reset-data.sh: require typed confirmation + auto pre-backup by default

- local wrapper now prompts interactively for the operator to type the
  exact DEPLOY_TARGET before it will even upload/run the remote script;
  refuses to run without a TTY. --yes alone is no longer enough.
- remote script takes a fresh backup.sh snapshot right before wiping
  mongo/redis/minio (aborts the reset if the backup fails) unless
  --skip-backup is explicitly passed on both ends.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/prod/remote/reset-data.sh

@@ -11,14 +11,42 @@ if ! flock -n 9; then
   exit 1
 fi
 
-if [[ "${1:-}" != "--yes" ]]; then
-  printf '%s\n' "usage: reset-data.sh --yes" >&2
+skip_backup=0
+yes_flag=0
+for a in "$@"; do
+  case "$a" in
+    --yes) yes_flag=1 ;;
+    --skip-backup) skip_backup=1 ;;
+    *)
+      printf '%s\n' "unknown argument: $a" >&2
+      exit 1
+      ;;
+  esac
+done
+if [[ "$yes_flag" != 1 ]]; then
+  printf '%s\n' "usage: reset-data.sh --yes [--skip-backup]" >&2
   printf '%s\n' "this permanently deletes all Mongo, Redis, and MinIO data" >&2
   exit 1
 fi
 
 compose=(docker compose --env-file /etc/harbor/harbor.env -f /opt/harbor/deploy/compose/docker-compose.yml)
 
+if [[ "$skip_backup" == 1 ]]; then
+  printf '%s\n' "--skip-backup given: NOT taking a safety backup before wiping data"
+else
+  printf '%s\n' "taking a safety backup before wiping data (use --skip-backup to skip)"
+  set -a
+  # shellcheck disable=SC1091
+  . /etc/harbor/harbor.env
+  set +a
+  if ! BACKUP_DIR=/var/backups/harbor BACKUP_STATUS_DIR=/opt/harbor/deploy/backup/status \
+      /opt/harbor/deploy/backup/backup.sh; then
+    printf '%s\n' "pre-reset backup failed — aborting without touching any data" >&2
+    printf '%s\n' "re-run with --skip-backup if you really want to proceed without one" >&2
+    exit 1
+  fi
+fi
+
 printf '%s\n' "stopping app slots"
 for slot in blue green; do
   systemctl stop "harbor-gateway@$slot.service" 2>/dev/null || true
@@ -39,4 +67,7 @@ rm -f /etc/harbor/admin-seeded /etc/harbor/initial-admin-credentials
 
 printf '%s\n' "data reset complete: mongo/redis/minio are now empty"
 printf '%s\n' "monitoring volumes (prometheus/grafana/loki/alertmanager) were left untouched"
+if [[ "$skip_backup" != 1 ]]; then
+  printf '%s\n' "pre-reset safety backup is under /var/backups/harbor (see backup.sh output above for the exact timestamp)"
+fi
 printf '%s\n' "next: run release.sh to redeploy app code, run forward migrations, and reseed the admin account"

deploy/prod/reset-data.sh

@@ -6,9 +6,38 @@ TARGET=${DEPLOY_TARGET:-daniel@10.0.0.33}
 SSH_KEY=${DEPLOY_SSH_KEY:-$HOME/.ssh/harbor_deploy}
 ssh_opts=(-i "$SSH_KEY" -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes)
 
-if [[ "${1:-}" != "--yes" ]]; then
-  printf '%s\n' "usage: reset-data.sh --yes" >&2
+skip_backup=0
+yes_flag=0
+for a in "$@"; do
+  case "$a" in
+    --yes) yes_flag=1 ;;
+    --skip-backup) skip_backup=1 ;;
+    *)
+      printf '%s\n' "unknown argument: $a" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ "$yes_flag" != 1 ]]; then
+  printf '%s\n' "usage: reset-data.sh --yes [--skip-backup]" >&2
   printf '%s\n' "this permanently deletes all Mongo, Redis, and MinIO data on $TARGET" >&2
+  printf '%s\n' "(a fresh backup is taken first unless --skip-backup is given)" >&2
+  exit 1
+fi
+
+# Second confirmation: require the operator to type the exact target so a
+# muscle-memory "--yes" (or a copy-pasted command) can't wipe the wrong host.
+if [[ -t 0 ]]; then
+  printf '%s\n' "About to permanently delete ALL Mongo, Redis, and MinIO data on: $TARGET"
+  printf '%s' "Type the target above to confirm: "
+  read -r confirm_target
+  if [[ "$confirm_target" != "$TARGET" ]]; then
+    printf '%s\n' "confirmation did not match \"$TARGET\" — aborted" >&2
+    exit 1
+  fi
+else
+  printf '%s\n' "refusing to run non-interactively: no TTY to type the confirmation" >&2
   exit 1
 fi
 
@@ -16,6 +45,11 @@ printf '%s\n' "uploading reset-data.sh"
 rsync -az -e "ssh -i $SSH_KEY -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" \
   "$SCRIPT_DIR/remote/reset-data.sh" "$TARGET:/tmp/harbor-reset-data.sh"
 
+remote_args=(--yes)
+if [[ "$skip_backup" == 1 ]]; then
+  remote_args+=(--skip-backup)
+fi
+
 printf '%s\n' "The remote host may request the sudo password once."
 ssh -t "${ssh_opts[@]}" "$TARGET" \
-  "sudo install -o root -g root -m 0755 /tmp/harbor-reset-data.sh /opt/harbor/deploy/remote/reset-data.sh && rm -f /tmp/harbor-reset-data.sh && sudo /opt/harbor/deploy/remote/reset-data.sh --yes"
+  "sudo install -o root -g root -m 0755 /tmp/harbor-reset-data.sh /opt/harbor/deploy/remote/reset-data.sh && rm -f /tmp/harbor-reset-data.sh && sudo /opt/harbor/deploy/remote/reset-data.sh ${remote_args[*]}"