '%s\n' "stopping app slots" for slot in blue green; do systemctl stop "harbor-gateway@$slot.service" 2>/dev/null || true @@ -39,4 +67,7 @@ rm -f /etc/harbor/admin-seeded /etc/harbor/initial-admin-credentials printf '%s\n' "data reset complete: mongo/redis/minio are now empty" printf '%s\n' "monitoring volumes (prometheus/grafana/loki/alertmanager) were left untouched" +if [[ "$skip_backup" != 1 ]]; then + printf '%s\n' "pre-reset safety backup is under /var/backups/harbor (see backup.sh output above for the exact timestamp)" +fi printf '%s\n' "next: run release.sh to redeploy app code, run forward migrations, and reseed the admin account" diff --git a/deploy/prod/reset-data.sh b/deploy/prod/reset-data.sh index 0f223d9..22bc7fb 100755 --- a/deploy/prod/reset-data.sh +++ b/deploy/prod/reset-data.sh @@ -6,9 +6,38 @@ TARGET=${DEPLOY_TARGET:-daniel@10.0.0.33} SSH_KEY=${DEPLOY_SSH_KEY:-$HOME/.ssh/harbor_deploy} ssh_opts=(-i "$SSH_KEY" -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes) -if [[ "${1:-}" != "--yes" ]]; then - printf '%s\n' "usage: reset-data.sh --yes" >&2 +skip_backup=0 +yes_flag=0 +for a in "$@"; do + case "$a" in + --yes) yes_flag=1 ;; + --skip-backup) skip_backup=1 ;; + *) + printf '%s\n' "unknown argument: $a" >&2 + exit 1 + ;; + esac +done + +if [[ "$yes_flag" != 1 ]]; then + printf '%s\n' "usage: reset-data.sh --yes [--skip-backup]" >&2 printf '%s\n' "this permanently deletes all Mongo, Redis, and MinIO data on $TARGET" >&2 + printf '%s\n' "(a fresh backup is taken first unless --skip-backup is given)" >&2 + exit 1 +fi + +# Second confirmation: require the operator to type the exact target so a +# muscle-memory "--yes" (or a copy-pasted command) can't wipe the wrong host. +if [[ -t 0 ]]; then + printf '%s\n' "About to permanently delete ALL Mongo, Redis, and MinIO data on: $TARGET" + printf '%s' "Type the target above to confirm: " + read -r confirm_target + if [[ "$confirm_target" != "$TARGET" ]]; then + printf '%s\n' "confirmation did not match \"$TARGET\" — aborted" >&2 + exit 1 + fi +else + printf '%s\n' "refusing to run non-interactively: no TTY to type the confirmation" >&2 exit 1 fi @@ -16,6 +45,11 @@ printf '%s\n' "uploading reset-data.sh" rsync -az -e "ssh -i $SSH_KEY -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \ "$SCRIPT_DIR/remote/reset-data.sh" "$TARGET:/tmp/harbor-reset-data.sh" +remote_args=(--yes) +if [[ "$skip_backup" == 1 ]]; then + remote_args+=(--skip-backup) +fi + printf '%s\n' "The remote host may request the sudo password once." ssh -t "${ssh_opts[@]}" "$TARGET" \ - "sudo install -o root -g root -m 0755 /tmp/harbor-reset-data.sh /opt/harbor/deploy/remote/reset-data.sh && rm -f /tmp/harbor-reset-data.sh && sudo /opt/harbor/deploy/remote/reset-data.sh --yes" + "sudo install -o root -g root -m 0755 /tmp/harbor-reset-data.sh /opt/harbor/deploy/remote/reset-data.sh && rm -f /tmp/harbor-reset-data.sh && sudo /opt/harbor/deploy/remote/reset-data.sh ${remote_args[*]}"